The extension downloads pet artwork and small animation description files from the user's own SillyTavern server, which is exactly what a pet sprite extension needs to do. The downloaded files are used to draw and animate the pet; they are never run as code. The scanner's warning is based on the file containing both a download feature and some code-execution-like pattern, but nothing shown connects the downloaded content to any execution of code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a correlation between network retrieval and a code execution sink within the same file, but the supplied source shows no data flow connecting them. All fetch calls target same-origin SillyTavern endpoints (sprite listing, asset listing, optional per-pet JSON manifests) using relative paths. Retrieved content is used only as data: image files are loaded as sprite atlases, and JSON manifests supply animation frame indices, dimensions, and display labels that are normalized and clamped to numeric values before use. No retrieved string is passed to an evaluator, script loader, or command interface anywhere in the supplied excerpt. The presumed dynamic-execution indicator elsewhere in the file is not shown to consume network-derived data, and same-file coexistence alone is not a demonstrated attack path.