No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger
0 material
1 low
What this review found
No material or immediate-danger item was identified.
Expected scanner matches (1)
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension contacts CHUB to search for characters, downloads selected character data, and hands it to SillyTavern for import. The scanner correlation does not show hidden or unrelated code execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
Scanner javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule javascript.download-to-execution
File role production
Source index.js:63-370
Coverage and limitations
Inventory 5 files · 27619 bytes
Contextual coverage 1 of 1 candidates assessed
JavaScript coverage
Status Complete
Candidates 1 files · 22424 bytes
Representations 1 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans 1 raw signatures · 1 raw AST · 1 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep
Tools
Limitations
This advisory review cannot prove the absence of unknown behavior.
Technical scan identity
Full commit 8c699ccd6b5ba1176c01a300eba8bc1b862550fa Completed Aug 9, 2026 History depth 20 commits
Method Deterministic evidence with contextual review
Reviewer api.openai.com · gpt-5.6-luna
Scanner 0.1.0
Scanner policy 4
Rule catalog 1
Contextual policy 2
Ecosystem context sillytavern-community-v1
Prompt contextual-review-v5
Assessment schema contextual-assessment-v1
Review usage 25182 input · 860 output · 25173 cache read · 0 reasoning tokens
Report d8e41c0adbde80852a0215b70121c8ab2419213698ca94f2d3c2e8662d4112bc