Credential access and network transmission in one file
Expected behavior · high confidence
The server plugin reads the user's stored API key and sends it to the user's own configured API endpoint to authenticate requests. This is exactly what an API proxy adapter is supposed to do, and the key is never sent anywhere unexpected or stored outside the request.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged credential access (readSecret at line 129) and outbound network transmission (fetch at line 157) in the same file. The data flow is: readSecret retrieves the user's stored Custom API key from SillyTavern's secrets store, and fetch sends it as an x-api-key header to an endpoint derived from getNavyMessagesUrl(payload.custom_url) — the user's own configured custom endpoint, converted to Anthropic's /v1/messages format. The key is used solely as an authentication header for the upstream API request, is not logged, not persisted, and not sent to any third-party destination. This matches the README's stated design: 'Reuses the Custom API key already stored by SillyTavern; the key never enters browser extension settings.' The credential-to-network flow is the core, disclosed purpose of the companion adapter.
The extension downloads a local JSON rules file and intercepts web requests to manage API parameters. It does not download or run any executable code. This is normal behavior for an extension that manages model parameter settings.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive (fetch at line 66) with a code execution sink in the same file. However, the fetch call at line 66 retrieves a local JSON ruleset (RULES_URL resolves to a same-origin path within the extension's own data directory) and parses it as JSON — no eval, Function constructor, or dynamic code execution is performed on the response. The installFetchObserver function at line 330 overrides window.fetch to intercept chat-completion generation requests, which is a legitimate and disclosed extension pattern for observing API errors and routing companion requests. All fetch destinations are local SillyTavern endpoints. No downloaded content is ever executed as code.
The scanner flagged a line that is simply filtering server-sent event stream data. This is standard stream processing for translating API responses, not suspicious network activity.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.