TavernKeeper Scan Report

chesswoodspixel/SillyTavern-LorebookStickySort

Commit 5deba7b Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The code is completely readable and straightforward. It is a normal SillyTavern extension that remembers your lorebook sort preferences. There is no hidden or obfuscated code, no network calls, and no credential handling.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner flagged an obfuscated-code signal on line 1 with low confidence. The actual source is plain, well-commented JavaScript with no obfuscation, minification, encoded strings, or dynamic code execution. The extension imports only standard SillyTavern APIs (extension_settings, saveSettingsDebounced, eventSource, event_types), reads DOM elements for lorebook sort dropdowns, persists sort preferences via saveSettingsDebounced, and exposes a diagnostics helper on window. No external network requests, credential access, eval, or concealed execution paths are present. The scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
index.js:1

Related contextual observations

Window-global diagnostics function for console debugging

low risk · high confidence

The extension exposes a diagnostics function on the browser console for troubleshooting. This is a common debugging aid and poses no security risk.

Technical assessment

The window.lorebookStickySortDiagnostics function reads extension_settings and current DOM state to print diagnostic information to the console and return a summary object. This is a standard debugging pattern for SillyTavern extensions and does not transmit data externally or expose sensitive information beyond what is already accessible in the browser console.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity