TavernKeeper Scan Report

aikohanasaki/SillyTavern-MemoryBooks

Commit 6b59df8 Reviewed Aug 20, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 20 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: index.build.js:366

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: addlore.js:919

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: index.build.js:3349

Deterministic technical evidence (4)

JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: characterMemoryBookLocks.test.js:112
Gitleaks reported generic-api-key · gitleaks 8.30.1

This technical signal is not part of the shipped runtime behavior.

Policy reason: gitleaks-inert-placeholder · Execution scope: test-documentation-data

Source: userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:530
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: customConnectionProfiles.test.js:79
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: stloCharacterFilters.test.js:82

Contextual expected matches (13)

Gitleaks reported generic-api-key

Expected behavior · high confidence

A secret-scanning tool flagged a line in a French translation file, but the flagged text is just a translated UI label about API provider settings. There is no real secret or password in this file.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: Gitleaks flagged a generic-api-key pattern on line 614 of a French localization JSON file. The supplied source context shows line 614 is the translation entry STMemoryBooks_APIProvider with value API/Fournisseur, a UI label string. No actual credential, token, or secret is present. Nearby lines referencing API key and proxy password are also UI label and placeholder translations, not hardcoded secrets. This is a false positive from pattern matching on natural-language localization text.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: locales/fr-fr.json:614

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The code looks confusing because it has been processed by a build tool that compiles multiple source files into one delivery file. The strange variable names and repetitive patterns are normal side effects of that process, not an attempt to hide anything malicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The flagged code is standard bundler-generated ES module interop boilerplate from a build artifact (file). The patterns visible—WeakMap-based caching for module interop, defineProperty with bound getters, __esModule marker creation, and a require proxy that throws when require is unavailable—are all characteristic of esbuild or similar bundler output, not intentional obfuscation. The scanner confidence is low and the signal is a false positive from static analysis on minified production code. No concealed logic, string encoding, or runtime decryption is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: index.build.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension downloads and saves its own prompt settings using the local SillyTavern server, which is expected for a configuration management feature. A build-tool helper in the same file looks like it could run code but actually just throws an error if used in an unsupported way. There is no connection between the downloaded settings and any code execution—this is a false alarm from automated scanning.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated a network retrieval primitive with a code execution sink within the same file range. The actual fetch calls target local SillyTavern server endpoints (/user/files/ and /api/files/upload) for reading and writing prompt configuration JSON files, using standard request headers and credentials. The retrieved data is JSON-parsed and passed through a validation function (P3) that checks schema version and object structure before storage. The presumed execution sink is a bundler-generated require proxy (iH) that either delegates to the platform require or throws an error stating dynamic require is unsupported—it does not evaluate downloaded content. There is no data flow connecting fetched data to any code or command execution sink. The two primitives coexist in the same bundled file but serve unrelated purposes.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: index.build.js:98-674

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file contains normal, readable interface code for the extension's settings panel. There is nothing hidden or obfuscated in it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The supplied source is a plain-text Handlebars settings template compiled via the standard SillyTavern lib.js import. The content is human-readable HTML with i18n attributes, standard Handlebars conditionals, and UI controls for an extension settings panel. No obfuscation, encoded payloads, hidden execution, dynamic eval, or obscured data flows are present. The scanner signal is a low-confidence false positive on readable template code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: templates.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file creates confirmation dialogs for the memory creation feature. The code is plain and readable with no hidden behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The supplied source is clear, readable ES module code implementing UI confirmation popups for memory creation. It uses DOMPurify sanitization before rendering template output, SillyTavern Popup APIs, and standard profile/settings management. No obfuscation, hidden execution, or suspicious data flows are present. The scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: confirmationPopup.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner flagged possible obfuscation, but the actual code is a straightforward translation file. It maps language codes to locale files and loads translation text. There is nothing hidden or scrambled.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray reported an obfuscated-code signal with low confidence. The supplied source is a localization module containing locale alias mappings, a fetch-based JSON locale loader using relative URLs resolved against import.meta.url, and plain-text translation string constants. The code is fully readable with clear naming and comments. No obfuscation, encoded payloads, or concealed execution is present. The locale JSON fetch targets only bundled locale files within the extension directory.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: locales.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This is the compiled version of the extension. The network calls it makes are to the local SillyTavern server to save and load prompt settings, which is exactly what the extension is supposed to do. The code execution patterns the scanner flagged are standard bundler plumbing, not actual security issues.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: index.build.js:5-6

