TavernKeeper Scan Report

pixelnull/sillytavern-DeepLore

Commit dc2345a Reviewed Aug 9, 2026

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 110 low

What this review found

JavaScript analysis reported javascript.download-to-execution

Material concern · low confidence

The scanner reports both downloading data and executing code somewhere in this file, but the supplied excerpt does not show whether they are connected. If connected and reachable by an attacker, this could let downloaded content run as the user.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The evidence establishes only a broad correlation across lines 130–1799 between a network retrieval primitive and a dynamic execution sink. It does not provide the relevant statements, data-flow edges, destination, trigger, or attacker-control path, so exploitation and intent cannot be determined.

Impact: high · Exploitability: plausible

Developer action: Provide the full source or narrowed code/data-flow context for the reported retrieval and execution operations, including whether downloaded data reaches the sink and when it runs.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.download-to-execution
File role: production
Source: src/ui/settings-ui.js:130-1799

Minor cautions

zizmor reported excessive-permissions

Minor caution · low confidence

The automated test job may receive more GitHub access than it needs. The supplied workflow does not show a harmful action, but limiting access would reduce damage if a test step or dependency were compromised.

Technical evidence

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The scanner reports excessive workflow permissions, but the supplied excerpt contains only checkout, Node setup, dependency installation, tests, and linting, with no demonstrated privileged operation or attacker-controlled execution path. This supports a hardening issue rather than an immediate vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Add an explicit least-privilege permissions block and grant only the permissions required by the test workflow.

Scanner: zizmor 1.28.0
Rule: excessive-permissions
File role: tooling
Source: .github/workflows/tests.yml:9-20

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow downloads a reusable action by a movable version label. If that label or its release were compromised, future test runs could execute unwanted code.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The supplied source shows a mutable version reference for the checkout action. Because the workflow runs dependency installation and project tests on a hosted runner, a compromised action reference could execute code in the workflow context; no compromise or secret exposure is demonstrated here.

Impact: medium · Exploitability: plausible

Developer action: Pin the action to an immutable commit SHA and update it deliberately through reviewed changes.

Scanner: zizmor 1.28.0
Rule: unpinned-uses
File role: tooling
Source: .github/workflows/tests.yml:12

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow downloads the Node setup action by a movable version label. A compromised update could run code during automated tests.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The supplied source shows a mutable version reference for the Node setup action. The action executes before package installation and tests, so an upstream reference compromise could affect the runner, although the evidence does not show malicious behavior or a concrete exposed secret.

Impact: medium · Exploitability: plausible

Developer action: Pin the action to an immutable commit SHA and update it deliberately through reviewed changes.

Scanner: zizmor 1.28.0
Rule: unpinned-uses
File role: tooling
Source: .github/workflows/tests.yml:13

Dependency advisory GHSA-h67p-54hq-rp68 applies

Minor caution · low confidence

A scanner found a known issue in a dependency, but the supplied evidence does not show which package is affected or whether the extension uses it when running.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.

Contextual assessment: The evidence identifies only an advisory and a lockfile candidate. Package identity, affected version, reachability, attacker-controlled input, and runtime impact are unavailable; the visible manifest places the direct dependency in development tooling.

Impact: low · Exploitability: unlikely

Developer action: Identify the dependency and installed version, confirm whether it is production-reachable, and update or remove it if applicable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-h67p-54hq-rp68
File role: production
Source: package-lock.json

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · low confidence

The scanner reports a high-severity dependency issue, but there is not enough information to tell whether it affects the running extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: Only the advisory identifier and generic scanner explanation are supplied. The affected package, version range, runtime reachability, input path, and concrete impact cannot be established.

Impact: low · Exploitability: unlikely

Developer action: Identify the dependency and installed version, confirm runtime reachability and attacker-controlled input, then update or remove it if applicable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-3jxr-9vmj-r5cp
File role: production
Source: package-lock.json

Dependency advisory GHSA-5p4m-2wfm-xmqj applies

Minor caution · low confidence

A known dependency advisory was detected, but the supplied material does not establish a practical attack against users of this extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5p4m-2wfm-xmqj to a dependency declared by this repository.

Contextual assessment: The candidate lacks package identity and version details. No runtime import, attacker-controlled input, or exploitable execution path is shown.

Impact: low · Exploitability: unlikely

Developer action: Identify the dependency and installed version, determine whether vulnerable code is loaded in production, and remediate if reachable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-5p4m-2wfm-xmqj
File role: production
Source: package-lock.json

Dependency advisory GHSA-52cp-r559-cp3m applies

Minor caution · low confidence

The scanner found a reported dependency problem, but the evidence does not show that the affected code runs or can be reached by an attacker.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.

Contextual assessment: Advisory metadata alone is insufficient for a material finding. The supplied context omits the matched package, installed version, reachability, and attacker influence over vulnerable data.

Impact: low · Exploitability: unlikely

Developer action: Resolve the advisory to its package and shipped version, assess production reachability, and update the dependency where necessary.

