JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension can call the OpenRouter AI service when a user configures a custom model in the settings panel. It uses the API key already stored in SillyTavern's own secret manager and sends it only to OpenRouter. The AI's text response is used to help manage the map scene, not executed as code. This matches the extension's advertised feature of AI-assisted map management.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a code execution sink in lines 324-374. The actual code in this range contains a fetch call to the official OpenRouter chat completions endpoint and calls to SillyTavern's generateQuietPrompt. The fetch retrieves the OpenRouter API key from SillyTavern's own secret store via findSecret(SECRET_KEYS.OPENROUTER) and sends it only to openrouter.ai with a user-configured model override. The response is parsed as JSON and the text content string is returned for use in AI scene management. No eval, Function constructor, innerHTML with untrusted data, or other dynamic code execution sink is present in the shown range. The openPanel function uses jQuery selector strings with template interpolation from a data attribute, but jQuery treats strings starting with # or . as selectors, not executable HTML. The model override is explicitly set by the user in the settings panel UI, matching the project's stated AI-driven map automation purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:324-374