TavernKeeper Scan Report

aikohanasaki/SillyTavern-MemoryBooks

Commit 9c7b6f9 Reviewed Aug 12, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 20 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: index.build.js:366

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: index.build.js:3341

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: addlore.js:919

Deterministic technical evidence (4)

JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: characterMemoryBookLocks.test.js:112
Gitleaks reported generic-api-key · gitleaks 8.30.1

This technical signal is not part of the shipped runtime behavior.

Policy reason: gitleaks-inert-placeholder · Execution scope: test-documentation-data

Source: userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:530
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: customConnectionProfiles.test.js:79
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: stloCharacterFilters.test.js:82

Contextual expected matches (13)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

This is the main extension file that has been packed and compressed to make it load faster. The 'obfuscated' appearance is normal for bundled code, not a sign of hiding bad behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file is a built/bundled artifact containing transpiled and minified JavaScript. The code includes module-loading boilerplate (WeakMap-based interop, lazy initialization, and named exports) that is typical of bundlers like Rollup or esbuild. The obfuscation indicator is a result of minification and bundling, not intentional concealment. The imports and logic reflect the same functionality as the source modules. No malicious patterns are present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: index.build.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner thought this file might be hiding code, but looking at the actual code shows it's just normal readable UI templates for the Memory Books settings panel.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file exports Handlebars template strings for UI rendering. The scanner's obfuscation signal is a false positive; the actual source is plain readable JavaScript with template literals. No concealed or obfuscated code exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: templates.js:1

Gitleaks reported generic-api-key

Expected behavior · high confidence

A security scanner flagged an apparent API key in a French translation file, but the flagged text is just the label 'API/Provider' translated into French—not a real API key. Nothing is exposed.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The Gitleaks generic-api-key rule triggered on line 608 of the French locale file fr-fr.json, which contains the translation key 'STMemoryBooks_APIProvider' with value 'API/Fournisseur :'. This is a localization string, not an actual API credential. The matched value was removed by the scanner and no credential data is present in this file. The file is purely a JSON translation resource and cannot expose secrets.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: locales/fr-fr.json:608

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This is a popup window for creating memories. The code is normal and easy to read. The security alert was a mistake.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file is a runtime module that creates and manages confirmation popups for memory creation. The supplied source code is plain, readable JavaScript with standard SillyTavern imports and DOM manipulation. There is no obfuscation, concealed behavior, or data exfiltration. The scanner signal is low-confidence and does not match the actual code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: confirmationPopup.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A scanner flagged this file as possibly obfuscated, but it's just a translation file with plain text strings. Nothing suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner rule 'javascript.xray.obfuscated-code' flagged file for suspected obfuscation, but the supplied source is standard localization code with a copyright header, imports, and a large plaintext translation object. No obfuscation is present; the scanner had low confidence and the match is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: locales.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches settings files from the SillyTavern server to save and load its configuration. This is normal behavior for an extension and does not involve running any downloaded code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The candidate flags co-occurrence of fetch and a potential dynamic execution sink, but the supplied source only uses fetch to read/write JSON configuration files via /user/files/ and /api/files/upload endpoints. Deserialization uses JSON.parse, not eval, Function, or any dynamic code execution. The uH function is a stub for dynamic require that always throws; it is not invoked on fetched data. No actual download-to-execution path exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: index.build.js:98-670

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The minified extension code still only fetches settings files from the server. It does not run any downloaded code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: This is the minified version of the same code. As with the normalized representation, network retrieval is used only to load and save JSON configuration files, with no eval, Function, or other dynamic code execution sink applied to retrieved data. The correlation flagged by the scanner does not represent an actual vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: index.build.js:5-6

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

A security scanner flagged a line in the code as potentially downloading and running something, but the actual code just loads settings normally. Nothing to worry about.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The scanner rule 'download-and-execute.shell-pipeline' matched line 28 of file, but the supplied source context shows a normal function call to loadContextSettings() and no download, shell execution, or eval pattern. The match is a false positive; the code performs standard extension operations and does not execute downloaded content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.download-and-execute.shell-pipeline
File role: production
Source: index.build.js.map:28

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

A static analysis tool thought this file might contain obfuscated code, but looking at the actual source it is clear, readable JavaScript. This is a false alarm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged file with an obfuscated-code signal at low confidence. The supplied source code shows a standard JavaScript module with clear imports, a copyright header, well-structured functions, and no obfuscation techniques such as packed strings, eval, or encoded payloads. The scanner likely matched a false pattern (e.g., a long line or template literal). No actual obfuscation is present in the evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: profileManager.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file runs after installation to set up a helpful git hook. The code is straightforward and does what it says. The security scanner warning was incorrect.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file is a post-install script that optionally installs a git pre-commit hook. The scanner flagged it for obfuscation, but the supplied source code is fully readable, standard Node.js module code with clear logic. There is no obfuscation, concealed execution, or external data exfiltration. The scanner signal is low-confidence and likely a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: bin/postinstall.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A scanner thought this file might be obfuscated, but it's actually normal, readable code. No action needed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner rule 'javascript.xray.obfuscated-code' flagged file for suspected obfuscation, but the provided source is plain, readable JavaScript with clear copyright headers, module imports, and standard codepaths. The scanner had low confidence and the evidence does not demonstrate any obfuscation or concealed behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: index.js:1

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner thought it found an API key in a documentation file, but the flagged line is just a table of contents entry with the word 'Tokens'. There's no real credential here.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The file is an old Portuguese user guide (markdown). Gitleaks flagged a generic API key pattern at line 23, but the actual line is a table-of-contents heading: '- [Economia de Tokens: Ocultar/Reexibir Mensagens](#-token-saving-hide--unhide-messages)'. No credential or secret is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: documentation
Source: userguides/old_guides_no_longer_updated/USER_GUIDE-pt-br.md:23

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

A security tool suspected this file might be hiding code, but the actual source is normal, readable JavaScript. No issue here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged file with an obfuscated-code signal at low confidence. The supplied source reveals a well-structured ES module with explicit imports, documented functions, and safe DOM manipulation using DOMPurify and escapeHtml. No obfuscation, minification, or hidden execution paths are present in the evidence. The scanner result is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: sidePromptsPopup.js:1

Coverage and limitations

Inventory: 184 files · 9862921 bytes
Contextual coverage: 20 of 20 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 61 files · 2868298 bytes
X-Ray review families: 25 warning occurrences compacted to 14 evidence-preserving review families
Representations: 61 raw · 37 decoded · 6 normalized · 0 bundle modules
Stage scans: 61 raw signatures · 61 raw AST · 61 raw OpenGrep · 43 derived signatures · 11 derived AST · 43 derived OpenGrep

Unresolved JavaScript stages

index.build.js — derived-ast / parse
index.build.js — normalize / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 9c7b6f93e2160c64ab85e9b6d2d03d12eed62474
Completed: Aug 12, 2026
History depth: 4 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 13 fresh / 0 reused groups · 13 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 7 deterministic / 13 contextual candidates · 13 contextual / 20 total behavior cases
Model budget: 5 model calls · 13 / 12 fresh cases · 251448 / 200000 estimated input · 227799 / 250000 actual input · 7009 / 40000 output tokens
Review batching: 5 model calls · up to 3 groups and 3 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 227799 input · 7009 output · 0 cache read · 0 reasoning tokens
Report: df572845467cb6c9a57977ddd1d65fd9826502a08a51e2b15b9f111d88782f5b