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A static analysis tool flagged this file as potentially obfuscated, but the code is plainly readable and well-organized. There is no hidden or scrambled code present.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray reported a low-confidence obfuscated-code signal on line 1 of profileManager.js. The supplied source shows a standard, readable ES module with clear imports, well-named functions, Handlebars templates, comments, and straightforward profile management logic. No minification, encoding, eval chains, string obfuscation, or concealed execution is present. The signal is a false positive, likely triggered by file structure or template complexity rather than genuine obfuscation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: profileManager.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This install script simply checks whether a git pre-commit hook is already set up and prints a status message. It does nothing hidden or harmful.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The supplied source is a straightforward, fully readable postinstall script. It checks for the existence of a .git directory, reads and compares a pre-commit hook file against a source hook, and logs status messages. There is no obfuscation, no network activity, no credential access, and no concealed execution. The scanner signal is a false positive on plain code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: bin/postinstall.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray reported an obfuscated-code signal with low confidence. The supplied source is the main extension entry point with clear, readable ES module imports from standard SillyTavern APIs, well-named functions, copyright headers, and comments. No encoded strings, eval chains, packed code, or concealed logic is visible. The code imports event handling, popup, slash command, world-info, and utility modules and defines settings templates and UI helpers, all consistent with a legitimate SillyTavern memory management extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: index.js:1

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged line is just a table-of-contents link in a help document. There is no secret or password in it.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged line is a table-of-contents entry in a Portuguese-language markdown user guide. It contains a documentation anchor link, not a credential. The file role is documentation with no runtime execution scope. No API key, secret, or usable credential is present in the supplied source context. The gitleaks match is a false positive on markdown link text.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: documentation
Source: userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:23

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A static analysis tool flagged this file as potentially obfuscated, but the code is plainly readable and well-organized. There is no hidden or scrambled code present.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray reported a low-confidence obfuscated-code signal on line 1 of sidePromptsPopup.js. The supplied source shows a standard, readable ES module with clear imports, well-named functions, DOMPurify sanitization usage, escapeHtml calls, comments, and straightforward UI popup logic for side prompt management. No minification, encoding, eval chains, string obfuscation, or concealed execution is present. The signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: sidePromptsPopup.js:1

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The scanner flagged a pattern that looked like downloading and running code, but the actual code shown is about loading and saving lorebook entries and managing extension settings. There is no evidence of downloading and executing any content.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The scanner matched a download-and-execute rule against a source map file, but the supplied source context shows standard extension logic: context-settings migration, lorebook entry resolution via SillyTavern's loadWorldInfo API, custom connection profile inspection, and OpenRouter routing field mapping. No fetch-to-eval pipeline, shell execution, or downloaded-content execution is present in the exposed code. The code reads and writes lorebook data through legitimate SillyTavern APIs consistent with the extension's stated purpose of managing chat memory in lorebooks.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.download-and-execute.shell-pipeline
File role: production
Source: index.build.js.map:30

Coverage and limitations

Inventory: 190 files · 9922060 bytes
Contextual coverage: 20 of 20 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 67 files · 2896245 bytes
X-Ray review families: 25 warning occurrences compacted to 14 evidence-preserving review families
Representations: 67 raw · 37 decoded · 6 normalized · 0 bundle modules
Stage scans: 67 raw signatures · 67 raw AST · 67 raw OpenGrep · 43 derived signatures · 11 derived AST · 43 derived OpenGrep

Unresolved JavaScript stages

index.build.js — derived-ast / parse
index.build.js — normalize / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 6b59df8d2a1614c3dacf9996a7df6e7ead47cb81
Completed: Aug 20, 2026
History depth: 11 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 13 fresh / 0 reused groups · 13 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 7 deterministic / 13 contextual candidates · 13 contextual / 20 total behavior cases
Model budget: 5 model calls · 13 / 12 fresh cases · 251586 / 200000 estimated input · 199082 / 250000 actual input · 6540 / 40000 output tokens
Review batching: 5 model calls · up to 3 groups and 3 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 199082 input · 6540 output · 6797 cache read · 0 reasoning tokens
Report: a79e40b8e7e1e54fca4db3c62d48b8f41c7fe1b080cef55c2eaba677222d2e18