A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The extension sends requests only to your local SillyTavern server to save group chat settings, which is exactly what a group-chat management extension should do. No evidence of downloading and running remote code was found in the supplied source.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a correlation between a network retrieval primitive and a code execution sink across an extremely broad line range (3388-9149, roughly 5761 lines). The only network primitive visible in the supplied source is fetch('/api/groups/edit', ...) inside saveGroup(), which calls the local SillyTavern server API to persist group reply-strategy settings. This is standard, expected behavior for a SillyTavern extension that manages group chat routing. No eval(), Function constructor, dynamic script injection, setTimeout/setInterval with string arguments, or any other dynamic code execution sink is visible in the provided source context. The fetch destination is a relative local API path, not an external endpoint. The scanner's broad same-representation correlation does not demonstrate a download-to-execution data flow. The visible code consists of group-member selection logic, protocol prompt template management, and group settings persistence—all consistent with the project's stated purpose of automating group chat character responses.
Local SillyTavern API call for group settings persistence
low risk · high confidence
The extension saves group chat settings by sending them to your local SillyTavern server, which is the expected way for a group management extension to work.
Technical assessment
The saveGroup function calls fetch('/api/groups/edit', ...) using context.getRequestHeaders() for authentication headers, which is the standard SillyTavern extension pattern for persisting group configuration changes. The destination is a local relative API path, not an external service. This fetch is used by forceManualStrategyForCurrentGroup and restoreOriginalStrategyForCurrentGroup to set or restore the group activation strategy, which directly matches the extension's stated purpose of overriding group reply strategy.