The scanner noticed URL-shaped text in this file. Those are just standard labels that say which version of the JSON format the AI's answer should follow; they are not links the extension visits. The code only talks to the model connection the user already has set up in SillyTavern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged 'shady-link' signal corresponds to the JSON Schema dialect identifier strings embedded in the structured-output schema objects used for LLM responses; five such schema constants appear in this module, matching the reported occurrence count. These are declarative schema-version markers passed through SillyTavern's generation API, not network requests, fetch targets, or remote script loading. The module's visible request routing funnels calls through the host's LLM APIs with queueing and rate limiting, consistent with the extension's stated purpose. No outbound destination beyond the user-configured model provider is demonstrated.
The scanner suggested this interface file might be obfuscated. The actual code is ordinary, well-commented extension UI code that builds dialogs and buttons, and it even escapes user text before displaying it. Nothing is concealed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscation signal on the UI module is contradicted by the supplied source: it is straightforward, commented module code that imports project helpers, renders popups via SillyTavern's Popup API, escapes user-controlled lorebook names and content before inserting them into markup, and wires settings controls. There is no minified blob, encoded string decoding, dynamic code evaluation, or hidden control flow. The flagged heuristic is a false positive on readable code.
An automated scanner thought this file might be deliberately scrambled to hide what it does. Reading the actual code shows it is normal, clearly written extension code that builds settings screens, lists lorebook entries, and manages backups. Nothing is hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The scanner flagged an obfuscation signal on the extension's main entry module, but the supplied source is plain, readable ES-module JavaScript with clear identifiers, ordinary SillyTavern extension-API usage (settings UI wiring, lorebook loading, backup history rendering, slash-command registration), and no encoded payloads, packed strings, eval-style construction, or concealed logic. The obfuscation heuristic appears to be a false positive on readable code; no hidden execution, exfiltration, or unusual data flow is present in the shown behavior.