No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger
0 material
2 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (1)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged link is just the default address for a local ComfyUI image-generation service, which is exactly what this extension is designed to talk to. It is not sending data anywhere suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Scanner javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule javascript.xray.shady-link
File role production
Source settings.js:7
Related contextual observations
Default localhost ComfyUI URL flagged by scanner
low risk · high confidence
The default ComfyUI address is a standard localhost URL and matches the extension's documented purpose. No security action needed.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Sources:
Coverage and limitations
Inventory 15 files · 128976 bytes
Contextual coverage 1 of 1 candidates assessed
JavaScript coverage
Status Complete
Candidates 11 files · 81417 bytes
X-Ray review families 1 warning occurrences compacted to 1 evidence-preserving review families
Representations 11 raw · 11 decoded · 0 normalized · 0 bundle modules
Stage scans 11 raw signatures · 11 raw AST · 11 raw OpenGrep · 11 derived signatures · 0 derived AST · 11 derived OpenGrep
Tools
Limitations
This advisory review cannot prove the absence of unknown behavior.
Technical scan identity
Full commit 11b86fa68169fed4069cc2d625c8d9f0b5282ad0 Completed Aug 24, 2026 History depth 1 commit
Method Deterministic evidence with contextual review
Reviewer nano-gpt.com · zai-org/glm-latest
Scanner 0.1.0
Scanner policy 5
Rule catalog 2
Contextual policy 5
Ecosystem context sillytavern-community-v1
Prompt contextual-review-v7
Assessment schema contextual-assessment-v2
Review provenance 1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports none
Evidence triage 0 deterministic / 1 contextual candidates · 1 contextual / 1 total behavior cases
Model budget 1 model call · 1 / 12 fresh cases · 10731 / 200000 estimated input · 9334 / 250000 actual input · 780 / 40000 output tokens
Review batching 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage 9334 input · 780 output · 0 cache read · 0 reasoning tokens
Report 46a15be49a9a7113e5da7a0048b759f24fcf9a80f99cb163800a8ad8abb687ae