JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This extension uses the network only to load and save its own summary notes on the user's own SillyTavern server. The only 'command' it runs is a fixed, built-in SillyTavern action to start a new chat, and nothing downloaded from the network influences what that command does. The scanner flagged these features appearing in the same file, but there is no path where downloaded data turns into executed code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic execution sink in the same file, but the actual data flow shows no connection between them. The fetch operations target same-origin SillyTavern host endpoints (a GET for a per-character facts JSON document and a POST to the host's file-upload API), both authenticated with host-provided request headers, and the responses are parsed as JSON facts data that is only rendered into prompt text and a settings UI. The execution-like sink is the host's slash-command runner, invoked with a hardcoded fixed command string that starts a new chat, optionally with a delete flag set by an explicit user confirmation popup. No fetched or model-generated content is ever passed into the command string, and there is no eval, dynamic import, or code execution of retrieved bytes anywhere in the supplied source. All capabilities match the extension's stated purpose of summarizing chats, persisting user facts, and resetting the chat with a chronology message.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:239-822