A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The code is plainly written and easy to read. It handles on-screen visuals, edit dialogs, and progress bars for a chat summarizer extension. There is no hidden or scrambled code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is fully readable, commented JavaScript with no obfuscation patterns: no eval, no encoded strings, no packed code, no dynamic code generation beyond standard template literals for DOM element construction. All imports resolve to local modules or the SillyTavern extension API. The JS-X-Ray signal at low confidence is a false positive on ordinary template-literal HTML construction and jQuery DOM manipulation.