TavernKeeper Scan Report

kangjoseph90/Risu-Antigravity

Commit 0998d71 Reviewed Sep 11, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 35 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (32)

Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-rcqx-6q8c-2c42:pkg:4924d19c912a418685c50f04 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-phwv-c562-gvmh:pkg:6451c23f0d1c43292c602111 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-w9m9-85wc-3x92:pkg:789fe9d4eb26f7c51d684509 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-pr6f-5x2q-rwfp:pkg:5d5fe58646d8594e79f18b24 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-f7gr-6p89-r883:pkg:8fd81e148e1b27069412ff27 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-xwg4-73v4-xw9w:pkg:b0abe8c9840bfaafb5747f78 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-73wf-gq98-2v4g:pkg:d94f2d739bc5b1390307ff33 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-mw96-cpmx-2vgc:pkg:601747c3b749b3dd8c3c29f8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-crpf-4hrx-3jrp:pkg:1239c1d6fa27af8cd8cf42dc applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-m56q-vw4c-c2cp:pkg:cfabc2fb061db0b3aae2a069 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:bba13391076e986785950213 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5j98-mcp5-4vw2:pkg:2bc06ba112845300e5f58cd2 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-w5vr-8v7q-w6rv:pkg:579c5a681acc1ea46223151f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json

Contextual expected matches (2)

Gitleaks reported generic-api-key

Expected behavior · medium confidence

The extension carries a Google sign-in credential so it can finish its own Google login. That credential is only ever sent to Google's own login service, which is the normal way desktop-style apps do this; Google does not consider this kind of credential secret. The code never sends it anywhere else, and no user passwords or unrelated accounts are involved.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged constant is an OAuth client secret for the Google sign-in this provider extension implements. The supplied code uses it only in the authorization-code exchange and refresh-token requests, both sent exclusively to Google's official OAuth token endpoint, together with a PKCE code challenge and a local loopback redirect. That combination is Google's documented installed-application pattern, in which the client secret is not treated as confidential and is expected to ship inside the distributed application. The matched value was withheld from review, so it cannot be confirmed as a live credential, and no destination other than Google appears anywhere in the supplied flow. Same-file presence of a credential literal is not, by itself, evidence of exposure to harm.

Impact: none · Exploitability: unlikely

Developer action: Confirm the Google OAuth client is registered as a desktop or installed application, where Google treats the embedded secret as public; if it was instead registered as a web application, treat the published value as compromised and rotate it.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/auth/index.ts:17

Credential access and network transmission in one file

Expected behavior · high confidence

The extension reads your Google login token and sends it to Google's own service to confirm who you are and to renew the token when it expires. That is exactly what the token is for, and it never goes to anyone other than Google.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The heuristic paired credential reads with a network call in one file. The access token is read from the extension's own storage and sent only as a bearer header to Google's own userinfo endpoint, and the refresh token is sent only to Google's OAuth token endpoint for renewal. Those are the tokens' intended destinations for the Google-backed provider this project states it is, and every outbound request in the supplied source targets Google. No third-party endpoint, log sink, storage write, or other recipient receives the tokens, so the correlation the scanner flagged is the legitimate operation of the login flow rather than exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/auth/index.ts:287

Related contextual observations

OAuth state value is generated but never validated when the user pastes the callback URL

low risk · medium confidence

The plugin creates a one-time marker when it sends you to Google's login page, but it never checks that marker when you paste the result back. Checking it would make it much harder for someone to trick you into connecting the wrong person's account.

Technical assessment

The login flow generates a random state parameter and includes it in the authorization URL, but when the user pastes the redirect URL back, only the authorization code is extracted and the state is never compared. The PKCE verifier limits classic code-injection risk, and the paste-based design requires the user to actively supply the callback URL, so no concrete harm is demonstrated. Still, a user who could be persuaded to paste an attacker-supplied callback URL would bind the attacker's account tokens into the plugin, and state comparison would close that gap.

Impact: low · Exploitability: unlikely

Developer action: Compare the state value found in the pasted callback URL against the locally generated state before exchanging the authorization code, and reject mismatches.

Sources:

src/auth/index.ts:287

Coverage and limitations

Inventory: 42 files · 263266 bytes
Contextual coverage: 34 of 34 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 27 files · 67459 bytes
X-Ray review families: 0 warning occurrences compacted to 0 evidence-preserving review families
Representations: 27 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 27 raw signatures · 6 raw AST · 27 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

src/antigravity/index.ts — raw-ast / parse
src/api.ts — raw-ast / parse
src/auth/index.ts — raw-ast / parse
src/chat/config.ts — raw-ast / parse
src/chat/format.ts — raw-ast / parse
src/chat/index.ts — raw-ast / parse
src/chat/request.ts — raw-ast / parse
src/chat/response.ts — raw-ast / parse
src/chat/types.ts — raw-ast / parse
src/model/index.ts — raw-ast / parse
src/model/list.ts — raw-ast / parse
src/plugin.ts — raw-ast / parse
src/shared/backup.ts — raw-ast / parse
src/shared/events.ts — raw-ast / parse
src/shared/logger.ts — raw-ast / parse
src/shared/types.ts — raw-ast / parse
src/shared/util.ts — raw-ast / parse
src/ui/index.ts — raw-ast / parse
src/ui/popup/index.ts — raw-ast / parse
src/ui/popup/store.ts — raw-ast / parse
vite-plugin-risu-header.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 0998d7134e3496a5fdbdd91b2f283c27f1ff3f82
Completed: Sep 11, 2026
History depth: 2 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 2 fresh / 0 reused groups · 2 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 32 deterministic / 2 contextual candidates · 2 contextual / 6 total behavior cases
Model budget: 1 model call · 2 / 12 fresh cases · 25348 / 200000 estimated input · 18616 / 250000 actual input · 6139 / 40000 output tokens
Review batching: 1 model call · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 18616 input · 6139 output · 0 cache read · 4741 reasoning tokens
Report: 7e6796b4ef27cf96663f0a2d75ce5dcc6ca282e62b1f17a7cbf0114d9affa105