The scanner flagged links in this file, but the only URLs present are standard JSON Schema specification identifiers repeated across multiple schema definitions. These are not fetched or used for network access — they are metadata labels required by the JSON Schema standard.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner flagged this file for obfuscation, but the actual code is clearly readable JavaScript with standard imports, UI popup construction, and event handling. There is no hidden or encoded code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source for file is transparent ES module JavaScript: named imports from local modules, prompt preset constants, pure utility functions (filterEntries, computeCascadeFixedIssues), a session cache object, and a large openMainPopup function that builds HTML template strings and wires up DOM event handlers. No eval, no encoded strings, no packed code, no concealed execution. The obfuscated-code scanner signal at low confidence is a false positive; the visible code is fully readable.
The scanner flagged this file for obfuscation, but the actual code shown is plainly readable, well-structured JavaScript with clear imports, comments, and standard SillyTavern extension patterns. There is no hidden or encoded code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source for file is transparent ES module JavaScript: named imports from local modules, frozen default settings, jQuery initialization, slash-command registration, lorebook selection UI wiring, and backup history rendering. No eval, no encoded strings, no packed code, no concealed execution. The obfuscated-code scanner signal at low confidence is a false positive; the visible code contains no obfuscation.
HTML output uses escapeHtml/escapeAttr consistently
low risk · high confidence
User-controlled values like lorebook names are escaped before being inserted into HTML, which is good practice.
Technical assessment
The code uses escapeAttr and escapeHtml when injecting lorebook names and entry fields into HTML option and div elements, which is correct defensive practice for preventing XSS in a browser extension context.
LLM request queue uses standard SillyTavern API with rate limiting
low risk · high confidence
The LLM request code routes through SillyTavern's own API and includes rate-limiting and retry logic, which matches the extension's stated purpose of rewriting lorebook entries via the active connection.
Technical assessment
The request router (queueLLMRequest) serializes LLM calls through a single promise queue with configurable interval pacing and abort signal support. No external network calls are made directly; the task function is passed in by callers that use SillyTavern's generateRaw or ConnectionManagerRequestService, consistent with the project's stated use of the active LLM connection.
UI HTML rendering uses escapeHtml/escapeAttr and safe DOM APIs
low risk · high confidence
When displaying AI-generated or user-entered text in the popup, the code escapes HTML to prevent injection, which is correct practice.
Technical assessment
The UI code uses escapeHtml and escapeAttr when interpolating lorebook names, entry content, and chat history into HTML template strings. Dynamic option elements are created via document.createElement with textContent assignment, avoiding innerHTML for untrusted data.