TavernKeeper Scan Report

bal-spec/sillytavern-character-memory

Commit 37b2102 Reviewed

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 31 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (31)

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This test reads a configurable setting for the local or user-selected model service. It does not show that the value is stolen or sent somewhere unexpected.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The candidate corresponds to reading a model endpoint setting from the test process environment. The file is an integration-test client, and the endpoint is used for the configured LLM workflow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:33

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a regular expression used by a translation-extraction build tool to find marked text. It does not handle user secrets, network requests, or persistence.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression scans source text for data-i18n attributes and is used only by tooling to collect localization keys. The supplied evidence shows no attacker-controlled runtime input or security-sensitive destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
tooling
Source
scripts/extract-strings.js:83

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a French translation of a normal interface label for showing or hiding an API key. It does not contain an API key or other credential.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The scanner matched a generic credential pattern on a localization value whose supplied context is a translated UI string. The evidence shows no secret value, credential-bearing data, execution, transmission, or persistence; the match is a false positive caused by the label's wording.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
locales/fr-fr.json:378

Credential access and network transmission in one file

Expected behavior · high confidence

This test code contacts the configured local or test LLM service to discover a model and submit sample chat text. It does not show credential collection or transmission.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The flagged network calls use TEST_LLM_URL, defaulting to a loopback service, and send the deliberately constructed extraction prompt and fixture chat to an LLM endpoint. No credential source, secret retrieval, or unrelated destination is shown. The code is located in a documentation test plan rather than the extension runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 4
Rule
credential-exfiltration
File role
documentation
Source
docs/plans/2026-02-26-automated-testing-plan.md:610

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a French translation for a normal settings label about showing or hiding an API key. The evidence does not contain an actual key or show it being transmitted.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The scanner match is on a localization string whose value is ordinary interface text. No credential value, data flow, destination, execution, or persistence behavior is evidenced in the supplied context; the project purpose also explicitly includes user-configured LLM connections and API keys, making this label proportionate to the stated functionality.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
locales/fr-fr.json:378

JavaScript analysis reported javascript.xray.sql-injection

Expected behavior · low confidence

The flagged line builds a visible batch-extraction popup for selecting chats. The supplied evidence does not show a database query, attacker-controlled SQL, or harmful data flow.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.sql-injection in this repository.

Contextual assessment: The candidate points to a call that renders static HTML through the host popup API and wires UI handlers. No SQL operation, query construction, database sink, or controllable SQL input is present in the supplied context; the scanner signal is therefore not substantiated by the available code excerpt.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.sql-injection
File role
production
Source
index.js:9936

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a translation for a normal interface label about showing or hiding an API key. It is not an actual key or secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The supplied match is in a production localization file and the value is ordinary translated UI text. The evidence shows no credential material, data flow, destination, or execution behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
locales/fr-fr.json:378

Credential access and network transmission in one file

Expected behavior · high confidence

This test uses the configured LLM address and optional test token to authenticate requests. The token is sent to the endpoint the user selected, which is the purpose of this client.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The file reads a test-only environment token, adds it as a bearer authorization header, and sends model-discovery requests to the user-configured LLM_URL. The default endpoint is local, and the destination is configurable rather than hidden or fixed to an unrelated service.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 4
Rule
credential-exfiltration
File role
test
Source
test/integration/llm-client.js:48

Credential access and network transmission in one file

Expected behavior · high confidence

This test reads an optional API key from the test environment and sends it to the locally configured language-model server during an explicitly named live integration test. It does not show hidden collection or transmission to an unrelated destination.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The supplied documentation describes a live integration-test helper that reads TEST_LLM_KEY, conditionally adds it as a bearer credential, and posts test prompts to LLM_URL, which defaults to loopback and is configurable for the test environment. The same-file credential source and network sink are therefore consistent with authenticated testing of the project's stated LLM functionality. The evidence does not show automatic production execution, concealment, unrelated destinations, or persistence; the artifact is a plan/documentation file rather than shipped runtime code at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 4
Rule
credential-exfiltration
File role
documentation
Source
docs/superpowers/plans/2026-04-23-chunked-consolidation.md:708

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

The test passes the optional LLM key to the LLM server configured for testing. It is not shown being copied to a separate or concealed destination.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The matched flow is environment variable to Authorization header on a fetch directed to LLM_URL. The same configured endpoint is used for model discovery, with no evidence of an additional destination, encoding, persistence, or concealed execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
test
Source
test/integration/llm-client.js:48

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The test connects to the model server selected by the test operator, commonly a local server. This is required to test LLM integration.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The outbound request targets the configured LLM endpoint and requests its model list, matching the integration-test purpose. No fixed external destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
test/integration/llm-client.js:19

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern identifies template-based translation text during development. It is not part of the extension's chat or memory processing and does not send data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The expression parses tagged template literals in a build-time extraction script, normalizing interpolation placeholders before collecting keys. It performs local file scanning only; no sensitive data flow or execution sink is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
tooling
Source
scripts/extract-strings.js:175

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

The test sends the configured token along with the chat request to the selected model server, as needed for authenticated testing.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The request to the configured chat-completions endpoint reuses authHeaders(), which conditionally contains the TEST_LLM_KEY bearer token. The request body contains the test prompt and generation settings; the evidence shows no unrelated network sink or exfiltration behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
test
Source
test/integration/llm-client.js:90-95

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This is another detection of reading the configured test endpoint. The available evidence shows normal test configuration rather than credential theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment-derived endpoint is used to construct the model-discovery request. Its use is consistent with configurable provider testing.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:19