Scanner: osv-scanner 2.4.0
Rule: GHSA-52cp-r559-cp3m
File role: production
Source: package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Minor caution · low confidence

The advisory may concern a dependency used only during development, but the supplied evidence does not identify it or prove that distinction.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: The lockfile scanner result is not accompanied by package details. Runtime use, vulnerable code path, input control, and resulting harm remain unestablished.

Impact: low · Exploitability: unlikely

Developer action: Determine the affected package and version and verify whether the vulnerable behavior is reachable in the shipped extension; patch if so.

Scanner: osv-scanner 2.4.0
Rule: GHSA-mh99-v99m-4gvg
File role: production
Source: package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Minor caution · low confidence

A scanner warning alone does not show that users are exposed; more dependency and runtime information is needed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: The supplied candidate contains only an advisory identifier and generic match statement. No package, version, reachability, attacker-controlled input, or concrete impact is provided.

Impact: low · Exploitability: unlikely

Developer action: Identify the affected dependency and installed version, assess whether production code reaches the vulnerable functionality, and remediate if applicable.

Scanner: osv-scanner 2.4.0
Rule: GHSA-rgw5-rvv9-x895
File role: production
Source: package-lock.json

Expected scanner matches (101)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension creates a local HTTPS address to help diagnose its user-configured Obsidian connection. This is part of its stated vault-integration setup, not evidence of contacting an unrelated service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The shown code constructs a certificate-diagnostic address from the configured host and port after a local connection failure. The destination is user-supplied and tied to the Obsidian REST API workflow; no external fixed destination or concealed transmission is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:419

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This code reads the connection details entered in the setup wizard and uses them to test the user's Obsidian vault connection. That is the feature's stated purpose, not a hidden destination or suspicious link.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is a fixed host fallback used with user-supplied host, port, API key, and protocol settings before calling the imported connection-test routine. The surrounding code displays certificate guidance and opens a returned certificate URL only after a connection error and user click. The supplied evidence shows no concealed external destination, automatic credential exfiltration, obfuscation, or unrelated persistence; the actual imported network implementation is not included here but is not needed to contextualize this literal signal as expected connection behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:374

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The retained source context shows ordinary settings UI behavior, including user-visible connection links, without enough data to establish concealed or harmful network access.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:880

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged operation checks the configured Obsidian host before sending a request, which fits the extension's stated purpose of connecting to a local vault.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is on host validation immediately before request construction. The supplied context shows validation intended to restrict requests to loopback or LAN hosts, with the bearer token added only afterward. No arbitrary external destination or concealed transfer is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:242

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This reads a host and port that the user entered into the setup wizard so the extension can display the selected vault connection. The supplied evidence does not show data being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:1057

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a configurable local proxy address used by an AI note feature. The supplied evidence does not show secret collection or data being sent to an unrelated destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged fixed network value is a loopback proxy endpoint associated with an explicitly documented AI Notepad connection setting. The evidence shows configuration only and no exfiltration flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:117

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a fixed hostname check in a proxy URL validator. It blocks a cloud metadata address rather than contacting it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied code compares the parsed hostname against a small denylist and throws before constructing or sending the proxy request. The scanner signal does not show a suspicious destination or data exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ai/proxy-api.js:31

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

This is a test that checks whether analytics can safely handle a specially named entry without changing the underlying object prototype.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.

Contextual assessment: The flagged line constructs a test input using a prototype-sensitive property name, then invokes the analytics recorder and asserts that the resulting prefixed key is an own property containing a normal value. The supplied context shows defensive test coverage rather than an unsafe assignment or attacker-controlled execution path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.prototype-pollution
File role: test
Source: test/unit.mjs:3651

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a local proxy setting for the session-summary feature, not evidence of a suspicious outside connection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fixed endpoint is loopback and is paired with documented Session Scribe connection configuration. No request construction, credential handling, or external destination is supplied.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:149

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a local-network address check used before connecting to Obsidian. The scanner signal alone does not show a suspicious external link.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied code validates an Obsidian host and restricts accepted destinations to loopback or private/link-local address ranges before API-key use. No external destination or concealed execution is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:34

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This value sets the default local address for an Obsidian vault, matching the extension’s stated purpose of connecting to a local Obsidian service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited code assigns a loopback host during migration of an existing vault configuration. It is a local default, not an external destination or data transmission mechanism.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:481

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The scanner noticed a possible obfuscation pattern, but the supplied evidence does not show hidden behavior or executable payloads. The flagged file is a large unit-test file containing ordinary imports and test code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based only on a low-confidence static obfuscation signal. Supplied context identifies the artifact as a test module and does not retain the matched literals or demonstrate concealed execution, data collection, persistence, credential access, or an external destination. The project purpose and visible imports are consistent with testing application functionality, so the signal alone does not establish a security issue or malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.obfuscated-code
File role: test
Source: test/unit.mjs:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged behavior is a local connection check for the Obsidian service that this extension is designed to use. It checks nearby localhost ports over HTTP and HTTPS, optionally including the user-provided service key, rather than sending data to an unrelated external destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source constructs requests from a configurable host, defaulting to localhost, and scans a bounded port range around the documented Obsidian Local REST API port. Requests are GET probes with an optional caller-supplied bearer token, bounded by timeout and abort handling. The evidence shows no external destination, persistence, obfuscation, or unrelated collection in this candidate's code context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/scanner.js:32

