TavernKeeper Scan Report

leandrojofre/SillyTavern-Stat-us-Maximus

Commit 1d3301a Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 6 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
source/js/macros.js:16

zizmor reported archived-uses

Minor caution · high confidence

The workflow uses a GitHub release action that has been archived by its maintainer. It still works but will no longer receive security patches or bug fixes. This is a maintenance hygiene issue for the project's release pipeline, not a demonstrated security threat.

Technical evidence

Scanner reason: zizmor matched workflow-security rule archived-uses. The match applies to this repository.

Contextual assessment: The workflow at file uses actions/create-release@v1 on line 70 to create GitHub releases. Zizmor flagged this because the actions/create-release repository is archived and no longer maintained. This is a CI/CD tooling file with execution scope limited to GitHub Actions automation; it is not part of the shipped extension. The action receives only GITHUB_TOKEN and statically defined parameters (tag name, release name, body from prior step outputs). No untrusted or attacker-controlled input flows into executable or injection-prone parameters of this action. The archived status means no future security fixes, but no current vulnerability or malicious behavior is demonstrated. This is a minor CI hygiene weakness.

Impact: low · Exploitability: unlikely

Developer action: Replace actions/create-release@v1 with the actively maintained gh CLI release creation command (gh release create) or another supported release action.

Scanner
zizmor 1.28.0
Rule
archived-uses
File role
tooling
Source
.github/workflows/release.yml:70
Deterministic technical evidence (3)
  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:21-24

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:70

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:22

Related contextual observations

GITHUB_TOKEN written to filesystem file

low risk · high confidence

The workflow writes the GitHub token to a file on disk. While the runner is ephemeral and the token is short-lived, writing secrets to files is poor hygiene and unnecessary since the environment variable is already available.

Technical assessment

Line 27 writes ${{ secrets.GITHUB_TOKEN }} to a file named gh_token, and the same step also sets GH_TOKEN via env. Writing the token to the runner filesystem is unnecessary since GH_TOKEN is already available to the gh CLI through the environment. The runner is ephemeral and the token is scoped and short-lived, so concrete harm is not demonstrated, but this is a minor hygiene weakness.

Impact: low · Exploitability: unlikely

Developer action: Avoid writing the token to the filesystem; use the GH_TOKEN environment variable already set in the same step, and remove the gh_token file or ensure cleanup.

Sources:

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity