No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger
0 material
2 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (1)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged URLs are just default local addresses for the user's own image generation software running on their machine. This is exactly what an image generation extension is supposed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Scanner javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule javascript.xray.shady-link
File role production
Source src/profiles.js:31
Related contextual observations
Second localhost default URL for A1111/Forge backend
low risk · high confidence
The autoUrl default also points to localhost, the user's own machine, which is the expected default for a local A1111 or Forge server.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Sources:
Coverage and limitations
Inventory 14 files · 294618 bytes
Contextual coverage 1 of 1 candidates assessed
JavaScript coverage
Status Complete
Candidates 8 files · 246751 bytes
X-Ray review families 2 warning occurrences compacted to 1 evidence-preserving review families
Representations 8 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans 8 raw signatures · 8 raw AST · 8 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep
Tools
Limitations
This advisory review cannot prove the absence of unknown behavior.
Technical scan identity
Full commit 9db8b7dad2a40b2ccc47402cd6bb3de6959b6298 Completed Aug 26, 2026 History depth 5 commits
Method Deterministic evidence with contextual review
Reviewer nano-gpt.com · zai-org/glm-latest
Scanner 0.1.0
Scanner policy 5
Rule catalog 2
Contextual policy 5
Ecosystem context sillytavern-community-v1
Prompt contextual-review-v7
Assessment schema contextual-assessment-v2
Review provenance 1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports none
Evidence triage 0 deterministic / 1 contextual candidates · 1 contextual / 1 total behavior cases
Model budget 1 model call · 1 / 12 fresh cases · 22260 / 200000 estimated input · 17144 / 250000 actual input · 822 / 40000 output tokens
Review batching 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage 17144 input · 822 output · 14743 cache read · 0 reasoning tokens
Report 36497ef5c73895faed75d1cec7a1e333d92b8088a7248e4723cfe90ecd0f0b13