The code builds a search pattern from character or user names to replace them with placeholders. While the names are escaped to prevent special characters from causing problems, dynamically built search patterns can be inefficient with certain inputs. The code has a fallback if the pattern is unsupported, limiting any impact to a brief slowdown at worst.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner noticed both network fetching and code-like operations in the same file. However, the network fetch only retrieves avatar images from the SillyTavern server itself, and the other operations are PNG image processing and canvas drawing. There is no path from downloaded data to code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner flagged this code as potentially obfuscated, but the visible source is plain, readable JavaScript with clear comments, standard extension imports, and bilingual localization strings. There is no hidden or scrambled code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscated-code signal on line 1 is a false positive. The supplied source shows fully readable, well-commented JavaScript: standard SillyTavern extension imports from script.js and extensions.js, an import.meta.url folder-name detection pattern, and a large bilingual (Thai/English) LOCALES object for UI internationalization. No eval, hex encoding, string array rotation, encoded payloads, or minified/obfuscated constructs are present. The code structure is transparent and consistent with a hobbyist SillyTavern extension.