This file is a small icon image shown in the interface. The scanner flagged the standard technical label that all SVG images carry, mistaking it for a suspicious web address, but the app never connects to it or to anything else from this file.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The file is an inline SVG icon asset (a GitHub-style mark used for UI display). The only link-like literal is the mandatory SVG XML namespace declaration, a static format identifier present in all SVG markup; it is never used to initiate a network request. The file contains no fetch, no URL construction, no dynamic execution, and no data exfiltration path. The scanner's shady-link heuristic matched the namespace string in the decoded representation.
This code asks the app's own server for the user's saved lorebook data and displays it in the editor. It also registers named menu commands. The scanner saw a network request and command-related keywords together and flagged it, but nothing downloads code from the internet, and nothing executes downloaded content.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged region contains same-origin fetch calls to SillyTavern's own backend endpoints (worldinfo/get and settings/get) using standard request headers, followed by JSON parsing and cache storage. The 'code execution sink' the scanner correlated is SlashCommandParser registration of named slash commands with declared argument types and help text — declarative UI command registration, not dynamic code evaluation. No external network destination, no eval/Function invocation, no untrusted input flowing into an execution sink. The data retrieved is the user's own lorebook data, stored in a local cache and rendered in the editor UI.
This file is just a drawing — the app's logo icon. The scanner mistook the standard technical label that every SVG image carries for a suspicious web link, but it is only metadata about the image format and nothing contacts the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The entire file is an inline SVG graphic asset (a decorative book/stitch brand mark). The only string resembling a link is the standard SVG XML namespace declaration for the W3C schema, which is a required attribute of every SVG element and is not fetched, dereferenced, or used for any network request at runtime. There is no executable network logic, no fetch, no URL construction, and no data flow to any external destination.