A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The flagged file is a plain, readable theme settings file for a SillyTavern visual theme extension. It only contains configuration data for UI appearance options like colors, font sizes, and CSS styling. There is no hidden or obfuscated code, and nothing that accesses credentials, network resources, or user data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source is a straightforward ES module exporting two plain objects: tabMappings (category-to-tab mapping) and themeCustomSettings (an array of UI setting descriptors with types like color, text, checkbox, slider, select, textarea). All values are human-readable strings, CSS blocks, and default settings. There are no eval calls, encoded strings, dynamic imports, network requests, credential access, or any obfuscation techniques. The JS-X-Ray signal at low confidence is a false positive triggered by ordinary configuration syntax. The file matches the project's stated purpose as a SillyTavern theme extension.
Raw Custom CSS textarea is an intentional user-facing feature
low risk · high confidence
The file offers a raw CSS textarea for users to enter their own custom CSS. This is a normal theme customization feature and not a security issue since the user is styling their own local interface.
Technical assessment
Detailed technical wording was omitted by the public report safety filter.