TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

Vibecoder9000/Extension-TokenUsage

Commit aa40c45 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:946
Contextual expected matches (1)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged link is just the official SVG namespace identifier used by browsers when drawing charts. It is not a website the extension connects to; it is a standard technical constant needed to create chart graphics. No data is sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:1429

Coverage and limitations

Inventory
11 files · 317923 bytes
Contextual coverage
2 of 2 candidates assessed

JavaScript coverage

Status
Complete
Candidates
4 files · 140019 bytes
X-Ray review families
2 warning occurrences compacted to 2 evidence-preserving review families
Representations
4 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
4 raw signatures · 4 raw AST · 4 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
aa40c45d1c4cf45d17b13bede80253063a4be9fa
Completed
History depth
1 commit
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports
none
Evidence triage
1 deterministic / 1 contextual candidates · 1 contextual / 2 total behavior cases
Model budget
1 model call · 1 / 12 fresh cases · 19665 / 200000 estimated input · 17906 / 250000 actual input · 552 / 40000 output tokens
Review batching
1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
17906 input · 552 output · 0 cache read · 0 reasoning tokens
Report
db9aeb464dd189eb490825fcbc439465a8caa0f1da01dfaa8bf47ee4f9dfd9f6