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension downloads its own nearby icon and displays it in the drawer. This is a normal interface feature, not a download of executable code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The network request targets a relative module-resolved SVG asset. The response is read as text and inserted into the drawer as markup; no dynamic JavaScript evaluation, command execution, remote script loading, or user-controlled destination is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.download-to-execution
File role: production
Source: src/drawer/drawer.js:223-238

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The available evidence is a low-confidence scanner signal in a test file. The supplied context shows ordinary delete-safety tests and does not show hidden or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based only on a low-confidence obfuscation heuristic; matched literals and the underlying flagged construct were not retained. The visible file context is a test module importing validators and exercising path-safety checks, with no demonstrated concealed execution, persistence, credential handling, or external destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.obfuscated-code
File role: test
Source: test/prompts-delete-safety.test.mjs:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test value representing a local proxy address. The supplied evidence shows it is checked for settings migration and preserved for rollback, not sent elsewhere or executed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The signal occurs in a regression test fixture. The fixed localhost proxy value is assigned to a settings object, passed through migration logic, and asserted unchanged. No network operation, credential handling, or execution sink is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:7909

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This check rejects local or reserved network addresses to reduce the risk of unwanted internal-network requests.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code tests the parsed hostname against explicit local and private-network conditions, with an intentional exception for the documented loopback address. The matched network-access signal reflects validation logic, not an outbound request.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ai/proxy-api.js:51

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner flagged a local proxy address in a test that checks cache invalidation. The supplied evidence does not show harmful networking or data transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited context uses fixed loopback proxy values solely as inputs to a settings-key construction and equality test. No request, credential access, or external destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:868

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test fixture for checking that a saved local proxy setting remains unchanged. It does not show the extension contacting an outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is located in a test object containing a localhost proxy URL. The surrounding code invokes pure migration logic and compares the resulting setting with the expected value; the supplied evidence does not show request construction, transmission, or dynamic execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:7898

zizmor reported artipacked

Expected behavior · low confidence

The scanner suspects that a workflow artifact could preserve credentials, but the supplied workflow has no artifact-upload step. More workflow context is needed to confirm whether this finding applies.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The candidate metadata identifies an artifact credential-persistence rule, while the supplied source excerpt shows no artifact action, upload command, or credential-handling operation. The finding is therefore not substantiated by the available source.

Impact: none · Exploitability: unlikely

Developer action: Inspect the complete workflow and artifact configuration; prevent credentials or other sensitive files from entering uploaded artifacts, and remove artifact upload if unnecessary.

Scanner: zizmor 1.28.0
Rule: artipacked
File role: tooling
Source: .github/workflows/tests.yml:12

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged operation starts a local-network scan for the Obsidian vault service, which matches the extension's documented connection and discovery feature. The scan is user-triggered through this popup and uses the configured local host and authentication key.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The evidence shows a call to the imported vault scanner with a host defaulting to loopback, a configured port center and radius, an abort signal, and progress callbacks. This is proportionate to the documented localhost vault-discovery workflow; no external destination or concealed execution is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/vault-scan-popup.js:151

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test using a local address to simulate a failed AI proxy request. It checks that secret text is removed from error messages, rather than sending real user data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows a regression test mocking fetch, invoking the proxy helper with a loopback URL, and asserting that API-key-like and bearer-token-like values do not appear in the resulting error. No production execution or external destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:5059

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test checks that an in-progress local connection test can be cancelled. It does not demonstrate hidden networking or data theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The context shows a mocked fetch that waits for an abort signal, followed by a local loopback request and assertions for an aborted result. This is cancellation-behavior testing, not an outbound production data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:4996

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test that checks a deliberately invalid prompt deletion request is rejected before any network operation.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is in a test file and invokes the extension's prompt-deletion API with an empty path prefix. The assertion expects a failure result, indicating input validation rather than harmful network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:182

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

The flagged value is a short fixed test hash used to check duplicate-entry handling. The supplied evidence does not show hidden execution, data collection, or a suspicious destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The signal occurs in a test fixture at the reported line, where a deterministic content-hash-like value is assigned before testing strip-and-dedup behavior. No decoding, dynamic execution, credential access, network activity, or persistence is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/stages.test.mjs:712

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test confirms that an unknown prompt name cannot be deleted.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The test calls the deletion function with an unrecognized prompt stem and expects an unsuccessful result. The fixed local address is test input, not evidence of an outbound action succeeding.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:207

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a local proxy address used for AI-generated search, matching the extension's stated retrieval feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The value is a loopback proxy configuration for AI Search. The project purpose explicitly includes optional AI retrieval, while supplied evidence contains no hidden transmission or unrelated recipient.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:81

