The map viewer displays the user's own map projects and can run small automation scripts that the user themselves configured for each region. This is a documented, user-visible feature of the extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: JS-X-Ray flagged 5 occurrences of a network or execution signal. The shown code renders an SVG map viewer, intercepts the send button to inject an extension prompt (setExtensionPrompt) with region context, and optionally calls executeSlashCommands(region.script) where region.script is a user-authored STscript string stored in the user's own map project configuration. The README explicitly documents this as 'Optional STscript on click.' No data from untrusted remote sources is passed to the execution sink; the region object comes from the user's own saved project state.
The flagged links are calls to the SillyTavern server's own built-in API for saving and loading map project files. This is exactly what the extension is designed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.