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The supplied evidence shows only a generic static warning and does not identify a suspicious destination or behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate retains no matched literal or actionable data-flow detail. The surrounding code is ordinary user-interface and file-conversion logic, so the signal is insufficient to establish a harmful link or network operation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:1265

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

The flagged text is part of a visible setup form for entering a model server address and API key. That matches the extension's stated purpose of sending chat memories to a user-selected language model.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows a user-facing connection wizard with escaped, configurable base URL and API-key fields, an explicit connection test, and documented LLM-provider functionality. The candidate provides only a static scanner signal and does not show hidden redirection, credential transmission to an unrelated destination, obfuscation, or concealed execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:5686

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test reads a timeout setting so slow model calls can complete. That is ordinary integration-test configuration.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment value controls request timing and does not represent sensitive credential access or an outbound sink.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:35

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern replaces placeholders while extracting translation strings. It is ordinary localization tooling and does not indicate malicious behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged replacement expression is used to normalize template interpolation tokens for locale-key extraction. The surrounding code shows local parsing and collection of strings, with no credential access, external destination, persistence, or concealed execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
tooling
Source
scripts/extract-strings.js:157

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged address is a documented default for connecting to a language model running on the user's own computer. It does not indicate a suspicious external destination or hidden data transfer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is a fixed localhost base URL in the provider configuration, paired with a local-server provider, no authentication requirement, and explicit support for user-configurable local endpoints. This is proportionate to the extension's stated local-model integration purpose and is not evidence of malicious network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:423

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test reads a token limit to control how much text the model may generate. It does not show that credentials are exposed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment-derived numeric value configures generation size only; no sensitive data flow is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:25

JavaScript analysis reported javascript.download-to-execution

Expected behavior · low confidence

The warning combines broad indicators but does not show that downloaded content is executed. The visible code performs user-requested file reading and memory conversion.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The supplied window shows an application-controlled file retrieval followed by heuristic or LLM-based conversion and UI rendering. It does not show a network response reaching an execution sink, nor concealed execution, persistence, or attacker-controlled code loading.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:923-1210

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The flagged line only reads an optional model name from an environment variable so the test can use the configured model. It does not collect or transmit credentials there.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The candidate is located on an environment-variable assignment for TEST_LLM_MODEL. The surrounding code separately reads an explicitly named test bearer token, conditionally places it in an Authorization header, and sends requests to the configured LLM endpoint. This is consistent with an integration test client and does not show environment serialization, credential theft, or an undisclosed destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:37

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged line preserves a user-configured local Ollama address during a settings migration. It points to a local model server and does not show data theft or a concealed external connection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is a fixed local HTTP base URL assigned to the migrated provider configuration. The surrounding code copies the existing Ollama URL when present, otherwise selecting a localhost default, which is consistent with the extension's documented local-server provider support. No exfiltration, obfuscation, or attacker-controlled destination is shown by this evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:1566

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test optionally reads an API token and places it in an authorization header for the model service the user configured. That is expected for authenticated LLM testing.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The credential is sourced from an explicitly named test environment variable and used as a bearer authorization header for the configured LLM endpoint. The supplied code shows no unrelated destination or persistence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:20

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a normal text-cleaning pattern used to remove markdown tables from chat messages before memory extraction. The supplied code does not show secret access, external transmission, or hidden execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regular expression is applied by stripNonDiegetic to user or character message text during formatting for the documented memory-extraction workflow. It has no external side effects or security-sensitive data flow in the supplied context. Although the expression may be inefficient for unusually large or adversarial input, the shown bounded chat-processing use does not establish a practical denial-of-service vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
lib.js:387

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is a normal example address shown as a placeholder for a locally hosted model server. It is not evidence that the extension connects to or sends information to that address.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows the signal at a UI placeholder assignment for a configurable custom base URL. The value is presented conditionally for local, unauthenticated providers and is not an active request, credential transmission, redirect, or concealed destination. The project purpose explicitly includes local model servers and custom provider connections.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:5553

JavaScript analysis reported javascript.credential-to-network

Expected behavior · high confidence

The test sends the optional API token to the model endpoint chosen by the test operator so authenticated requests work. This is part of the stated LLM integration test.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.credential-to-network in this repository.

Contextual assessment: Credential-to-network correlation is explained by the authorization header applied to requests sent to the configurable LLM URL. The evidence does not show exfiltration to a concealed or unrelated service.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.credential-to-network
File role
test
Source
test/integration/llm-client.js:25-48

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is an example address shown in a setup form for connecting to a user-selected local or remote model server. It is displayed as a placeholder and is not an outgoing connection or hidden data transfer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows the value assigned to an input placeholder based on the selected provider's authentication mode. The value is not fetched, executed, or transmitted by this statement. The surrounding documented purpose explicitly includes configurable local and remote LLM connections, so this fixed example address is proportionate UI behavior rather than suspicious network activity.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:5858

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a translation entry describing a normal user-interface control for showing or hiding an API key. It is not an actual key or credential.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched line is a localized UI string whose value describes an API-key visibility toggle. The supplied evidence contains no secret-like value, credential assignment, transmission, or execution behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
locales/fr-fr.json:378

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test reads a switch controlling whether the model should skip internal reasoning. This only changes request behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment flag controls an optional request parameter and is not sensitive credential access or persistence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
test
Source
test/integration/llm-client.js:29

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged line is a visible base-URL field for configuring the model service used by the extension. It is not evidence of a hidden or suspicious link.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source context shows the signal at a user-facing configuration input whose value is derived from the selected provider settings and whose purpose is to configure an API or local model endpoint. No concealed destination, automatic transmission, credential exfiltration, or obfuscated execution is shown by this candidate evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:4325

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity