A scanner paired a network request with a code-execution pattern in the same file and flagged it. In reality, the extension only asks the user's own SillyTavern server for the user's saved lorebook entries and pastes that text into the AI prompt. Nothing that is downloaded is ever run as code, and this is exactly the feature the extension advertises.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged download-to-execution correlation is not supported by the actual data flow. The retrieval is a relative, same-origin request to the host SillyTavern server's world-info endpoint, carrying the host-provided request headers, and it is only a fallback used when the host context's own loading method is unavailable. The response is parsed as structured world-book data, cached in memory, and its entry text is inserted into LLM prompt content for scenario generation. No fetched content is passed to any dynamic evaluation sink, and the request never leaves the user's own server. This matches the documented world-info context feature exactly.
A scanner suggested this file might be obfuscated, but the code is ordinary, readable interface code that builds the extension's dialog and dropdowns. Nothing is hidden or disguised; it only reads information the user already has in SillyTavern to populate the interface.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscation signal is a false positive on plainly readable UI code. The supplied source shows a modal class that builds its interface from legible template-literal markup, reads host state such as characters, personas, chat activity, and settings, and uses an escaping helper before inserting character names into markup. The scanner's low confidence, together with long inline HTML strings and non-ASCII characters that commonly trigger this heuristic, supports treating this as expected extension behavior with no concealed logic.
The extension asks the SillyTavern app running on the user's own machine for the user's saved lorebook entries so it can show them in a picker, and then displays those entries on screen with their text cleaned up. It never downloads and runs code. The alert is a false alarm triggered by seeing a web request and popup-building code in the same file.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged span contains a same-origin, relative-URL request to the host SillyTavern server's world info endpoint, used only as a fallback when the host-provided loader is unavailable, and authenticated with the host context's standard request headers. The response is parsed as structured data, cached in memory, and rendered through DOM construction with an HTML escaping helper applied to the book name, title, keys, and content shown to the user. There is no dynamic code evaluation, function construction from strings, script injection, or command execution anywhere in the supplied file. The scanner's correlation pairs ordinary network retrieval with markup-building UI code in the same file; the retrieved data is displayed, not executed. Reading the user's own world info is a core, disclosed capability of this extension, whose stated purpose includes selecting lorebook entries as generation context. No exfiltration destination, obfuscation, or out-of-purpose behavior is present.
A scanner thought this file might contain disguised, hard-to-read code. Looking at the actual code, it is plain and readable: it sets up the extension's interface and commands, and everything it does matches what the extension's documentation says it does. There is no hidden or scrambled code here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscation signal does not correspond to the supplied source. The entry file is fully readable: it uses static imports from the host application and local extension modules, lazily imports the extension's own local modules during initialization, registers slash commands, and appends a menu button. There are no encoded payloads, string-decoding routines, packed code, or concealed execution paths. The capabilities present, including slash-command registration, chat manipulation on generation, connection-profile switching with restoration, and a small global handle for other extensions, are proportionate to and disclosed by the project's stated scenario-generation purpose. The scanner's low confidence and the plainly legible code indicate a false positive, plausibly triggered by long HTML help strings, template literals, or non-ASCII characters.
A scanner flagged this file as possibly obfuscated, but it is ordinary, readable settings code. It saves the user's own preferences, like default tone and history settings, in the browser's local storage. No sensitive data is stored and nothing is hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscation signal does not match the supplied source. The file is readable settings-management code: it defines default preferences, renders a settings panel with legible markup, persists those preferences in the browser's local storage, and exposes accessors used by the rest of the extension. No credentials or secrets are stored, no encoded or decoded payloads exist, and persistence is limited to user-chosen configuration values for the extension's documented options. The scanner's low confidence and the long multi-line prompt strings with non-ASCII characters are consistent with a heuristic false positive.
Inconsistent escaping of entry identifier and dynamically built selection matching
low risk · medium confidence
The popup cleans most text before showing it, but two behind-the-scenes spots skip that cleanup. Because the data comes from the user's own setup and nothing harmful is shown to be possible, this is a tidiness and reliability issue rather than a danger.
Technical assessment
Nearly every user-visible value rendered from world book data passes through an HTML escaping helper, but the entry identifier is interpolated directly into an attribute in the entry markup, and book names are interpolated into dynamically constructed selector text used for book-level select and deselect actions. Both inputs originate from the user's own locally stored world info, so no attacker-controlled path or concrete harm is demonstrated. The gaps are hardening and reliability issues: unusual book names could break selector matching and behave incorrectly rather than cause any demonstrated security impact.
Impact: low · Exploitability: unlikely
Developer action: For consistency, pass the entry identifier through the same escaping helper used for neighboring values, and implement book-level selection by iterating rendered elements and comparing stored data attributes instead of interpolating names into selector text.