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension checks the alternate local HTTP endpoint when HTTPS fails so it can explain whether the problem is a certificate, authentication, or connectivity issue.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fallback request targets the configured Obsidian host and alternate port, validates the host first, uses a short timeout, and sends the API key as the authentication header required by the local REST API. This matches the documented connection-diagnostic purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:464

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The available source context shows normal user-facing connection configuration and no demonstrated malicious link flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:328

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This flagged line is a test that checks whether the extension rejects a missing folder prefix. It does not itself send data, open an external connection, or run hidden code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source context shows a negative test invoking a prompt-folder listing function with a null prefix and asserting failure. The scanner signal is therefore attributable to test input text, not suspicious runtime network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:222

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This flagged line is test data containing a local vault address and placeholder key, used to verify that removing a vault does not happen when confirmation fails. It does not show a real connection or data transfer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source context places the signal inside a regression test fixture. The host values are loopback addresses and the key-like values are static placeholders. No network operation, credential collection, or external destination is shown in the candidate context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:5849

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

The flagged text is a fixed test value used to check cache behavior. It does not show hidden instructions, secret theft, or an external connection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The supplied context places the match in an integration test that constructs a cache object with ordinary fixed identifiers and compares them against equivalent fixed values. No decoding, execution, credential access, persistence, or network destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/integration.mjs:648

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension deliberately blocks a few dangerous local destinations while allowing the documented local proxy address.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied lines reject localhost, unspecified-address, IPv6 loopback, and an IPv4-mapped loopback representation. These are defensive URL checks in a deprecated proxy module and do not disclose data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ai/proxy-api.js:35

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This flagged line is a security test using a deliberately unsafe-looking folder path to confirm traversal is blocked. It is not an attack performed by the extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source context shows a test passing a parent-directory traversal prefix to the folder-listing function and asserting a false result. This is defensive validation of path handling, with no evidence of execution or data transmission.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:217

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test verifies that a cancelled local connection attempt returns the right status and does not continue waiting. That matches the extension's connection-diagnostic purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied test pre-aborts an AbortController, replaces fetch with a recording mock, calls the proxy connection helper against loopback, and checks the aborted result. No credential access or external transmission is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:5079

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. No suspicious endpoint, hidden navigation, or credential transfer is demonstrated by the retained context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:245

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The flagged pattern is a regular expression used to recognize frontmatter keys. The supplied context shows ordinary metadata parsing and preservation, not secret collection, hidden execution, or data transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed expression is anchored to a complete line, uses Unicode character classes, and is applied to frontmatter lines for key detection. The supplied evidence does not demonstrate attacker-controlled repeated input, catastrophic backtracking, network activity, credential access, persistence, or concealed behavior. The scanner signal alone is insufficient to establish an unsafe-regex vulnerability; performance impact is unlikely in this bounded line-oriented use.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/helpers.js:350

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · low confidence

The scanner detected a literal used in a test file, but the supplied context shows ordinary test data rather than hidden or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The available evidence identifies an encoded-literal signal without retaining the matched value or showing its use. The surrounding supplied source is regression-test code and does not establish obfuscation serving malicious execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/regression.test.mjs:820

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line is part of protection against sending an Obsidian key to an unsafe address, not evidence of data theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The shown host-validation logic rejects a blocked metadata address and other disallowed destinations. The scanner candidate lacks retained matched literals, but the supplied source context explains the network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:35

JavaScript analysis reported javascript.xray.sql-injection

Expected behavior · high confidence

The flagged section is instructions sent to the librarian AI describing the JSON response format and editor behavior. It does not perform database queries or execute user-controlled SQL.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.sql-injection in this repository.

Contextual assessment: The candidate covers a template literal containing static prompt text, JSON examples, interpolated configuration text, and response-format rules. The supplied code shows no SQL construction, database API invocation, query execution, or attacker-controlled value reaching a database sink in the flagged range.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.sql-injection
File role: production
Source: src/librarian/librarian-session.js:617-686

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

When the user clicks the vault-scan control, the extension opens a local-vault discovery dialog and passes the configured connection credential so a newly found vault can be added. This matches the advertised Obsidian integration; the supplied code does not show an external or concealed destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged location is within an explicit user-initiated vault-scan handler. It supplies the configured vault credential to the imported scan dialog and later stores the credential on a selected vault configuration. The surrounding evidence shows localhost-oriented vault discovery and separate user-triggered connection testing, with no evidence here of credential transmission to an unrelated service, hidden execution, or obfuscation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:1847

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Adding the configured Obsidian API token to a request is necessary for the advertised vault connection and is shown next to the host restriction.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged operation creates an Authorization header from the caller-provided API key after host validation. The destination is the configured Obsidian endpoint, and the project purpose explicitly includes Obsidian REST API access. The evidence does not show logging or forwarding of the token elsewhere.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:239

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Resetting the connection failure counter is done when the user explicitly tests the Obsidian connection, allowing a fresh diagnostic attempt.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The circuit breaker is reset inside the exported connection-test function immediately before the configured Obsidian vault request. This is explicit user-facing retry behavior and does not establish persistence or concealment.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:401

