No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/status-clock.js:29
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/api.js:180
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/status-ui.js:787
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/status-diff.js:19
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/status-rules.js:24
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/utils.js:471
Contextual expected matches (8)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner decoded the built-in placeholder picture into its raw drawing instructions and flagged the standard label that all SVG pictures must carry. That label is not a web address anything connects to; the picture is just a simple static silhouette drawn with shapes.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: This candidate is the decoded representation of the same fallback-avatar SVG string reviewed in the sibling candidate: a static rectangle, gradient, circle, and path defining a generic person silhouette. The scanner's network-access category fired on the standard SVG namespace identifier inside the markup, which is a mandatory attribute of any SVG document and not a URL that is fetched. The content contains no scripts, external references, event handlers, or data flow of any kind.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/constants.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
A link-checking scanner raised a flag, but the code shown only talks to the user's own SillyTavern server to save, list, or delete portrait images, or to send a portrait request through the server's configured image model. No outside web address is present in the code provided.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line guards a same-origin request to the SillyTavern server's image deletion endpoint, sent with the standard authenticated request headers and only after checking that no other character or persona still references the file. Every network destination visible in the supplied source is a relative path on the user's own SillyTavern server (image deletion, folder listing, and the chat-completions generation backend), plus reads of user-configured reference image sources that are converted to inline data for the model request. The scanner retained no matched literal values, and no external, shortened, or obfuscated destination appears anywhere in the supplied window. No credential material is read or transmitted at this site.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/api.js:710
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The automated scanner pointed at this file thinking there might be a suspicious link, but the actual code shown does not contact any external service. It only manages the extension's own portrait settings and chat notes, so nothing here poses a security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner raised a fixed network-access signal at line 59, but the supplied source shows no network access at all. The flagged line is a type/prefix guard on a settings string that skips entries already stored on disk; the surrounding module only reads the extension's own settings, moves inline data-URI portraits to disk through the project's own persistence helper, derives deterministic portraits from speaker names, and records face assignments in chat metadata. There are no external destinations, no credentials handling, and no obfuscated strings in the supplied code, and the scanner retained no matched literal values that would substantiate a suspicious link.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/default-portraits.js:59
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged line checks whether a picture inside a shared character file is an embedded image (a self-contained picture carried inside the file itself) and only accepts those. It is a safety filter, not a connection to any website, and nothing is sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/character-transfer.js:205
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged a possible suspicious link, but the code actually just deletes an unwanted AI-generated portrait by calling SillyTavern's own built-in cleanup feature. It only runs when the user chooses to throw the picture away, and nothing leaves the user's own SillyTavern installation.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a guard in a helper that deletes a discarded generated portrait. It skips empty or inline data-URI values, then posts the file path to SillyTavern's own same-origin image-deletion endpoint using the standard authenticated request headers. The path originates from the extension's own image persistence flow, the call is triggered only by the user's explicit discard choice, the destination is the host application rather than any external or obfuscated address, and the behavior matches the stated purpose of cleaning up images the extension generated. No suspicious external link exists in the supplied code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui-api.js:290
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner saw a web address written in the code and flagged it as a suspicious link. It is actually the official technical label the browser requires to create drawing elements for the ring-style stat meters around character portraits. It is never visited or contacted like a real web page—it is just a name, like a part number. Nothing leaves the user's computer because of it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a constant holding the standard SVG namespace identifier string, passed to document.createElementNS so the browser creates SVG elements for the HUD's meter-ring graphics. This is the required namespace argument for SVG element creation in the DOM API, not a URL that is fetched or navigated to. Namespace URIs in createElementNS are opaque identifiers resolved by the browser's element factory; no network request, script load, image fetch, or navigation occurs. The surrounding code uses the created elements solely to draw stat meters around the portrait, which matches the extension's stated HUD purpose. No data is sent anywhere, no external destination exists, and no attacker-controlled input reaches this constant.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui-hud.js:571
Credential access and network transmission in one file
Expected behavior · high confidence
The extension never handles the API key itself. It only tells the user's own SillyTavern server which saved connection to use when generating a portrait; the server holds the key and contacts the provider. This is the normal, documented way such extensions work and matches the feature the project advertises.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged pairing is between a lookup of a connection profile's secret identifier and a network request. The identifier is not the credential value; it is a reference the extension optionally forwards in the body of a same-origin request to SillyTavern's chat-completions endpoint so the server selects the corresponding stored provider key. The actual provider key is held and used server-side by SillyTavern and never enters the extension, as the code's own comments and error messages state. Destination, timing, disclosure, and proportionality all match the project's stated integrated portrait-generation feature. Co-occurrence of a credential-adjacent lookup and a fetch in the same file is a locating signal, not demonstrated exfiltration; there is no path here by which a credential value is read or transmitted off-host.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 5
- Rule
- credential-exfiltration
- File role
- production
- Source
- src/api.js:868
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged code is a built-in placeholder silhouette picture, stored directly inside the program as text so the extension has something to show when a character has no picture. It does not reach out to the internet or load anything from outside.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line constructs a fallback avatar constant as an inline SVG data URI. The scanner reacted to the data-URI scheme and the SVG namespace literal embedded in the markup. The constant is a static, self-contained placeholder image used when neither a character portrait nor a user default is available; it performs no fetch, contacts no host, and its content is fully visible in the source. This is a proportionate, disclosed use of the data scheme for the project's stated avatar-styling purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/constants.js:35