The scanner flagged this file as potentially obfuscated, but the code is plain, readable JavaScript with clear comments. It is a localization module that stores English and Russian UI text strings. There is no hidden or encoded behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The source for i18n.js is fully readable, well-commented JavaScript defining a STRINGS object with EN/RU translation key-value pairs. There is no minification, encoding, eval, character-array obfuscation, or concealed logic. The module reads localStorage['language'] and SillyTavern.getContext() for locale detection, which is proportionate and disclosed in comments. The JS-X-Ray obfuscated-code signal (scanner_confidence=low) is a false positive triggered by the static representation, not by any actual obfuscation present in the supplied source.
The scanner flagged this file as potentially obfuscated, but the code is plain, readable JavaScript with extensive comments. It assembles memory context and injects it into the prompt before generation, which is exactly what this memory extension is designed to do. No hidden or malicious behavior is present.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The source for injector.js is fully readable, well-commented JavaScript. It imports from sibling extension modules, reads settings via getSettings(), accesses SillyTavern.getContext(), and calls ctx.setExtensionPrompt() to inject assembled memory blocks before generation. This is the core stated purpose of the Chaotic Lorebooks extension. There is no eval, no obfuscation, no encoded strings, no external network calls, and no credential access. The injection uses ST's native setExtensionPrompt API with standard position enums. The JS-X-Ray obfuscated-code signal (scanner_confidence=low) is a false positive on the static representation.
The scanner flagged this file as potentially obfuscated, but the code is plain, readable JavaScript that builds the extension's UI drawer. It displays memory, saved items, and thought buffer tabs. User-controlled text is consistently escaped before insertion into HTML. No hidden or malicious behavior is present.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The source for tree-ui.js is fully readable, well-commented JavaScript that builds a mobile-first sliding drawer UI. It uses innerHTML with template literals for static structure, but consistently applies escapeHtml() and escapeAttr() to user-controlled or dynamic data (e.g., gist text, entry titles, drift details, arc content) before insertion. There is no eval, no obfuscation, no encoded strings, no external network calls, and no credential access. All imports are from sibling extension modules. The JS-X-Ray obfuscated-code signal (scanner_confidence=low) is a false positive on the static representation.
The file is straightforward localization code with no hidden logic.
Technical assessment
Lines 1-13 show a clearly documented header explaining the module's purpose as a self-contained EN/RU localization leaf module. The code is transparent with no obfuscation techniques present.
Prompt injection uses standard ST API with cache-clear safety
low risk · high confidence
The injection logic uses ST's standard API and includes a cache-clear on chat switch to prevent cross-chat memory leakage, which is a safety feature.
Technical assessment
Lines 21-27 show the injection key and cache variables. resetInjectCache() clears the swipe cache on chat switch specifically to prevent leaking the previous chat's memory into a new chat, demonstrating defensive design rather than malicious data flow.
Consistent HTML escaping of dynamic content in UI rendering
low risk · high confidence
User-controlled text shown in the UI is escaped to prevent injection, showing good security practice.
Technical assessment
Lines 86-91 in showLegend() apply escapeHtml() to translation strings before inserting them into innerHTML. This pattern is repeated throughout the file for all dynamic content, indicating consistent XSS-aware coding rather than careless innerHTML usage.