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern is used to read a structured list from saved lore text. It does not by itself send information, run commands, or create a security threat.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression parses indented tag-list lines from YAML-like frontmatter. Its input is document content and the supplied context shows no security-sensitive side effect or attacker-controlled execution path associated with it.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/librarian/librarian-review.js:85

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a pattern used to preserve indented text while the extension cleans up prose. It does not access credentials, send data, or execute commands.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged multiline regular expression is applied to the input text during markdown-oriented compression, replacing contiguous indented lines with temporary markers for later restoration. The pattern is bounded by line structure and indentation, with no attacker-controlled destination or security-sensitive side effect shown. Although regex backtracking risk cannot be fully characterized from the scanner metadata alone, the supplied implementation provides no meaningful denial-of-service path in this context and the use matches the extension's stated text-processing purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/caveman.js:72

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

When the user saves field definitions, the extension sends those definitions to the Obsidian vault configured by the user. This is the feature's intended storage operation, not a hidden connection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged call occurs inside the explicit save handler after validation. It uses the configured vault host, port, API key, path, and protocol to invoke the imported Obsidian-writing helper, then updates local state and rebuilds the index. The supplied evidence shows no unrelated destination, concealed execution, or exfiltration behavior at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/rule-builder.js:366

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The flagged dynamic execution appears in a test that extracts a known helper from project source so its behavior can be tested. The supplied evidence does not show user-controlled code being executed by the extension.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The match is at a test-only factory used to evaluate extracted, repository-controlled helper source for regression testing. No attacker-controlled input, runtime extension path, persistence, or external destination is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: test/audit-fix-privacy.test.mjs:229

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

When the configured Obsidian server cannot be reached, the extension returns a clear error telling the user what to check.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The plain-HTTP fetch-failure branch returns an unreachable diagnosis containing the configured host and port. It does not send data to a new destination or perform hidden execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:442

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The network request reads from or writes to the configured Obsidian vault, which is the extension's core function, and it uses the earlier host restriction.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fetch target is assembled from the selected HTTP or HTTPS protocol, validated host, port, and API path. The surrounding code sends the configured authorization header and request body to that endpoint. This is proportionate to the documented Obsidian integration; no unrelated destination or hidden timing is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:276

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line removes an accidentally pasted web-protocol prefix and trailing slashes from the Obsidian host before saving it. That is ordinary setup input cleanup, not a connection to an outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows normalization of a user-entered host string by stripping HTTP or HTTPS schemes and trailing slashes. It performs no network operation, data transmission, execution, or concealment at the flagged location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:1146

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Allowing loopback and private addresses is expected for an extension that connects to a local Obsidian service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code permits localhost, loopback, private IPv4, and selected private IPv6 ranges, matching the documented Obsidian Local REST API integration. This is proportional to the stated purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:32

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

This is another test using a local proxy address to confirm that changing connection settings changes a cache key. It does not show a connection being made.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited line supplies a loopback endpoint as a value in a test fixture. The surrounding code only builds and compares cache-key strings; network access and data flow are not demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:870

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a documented local fallback address used when no configured vault is available. It keeps the extension pointed at the computer running Obsidian.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fallback object returned by the primary-vault resolver uses the loopback host and a disabled placeholder configuration. No request or credential transfer occurs at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:526

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · medium confidence

The flagged text is a fixed identifier in a test fixture for pseudonymizing diagnostic data. In the supplied context, it is ordinary test data rather than concealed instructions or a hidden destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The candidate is located in a test file and the surrounding test constructs a representative diagnostic trace, then checks that titles and vault names are pseudonymized. The matched literal is a short fixed generation identifier, with no demonstrated decoding, execution, credential access, network transfer, or persistence. The scanner signal alone does not establish harmful obfuscation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/diagnostics.test.mjs:1308

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test checks that invalid content types are rejected instead of being written.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The write operation receives a numeric content value and the assertion requires failure. This exercises input validation in a test-only context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:212

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:5850

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This fills in the same local address for older saved vault entries so they continue to work after the extension added remote-vault support.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The migration backfills a missing host field with a loopback address and marks settings for persistence. It does not contact that address, expose credentials, or redirect data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:494

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This line only displays a translated message telling the user which local ports are being scanned. It does not itself send data, execute commands, or expose credentials.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged interpolation constructs popup text from a bounded port range and an optional host value, escaping the resulting HTML before insertion. In context, this is disclosure of an intended localhost vault-discovery operation rather than a suspicious external link or covert network action.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/vault-scan-popup.js:27

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This local proxy setting supports the optional automatic lore suggestion feature described by the project.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged fixed network value is a loopback endpoint under Auto Lorebook Creation settings. It is consistent with the documented AI-assisted feature and does not itself demonstrate harmful network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:97

