TavernKeeper Scan Report

kangjoseph90/Risu-Antigravity

Commit 89ddbc4 Reviewed Oct 3, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 39 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Gitleaks reported generic-api-key

Minor caution · high confidence

The plugin contains a login key that is built into the copy every user downloads. This is normal for desktop-style Google sign-in apps, where that key is not treated as truly private. It is only ever sent to Google's own login servers, and nothing in the evidence shows it being used to steal anything from users. It is a minor housekeeping issue for the developer, not a danger.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: A secret-scanner pattern matched a hardcoded OAuth client secret constant in the authentication module of a browser-distributed plugin. The surrounding code implements an OAuth authorization-code flow with PKCE against Google endpoints, and this constant is sent only to Google's own token endpoint during code exchange and token refresh. For an installed/public client type this constant is shipped to every user by design and Google does not treat it as confidential, so its presence in the repository is a hygiene weakness rather than a demonstrated user-facing exposure. All observed network destinations in this file are first-party Google OAuth endpoints; there is no exfiltration to any third-party host. The supplied evidence does not show any attacker-controlled path in which this constant produces concrete harm to end users.

Impact: low · Exploitability: unlikely

Developer action: Register the OAuth client as an installed/desktop application type, document that the client constant is public by design, and avoid treating it as a confidential secret. If the client type supports it, move to a flow that does not require a client secret. Do not reuse this constant for any server-side or confidential client.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/auth/index.ts:17

Deterministic technical evidence (36)

Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-rcqx-6q8c-2c42:pkg:4924d19c912a418685c50f04 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-phwv-c562-gvmh:pkg:6451c23f0d1c43292c602111 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-qhr7-859c-m2p7:pkg:778521755e4c759ed718a61e applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-w9m9-85wc-3x92:pkg:789fe9d4eb26f7c51d684509 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-pr6f-5x2q-rwfp:pkg:5d5fe58646d8594e79f18b24 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-f7gr-6p89-r883:pkg:8fd81e148e1b27069412ff27 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-xwg4-73v4-xw9w:pkg:b0abe8c9840bfaafb5747f78 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6j4f-fj2g-mc7p:pkg:3b7b9d961040d61c5a5fe87f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-73wf-gq98-2v4g:pkg:d94f2d739bc5b1390307ff33 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-mw96-cpmx-2vgc:pkg:601747c3b749b3dd8c3c29f8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-crpf-4hrx-3jrp:pkg:1239c1d6fa27af8cd8cf42dc applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-m56q-vw4c-c2cp:pkg:cfabc2fb061db0b3aae2a069 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-q2hr-2g5m-vwhr:pkg:63e388b1cfb851c3e8f43fee applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:bba13391076e986785950213 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5j98-mcp5-4vw2:pkg:2bc06ba112845300e5f58cd2 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-w5vr-8v7q-w6rv:pkg:579c5a681acc1ea46223151f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json

Contextual expected matches (1)

Credential access and network transmission in one file

Expected behavior · high confidence

The plugin reads the sign-in token it saved earlier and shows it to Google's own servers to fetch your account name and picture. That is exactly how sign-in tokens are meant to be used, and the token only ever goes to Google, not to anyone else. This is normal behavior for a Google login feature, not a threat.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The flagged pattern is a stored Google OAuth access token read via the host plugin API and sent as an Authorization header to Google's own userinfo endpoint to display the logged-in user's profile. This is the standard, intended use of an access token: it is transmitted only to the first-party Google API that issued it, over HTTPS, for a feature (login status and profile display) that matches the project's stated purpose of providing Google Antigravity authentication. The same file's other token-related network calls (code exchange and refresh) likewise target only Google's OAuth token endpoint. There is no transmission to any third-party or attacker-controlled destination, no obfuscation, and no use of the token beyond the documented authentication purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: src/auth/index.ts:287

Related contextual observations

Copy-paste redirect handling for OAuth callback

low risk · medium confidence

After signing in with Google, the user is asked to copy and paste the address of the page they land on back into the plugin. That is a clunky but common approach. The plugin does not double-check that the pasted link matches the login session it started, which is a small sloppiness, but nothing shown turns that into an actual attack on users.

Technical assessment

The login flow opens a Google authorization window, then asks the user to paste the redirected callback URL back into a plugin prompt so the authorization code can be extracted with a regex. This is a common workaround for plugins that cannot register a loopback listener, but it adds a manual step where a user could theoretically be social-engineered into pasting a crafted URL from elsewhere. The code does not validate the state parameter from the pasted URL and does not verify that the code originated from the flow this instance initiated. Any resulting token still goes only to Google's token endpoint in exchange, and tokens are stored via the host plugin API, so no concrete exfiltration or attacker-controlled harm is demonstrated by the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Validate the state parameter from the pasted callback URL against the generated state before exchanging the code, and clearly instruct users to paste only the URL shown immediately after the Google sign-in screen.

Sources:

src/auth/index.ts:17

Coverage and limitations

Inventory: 44 files · 270529 bytes
Contextual coverage: 38 of 38 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 29 files · 75653 bytes
X-Ray review families: 0 warning occurrences compacted to 0 evidence-preserving review families
Representations: 29 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 29 raw signatures · 6 raw AST · 29 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

src/antigravity/index.ts — raw-ast / parse
src/api.ts — raw-ast / parse
src/auth/index.ts — raw-ast / parse
src/chat/config.ts — raw-ast / parse
src/chat/format.ts — raw-ast / parse
src/chat/index.ts — raw-ast / parse
src/chat/request.ts — raw-ast / parse
src/chat/response.ts — raw-ast / parse
src/chat/types.ts — raw-ast / parse
src/model/config.ts — raw-ast / parse
src/model/index.ts — raw-ast / parse
src/model/list.ts — raw-ast / parse
src/plugin.ts — raw-ast / parse
src/shared/backup.ts — raw-ast / parse
src/shared/events.ts — raw-ast / parse
src/shared/logger.ts — raw-ast / parse
src/shared/types.ts — raw-ast / parse
src/shared/util.ts — raw-ast / parse
src/ui/index.ts — raw-ast / parse
src/ui/popup/index.ts — raw-ast / parse
src/ui/popup/store.ts — raw-ast / parse
tests/model.test.ts — raw-ast / parse
vite-plugin-risu-header.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 89ddbc4f2cd747a0073d563cd69a75cccea7389b
Completed: Oct 3, 2026
History depth: 2 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 2 fresh / 0 reused groups · 2 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 36 deterministic / 2 contextual candidates · 2 contextual / 7 total behavior cases
Model budget: 1 model call · 2 / 12 fresh cases · 25391 / 200000 estimated input · 18660 / 250000 actual input · 1791 / 40000 output tokens
Review batching: 1 model call · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 18660 input · 1791 output · 1360 cache read · 445 reasoning tokens
Report: 45d2e6eacb22b718746b5625c1e04bceae6440795d448861db819ad43b81322b