A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The scanner flagged a localhost web address, but it is simply the default local address for Ollama, a common local AI tool. It is used as a last-resort fallback so the extension works out of the box. No data is sent to any suspicious external site.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The scanner flagged a localhost web address, but it is just the default local address for Ollama, a common local AI tool. It serves as a fallback so retrieval works without manual configuration. No data is sent to any suspicious external site.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
All fetch calls target SillyTavern's own vector API endpoints
low risk · high confidence
All network calls in this file go to the extension's own host server, not to any external address. The only URL literal present is the standard local Ollama address used as a fallback.
Technical assessment
The embedEntry and deleteEntryVector functions both issue fetch calls to relative ST endpoints (/api/vector/insert, /api/vector/delete) using getRequestHeaders. The only absolute URL literal in the file is the Ollama default localhost address used as a provider fallback. No external destination is contacted directly by client-side code.
The sole fetch call targets SillyTavern's own vector query endpoint
low risk · high confidence
The only network call in this file's query function goes to the extension's own host server, not to any external address. The only URL literal is the standard local Ollama address used as a fallback.
Technical assessment
The queryCollection function issues a fetch to the relative ST endpoint /api/vector/query using getRequestHeaders. The only absolute URL literal present is the Ollama default localhost address, used as a provider fallback in the request body. No external destination is contacted directly by client-side code.