JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The scanner flagged this file because it seems to contain both network and code-execution related keywords. Looking at the actual code, the network-related parts are just the extension reading its own file location and configuring connection profiles for model calls handled by SillyTavern itself, and the execution-related parts are just text processing helpers. There is no evidence of downloading code and running it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner rule javascript.download-to-execution correlates network retrieval primitives with code execution sinks in the same representation. The visible code (lines 282-689) contains no fetch, XMLHttpRequest, eval, new Function, or child_process calls. The URL usage in get_extension_directory reads import.meta.url to determine the extension's own directory path, a standard SillyTavern extension pattern. The String.fromCharCode call in unescape_string is a text-control-character unescaping utility, not dynamic code execution. Connection profile functions read SillyTavern extension settings to configure which model API profile is used for summarization; actual HTTP requests to model APIs are handled by SillyTavern core infrastructure, not by this extension. setTimeout is used only with function references in delay and wait_for_event, never with string arguments. No data flow from network retrieval to a code execution sink is demonstrated in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:282-689