TavernKeeper Scan Report

Coneja-Chibi/Rabbit-Response-Team

Commit 45097b4 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches random words from public word-generation APIs and uses them to influence the AI's responses. This is exactly what the extension says it does. The scanner noticed both network calls and something it treats as code execution in the same file, but the actual code only downloads word lists and processes them as plain text. No malicious code execution is shown.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner flags a correlation between network retrieval and a code execution sink in the same file. The provided source shows fetch() calls to well-known public word APIs (Datamuse, Heroku random-word, Vercel random-word). Responses are parsed with response.json() and the resulting data is filtered by part-of-speech, shuffled, sliced, and prepared for prompt injection — the extension's stated purpose. No eval(), Function(), child_process, or other dynamic execution sink is visible in the supplied code. The network destinations are public dictionary APIs, URLs are constructed from user-configured parameters via URLSearchParams, and the retrieved data is treated as inert word strings/objects. The scanner's correlation heuristic does not demonstrate an actual download-to-execution data flow in the provided evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:496-1550

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity