TavernKeeper Scan Report

Revivalist-Dev/GuidedGenerations-Extension

Commit db5c968 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches its own local HTML menu file from the SillyTavern server and separately loads its own local code modules on demand. These are standard, independent operations for a SillyTavern extension and do not create a path from downloaded content into code execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic code execution sink in the same file. The actual code shows: (1) a fetch() at line 223 that retrieves a static HTML file ('rewriteContextMenu.html') from the extension's own same-origin path on the local SillyTavern server, with the result inserted into the DOM via insertAdjacentHTML for UI rendering; and (2) dynamic import() calls at lines 129 and ~263 that use hardcoded relative paths ('./messageManager.js' and '../guidedRewrite.js') to lazily load local extension modules. There is no data flow from the fetch response into any code execution sink. The fetch response is treated as HTML text for DOM insertion, not as executable code. The import() specifiers are static strings with no attacker-controlled input. These are independent, expected operations for a SillyTavern extension loading its own UI template and modules.

Impact: none · Exploitability: unlikely

Developer action: Review the cited evidence and confirm the intended behavior.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
tooling
Source
scripts/ui/rewriteManager.js:46-223

Related contextual observations

Incomplete HTML escaping of character names in popup construction

low risk · high confidence

Character names are inserted into a popup menu with only partial escaping. If a character name contains certain special characters, it could break the menu's HTML or cause unexpected display issues. Since users set their own character names, this is primarily a self-inflicted display problem rather than an attack vector.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Review the cited evidence and confirm the intended behavior.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity