A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The scanner flagged this file as possibly obfuscated, but the code is plain and readable. It's a standard SillyTavern extension with clear comments and normal variable names.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is fully human-readable JavaScript: descriptive variable names (MODULE, settings, RETHINK_MODES, WIDGET_ITEMS), plain comments, standard jQuery initialization (jQuery(function(){initAll();})), and straightforward SillyTavern module imports. No eval, no encoded strings, no packed/minified blobs, no dynamic code generation from opaque data. The scanner's low-confidence obfuscation signal is a false positive against ordinary extension boilerplate. No concealed execution, credential access, or network exfiltration is present in the reviewed context.
Readable header and plain declarations at file top
low risk · high confidence
The file starts with a plain header comment and simple variable declarations, which is normal and not obfuscated.
Technical assessment
Lines 1-12 contain a standard file header comment followed by plain top-level variable declarations (MODULE, scriptModule, chatModule, extsModule, settings). This is ordinary, readable extension initialization code with no obfuscation indicators.