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The flagged text appears in a test fixture containing example email, IP, and API-key-like values used to verify diagnostic scrubbing. The supplied evidence does not show a real external connection, data collection, or secret transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is located in a diagnostics unit test whose surrounding assertions verify deep-copy behavior and redaction of sensitive fields. The scanner metadata does not retain the matched literal or demonstrate network access, execution, persistence, or exfiltration. Project documentation describes pseudonymized diagnostics exports, which is consistent with the test context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/diagnostics.test.mjs:814

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a normal pattern for finding wiki links in markdown text. It is used for the extension's lore retrieval feature and does not access credentials, run commands, or contact an outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression is a fixed, global regular expression applied to caller-supplied markdown to extract bracketed wiki-link targets. The supplied evidence shows no attacker-controlled construction, sensitive-data source, external sink, or harmful execution path. Although regex backtracking behavior can merit testing with unusually large inputs, this expression is structurally simple and the shown use is bounded by normal document processing.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: core/utils.js:154

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The supplied evidence points to a test that exercises masking of local addresses and secrets in diagnostic text. It does not show a suspicious link, external destination, execution, or data theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is a low-severity static signal attached to a single test line. The available context shows scrubber tests for IPs, tokens, URLs, and related diagnostic redaction, while retaining no matched literal or network-flow evidence. The project description also states that diagnostics are pseudonymized before sharing. This evidence does not establish malicious network behavior or a vulnerability in shipped runtime code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/diagnostics.test.mjs:590

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged the button that starts a local vault scan. The supplied code shows it loading the scan interface and passing the user-entered connection details, which matches the extension’s stated purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged statement dynamically imports the vault-scan popup and then supplies the configured host, API key, and port range to that user-triggered workflow. The evidence shows no unrelated destination, concealment, persistence, or unsolicited execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:557

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · low confidence

The flagged text is a fixed identifier-like value in a test fixture. The supplied evidence does not show that it executes, hides behavior, or sends information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The scanner reports an encoded-literal signal at a test-data line, but the supplied source context shows an ordinary test object containing descriptive fixture values. No decoding operation, execution sink, external destination, credential access, or persistence is evidenced. The project purpose also involves processing lore and model-provider requests, but this candidate itself is confined to a test fixture based on the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/verdict.test.mjs:44

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern is used to read a clearly labeled HTTP status from an error message while deciding whether a service outage should trip a circuit breaker. It does not execute code, contact a destination, or handle credentials.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regular expression matches an explicitly labeled three-digit status following terms such as HTTP or status. It is applied to err.message only for local classification, with no dynamic evaluation or externally observable side effect. The surrounding logic intentionally avoids broad numeric matching and excludes rate-limit and authentication failures from breaker trips, consistent with the documented AI-service error-handling purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/ai/breaker-pure.js:54

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test verifies that an unrecognized prompt name cannot be removed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The deletion API is tested with a non-permitted stem and must return failure. No successful deletion or data transmission is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:202

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · low confidence

The scanner found an encoded-looking literal in a test file, but the supplied evidence does not show that it hides harmful behavior or sends data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The candidate is a low-severity, medium-confidence static obfuscation signal at one line in a test file. The provided context shows ordinary test data and assertions, with no retained literal, execution path, destination, or concealment behavior demonstrating a security impact.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/audit-fix-lifecycle.test.mjs:259

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The flagged value is part of a regression test fixture for proxy configuration. The available evidence does not show suspicious communication or secret handling.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The cited context places a fixed local endpoint in test input used to verify cache invalidation when the endpoint changes. No runtime request, exfiltration, persistence, or concealed execution is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:886

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The visible code concerns connection-profile display and user-configured proxy settings, which is consistent with the extension's purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:787

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The retained lines show ordinary vault connection configuration, including a user-entered API-key field, without evidence of exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:107

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged field is part of a demo setup button that fills in a local Obsidian address. It does not send information by itself and is consistent with helping users connect the demo vault.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The event handler writes fixed localhost connection values into visible form fields, clears the API-key field, and asks the user to enter the key and test the connection. No network request or secret transmission is shown at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:492

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern finds IPv4 addresses so diagnostics can replace identifying network details with consistent pseudonyms. It does not send data or execute commands; it supports the stated goal of preparing shareable diagnostic reports.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed expression matches IPv4 addresses and optional ports. Its callback increments a statistic, preserves the first two octets, pseudonymizes the remaining suffix, and returns the transformed value. The supplied evidence shows no attacker-controlled execution or external transmission.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/diagnostics/scrubber.js:161

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern performs the same kind of normal document parsing for keyword lists. It is not evidence of harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression extracts indented key-list lines from YAML-like frontmatter. The supplied code shows ordinary parsing of vault entries, with no demonstrated dangerous destination, execution, persistence, or credential handling.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/librarian/librarian-review.js:90

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner flagged a fixed value in a test that checks behavior when a connection is missing an API key. The supplied excerpt does not show a suspicious link or harmful network action.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is a low-severity static signal at a test fixture line. The visible code constructs a localhost connection object without an API key and asserts compiled-in fallback behavior; no external destination, credential handling, execution, or obfuscation is shown. The retained scanner metadata does not identify the matched literal, so malicious interpretation is unsupported.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-store.test.mjs:598

