TavernKeeper Scan Report

PavOrlov/SillyTavern-Interactive-Map

Commit 6b7143c Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 3 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (1)
  • JavaScript analysis reported javascript.xray.sql-injection · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

    Source: index.js:1606

Contextual expected matches (2)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension builds file paths to play sounds, show images, and load maps. It only looks inside its own folder and checks that paths don't escape. This is the normal way the extension works.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The 'shady-link' signal flags construction of URLs from user-provided file names for sounds, images, videos, and map assets. The extension constructs these URLs only within its own extension folder and uses a validateAssetPath function that blocks path traversal ('..', absolute paths). Network requests are limited to local index.json and map JSON files within the extension directory. No evidence of external or arbitrary network destinations. This is expected behavior for an asset-loading extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:819

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension downloads map data and then runs commands you put in your map when you click a zone. This is exactly what it's supposed to do — you create the map file yourself.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The extension fetches map JSON files from its local folder and then executes slash commands defined in the map's shape scripts via executeSlashCommands on user click. This is the core interactive functionality of the extension: zone-specific commands are user-authored in the map data. No network request reaches external servers; the only code execution is user-supplied slash commands within SillyTavern's sandbox. The correlation between network retrieval and code execution is expected for this extension's design.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:188-1179

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity