This part of the extension asks the SillyTavern host app for a breakdown of how the user's prompt is put together, then draws a bar chart of it in the extension's panel. The data comes from the user's own server, is shown as plain text, and is never run as code. The scanner flagged it only because a large bundled file happened to contain both a network call and something that looked like dynamic code use somewhere in the same file; nothing in the actual behavior connects the two.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a broad line range in a generated browser bundle because it contains both a network primitive and an apparent dynamic-construct sink somewhere in the same representation. In the supplied code, the network activity consists solely of same-origin fetches to the host's own generate-breakdown and dry-run API endpoints, sending only a chat identifier with same-origin credentials, which is the normal way a frontend panel reads host prompt statistics. The responses are normalized into typed token-count records and rendered exclusively through DOM element creation with text assignment; no fetched bytes are passed into any script evaluation, command execution, or HTML parsing sink in the visible data flow. No retrieved content is stored, persisted, or forwarded anywhere beyond the local UI. The correlation heuristic across a large minified bundle does not establish a download-to-execution relationship.
The scanner noticed code that mentions a special JavaScript property name often abused in prototype-pollution attacks. Reading the actual code, that mention is a safety check: the program deliberately refuses to process that property when copying user-provided data. This is the opposite of a problem—it is protection against the very issue the scanner was hunting for.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.
Contextual assessment: The flagged line is part of a codex-file validation helper that iterates unknown keys from user-supplied JSON and copies whitelisted primitive values onto an output object. The literal that triggered the prototype-pollution signal is an explicit defensive guard: when a key equals the prototype accessor name, the loop skips that key entirely before any assignment occurs. All other copied values are restricted to strings, finite numbers, booleans, or arrays of strings, and assignment happens on a freshly created plain object within the extension's own validation flow. The supplied code shows a mitigation, not a pollution sink, and no path where attacker-controlled keys reach a sensitive object's prototype chain.
The file is a bundled JavaScript file produced by a build tool. It looks compressed because many source files were combined into one, but the actual content is normal interface styling and UI code with nothing hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged obfuscated-code at line 1 of the generated frontend bundle. The supplied source context shows readable CSS style strings and straightforward DOM manipulation code (document.createElement, classList, event listeners). This is a standard bun build output where multiple TypeScript modules are concatenated into a single file. The structure is consistent with a bundler artifact, not deliberate obfuscation. No encoded payloads, eval-based string execution, or concealed logic are present in the visible evidence.
This file stores a small avatar image as embedded text data for display in the extension interface. It does not connect to any website, send data anywhere, or perform any network activity. The scanner alert is a false positive caused by the large encoded image string.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner flagged something that looked link-like in the interface code. Looking at the actual code around it, everything shown is normal user-interface work: building popups, buttons, graphs, and an embedded character portrait image. Nothing in the supplied evidence sends data to any outside server, and the scanner could not record what exact text it matched, so there is no demonstrated network behavior to worry about.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner raised a link-related signal at a line that, in the supplied context, is the tail of a DOM-building call in modal UI code. The surrounding frontend bundle shows only local browser operations: creating elements, attaching event listeners, writing to the clipboard API, embedding an inline base64 image avatar, and rendering an SVG relation graph with a force-layout library. No outbound network destination, request primitive, or remote fetch to any external service appears anywhere in the supplied evidence window, and the scanner did not retain the matched literal values. The signal is most plausibly explained by benign string content such as the inline data URI or namespace constants rather than a covert network call, and no attacker-controlled data flow to a remote destination is demonstrated.