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · medium confidence

The flagged text is an ordinary test value containing letters and numbers. The supplied evidence does not show hidden execution, secret handling, or suspicious data transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The candidate points to a fixed literal in a unit-test assertion validating a field-name format. No encoded payload behavior, decoding followed by execution, persistence, credential access, or external destination is shown in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/fields.test.mjs:38

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:995

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The alternate connection check includes the API key so the extension can distinguish an authentication failure from a certificate or network failure. It is directed at the configured Obsidian endpoint.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The validated alternate-port request places the supplied API key in the Authorization header and only interprets the response status. The evidence shows no unrelated destination, logging, persistence, or exfiltration path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:461

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

The flagged text is a fixed test value used to check that a secret-like URL parameter is removed. It does not show hidden execution, data collection, or transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The candidate is in a test asserting privacy behavior for URL sanitization. The flagged literal appears as a redacted secret marker in an input fixture, while the assertion checks that an unrelated placeholder value is absent and that a benign parameter remains. This is consistent with regression coverage for credential masking, not runtime obfuscation or exfiltration. The supplied evidence does not show execution of the test value as code, external communication, persistence, or concealed behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/audit-fix-privacy.test.mjs:245

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · medium confidence

The scanner found an encoded-looking value in a unit-test file, but the supplied context shows ordinary tests for lore-entry injection tracking and deduplication. There is no indication that the value hides harmful behavior or sends data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.

Contextual assessment: The candidate is a low-severity, medium-confidence static encoded-literal signal at a test assertion line. The provided source context is a test fixture containing a short content-hash value and associated deduplication logic; it shows no decoding, execution, persistence, credential access, or external destination. The signal alone is insufficient to establish obfuscation-based malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.encoded-literal
File role: test
Source: test/unit.mjs:3550

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged line only selects the configured local vault host, defaulting to the local computer when no host is set. This matches the extension’s documented purpose of connecting to an Obsidian vault.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows a fixed local-host fallback used while constructing a vault connection object. It does not show a remote destination, hidden execution, credential transmission, or obfuscation. The scanner signal is therefore consistent with ordinary connection setup for the stated local REST API integration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/prompts/prompt-store.js:109

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

The flagged line uses an API key only to distinguish cached vault configurations. The supplied code shows it being converted into a short hash rather than sent over the network, which fits persistent cache management.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The signal is on a cache-key construction expression containing vault host, port, protocol, and a hash of the configured API key. In the supplied production context, this value is used to namespace IndexedDB cache entries; no outbound destination or execution behavior is shown for this candidate. The README also describes an Obsidian REST connection, making configuration-based cache separation proportionate to purpose. The retained evidence does not establish exposure of the original key or malicious networking.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/cache.js:39

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged text is a deliberately redacted placeholder used in a regression test to confirm that error messages do not expose API keys or bearer tokens. It is not a usable credential.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The supplied test constructs synthetic response bodies containing clearly marked redaction placeholders and asserts that the proxy error path removes complete and partial secret values before truncation. No live credential, outbound exfiltration, or execution behavior is shown in this evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: test
Source: test/regression.test.mjs:4991

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The candidate is in a test utility that reads project files and uses a fixed regular expression to identify statically declared module exports. The expression is anchored to line starts, uses bounded structural tokens and a word-name capture, and is applied to source text during verification. No attacker-controlled runtime path, network destination, credential handling, persistence, or concealed execution is shown. The scanner signal therefore reflects a static pattern-matching heuristic rather than a security-relevant unsafe-regex vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: test
Source: test/verify-imports.mjs:244

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test checks that a path-traversal attempt is blocked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The deletion API receives a traversal-style key and the test expects rejection. This is defensive boundary testing, not evidence of traversal succeeding.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:187

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is part of the same protective blocklist for local proxy targets, not evidence that the extension is contacting them.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The hostname comparison and thrown error prevent the request from proceeding for the listed IPv6-related forms. The evidence shows validation and disclosure in an error message, but no credential handling or exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ai/proxy-api.js:36

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a default local address for an optional AI search proxy. It is used only when the user chooses proxy-based AI search, and it points to the local computer rather than an unknown external site.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context assigns a default loopback proxy URL when the non-keyword search mode is not profile-based. The value is configuration for a stated retrieval feature; no request, credential transfer, or runtime execution is shown at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:1189

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The supplied code handles user-configured vault hosts and connection tests, expected for this extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:159

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a compatibility test for connection validation with no optional cancellation signal. It checks an invalid empty address and does not expose user information.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The context shows the helper called with an empty URL and assertions that validation fails without marking the result as user cancellation. This is a unit/regression test with no meaningful security-impacting flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:4978

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is another local proxy option for the extension's configurable key-optimization AI feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fixed loopback address belongs to Optimize Keys connection settings. The supplied context shows an intended optional AI operation and no evidence of credential theft, covert execution, or unrelated network access.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:211

