JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension fetches a public list of available AI model names to show as suggestions in a dropdown, and offers a convenient field for saving your API key. The downloaded list is only used to populate suggestion options; it is never run as code. The key you paste goes to your own SillyTavern server's secure storage, the same place the standard settings page uses, and is not sent anywhere else. This is normal, visible functionality matching the extension's stated purpose, not a download-and-execute pattern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged region contains a one-time fetch to a well-known public model-provider listing endpoint and a click handler that stores a user-entered API key through SillyTavern's native secret-writing API. The fetch response is only parsed as JSON and its model identifiers are inserted into a datalist as attribute values via a DOM builder, with no dynamic evaluation, no script injection path, and no credential sent with the request. The key the user pastes flows directly to the local SillyTavern server's secrets store and is cleared from the input field afterward; it is never transmitted to any external destination or persisted in extension state. The scanner's network-retrieval-plus-execution-sink correlation does not reflect an actual data flow from the remote response into any code-execution sink; the nearby dynamic HTML usage involves only locally defined icon constants and static markup, not fetched content.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:332-372