The extension sends approved character card edits to the local SillyTavern server using a standard internal API call. There is no downloading of remote code and no dynamic code execution. This is exactly what the extension is designed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlated a network retrieval primitive with a code execution sink across lines 382-505. The only network call in that range is a fetch to the relative local endpoint /api/characters/merge-attributes with a POST body built from user-reviewed suggestions. This is the local SillyTavern server API, not a remote download, and the payload is a JSON merge of character card attributes. No eval, new Function, Function constructor, or comparable dynamic code execution sink is present in the supplied source. The remaining code in the range covers event emission, setTimeout scheduling, jQuery DOM construction, and settings handlers. This matches the extension's stated purpose of applying user-approved character card suggestions through the local SillyTavern API.
Local API fetch for character attribute merge is consistent with stated purpose
low risk · high confidence
The network call goes only to the user's own SillyTavern server to update a character card after the user explicitly approves the changes. This is normal and expected.
Technical assessment
The fetch at line 382 targets the relative path /api/characters/merge-attributes, uses context.getRequestHeaders for authentication, and sends a JSON body constructed from user-selected, user-editable suggestions. The response is checked for success before refreshing the character and emitting edit events. This is a standard SillyTavern extension pattern for modifying character data through the local server.