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The retry button repeats the same local vault scan with a wider port range after the user asks for a broader search. It does not show sending the key or vault data to an unrelated service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The retry handler is attached only when the empty-result retry control exists, disables that control, doubles the scan radius, and invokes the same scanner with the selected host, authentication key, local port center, and abort signal. The behavior is disclosed by the UI purpose and is bounded to the documented discovery action.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/vault-scan-popup.js:128

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This pattern identifies IPv6 addresses and replaces them with pseudonyms in diagnostic text. It is part of masking identifying information before reports are shared, and the evidence does not show any harmful action.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed expression matches IPv6-like hexadecimal address strings. Its callback increments an IPv6 statistic and passes the matched value to a pseudonymization function, returning the result. No network destination, persistence, or code execution is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/diagnostics/scrubber.js:177

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

Rejecting unrecognized public addresses helps keep the Obsidian connection on the local network.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied validation rejects public DNS names and global IPv6 addresses rather than sending credentials broadly. The scanner label does not establish malicious network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/vault/obsidian-api.js:50

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a local proxy configuration for the optional librarian assistant, which is part of the extension's stated purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fixed loopback endpoint is associated with Librarian connection configuration. The feature is disclosed, independently configurable, and gated by a disabled-by-default setting; no malicious destination or data flow is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: settings.js:134

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test checks that a failed AI request does not leak part of a secret in the displayed error. The secret-looking value is test data, and the assertion requires it to be hidden.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context constructs a mocked failed response containing a placeholder API-key-like value, invokes the proxy helper through a loopback endpoint, and asserts neither the full value nor a partial prefix is present in the error. This is defensive redaction coverage.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/regression.test.mjs:5016

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged line reads the host and port that the user entered for the Obsidian vault connection. This is needed to send the setup wizard's requested files to that vault.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is on a user-triggered setup action and obtains host, port, API key, and protocol from visible wizard controls before calling the imported vault-writing functions. The supplied evidence shows no hidden destination, automatic execution, obfuscation, or exfiltration beyond the configured Obsidian integration. The scanner signal alone does not indicate malicious network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/setup-wizard.js:848

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test confirms that oversized prompt content is rejected before writing.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The write API is supplied content exceeding the declared maximum and is expected to return failure. The evidence supports a size-limit test rather than a vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:192

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test checks that a missing deletion key is rejected.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The deletion API receives a null key and the test requires an unsuccessful result. No harmful side effect is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:177

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is another test-only use that evaluates a helper copied from the project's own source to verify URL-secret removal. It is not evidence that normal users can supply JavaScript for execution.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The dynamic execution occurs in a test factory after reading a repository source block matching the intended helper. The context shows regression tests for stripping URL credentials and token parameters, not production execution or attacker-controlled code flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: test/audit-fix-privacy.test.mjs:175

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test verifies that an invalid prompt name cannot be retrieved.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The fetch API is called with an unknown stem and must fail. The fixed local endpoint is test fixture data, and no successful request or sensitive-data flow is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: test
Source: test/prompts-api.test.mjs:197

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern only checks whether a YAML value is a number. It does not run code, contact a service, or expose information.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The fixed regular expression validates numeric scalar syntax before conversion with Number(). It has no attacker-controlled execution, external data flow, persistence, or meaningful denial-of-service exposure in this context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/fields.js:274

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a possible link-related pattern, but the supplied context does not show a suspicious destination or harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only a low-severity static signal is supplied. The visible link is a user-facing certificate or documentation action consistent with vault setup.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/settings-ui.js:91

Coverage and limitations

Inventory: 493 files · 42892492 bytes
Contextual coverage: 111 of 111 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 140 files · 4270865 bytes
Representations: 140 raw · 54 decoded · 1 normalized · 0 bundle modules
Stage scans: 140 raw signatures · 140 raw AST · 140 raw OpenGrep · 55 derived signatures · 2 derived AST · 54 derived OpenGrep

Unresolved JavaScript stages

src/graph/graph-health.js — derived-ast / parse
src/graph/graph-health.js — normalize / parse
src/i18n/prompts/en.js — derived-opengrep / parse
src/i18n/prompts/ja-jp.js — derived-ast / parse
src/i18n/prompts/ja-jp.js — normalize / parse
src/i18n/prompts/ja-jp.js — normalize / unsupported
src/librarian/librarian-review.js — derived-ast / parse
src/librarian/librarian-review.js — normalize / unsupported
src/ui/settings-ui.js — derived-ast / parse
src/ui/settings-ui.js — normalize / unsupported
test/regression.test.mjs — derived-ast / parse
test/regression.test.mjs — normalize / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 4 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: dc2345afa5e580bc8a4df6a37b5774354f6c90ba
Completed: Aug 9, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: api.openai.com · gpt-5.6-luna
Scanner: 0.1.0
Scanner policy: 4
Rule catalog: 1
Contextual policy: 2
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v5
Assessment schema: contextual-assessment-v1
Review usage: 441046 input · 28420 output · 0 cache read · 0 reasoning tokens
Report: 2fc9ba45d367ec673493fa200e28c1a125761d17aad24ee2e50964a46f43ca17