TavernKeeper Scan Report

mattjaybe/SillyTavern-Larson

Commit 142b1e4 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner saw a URL read and an HTML-writing operation in the same file and flagged it as suspicious. In reality, the code reads a script tag's path to find its own folder and writes a fixed settings menu template. Neither piece involves downloading and running external code, and no user or network data enters the HTML template.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner rule javascript.download-to-execution correlates a network-retrieval primitive with a code execution sink in the same file. In this code, the only URL-related operation is reading script.src attributes via querySelectorAll to derive BASE_URL for the extension's own static assets; there is no fetch, XMLHttpRequest, dynamic import, or eval. The innerHTML assignment in createThemeModal uses a hardcoded template literal containing only static HTML markup with no interpolation of external or user-controlled data. No download-to-execute data flow exists. The file is a self-contained UI extension that manipulates DOM, reads CSS variables for theming, and persists settings via SillyTavern's context API, all consistent with its stated purpose as an animated status bar extension.

Impact: none · Exploitability: unlikely

Developer action: No action required. The innerHTML template is static; no untrusted or network-retrieved data flows into it.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:3-2223

Related contextual observations

Static innerHTML template in createThemeModal

low risk · high confidence

The extension builds its settings dialog by writing a fixed block of HTML into the page. Because no outside or user-typed data is inserted into that HTML, there is no injection risk. This is a normal way for browser extensions to create their UI.

Technical assessment

createThemeModal assigns a static template literal to overlay.innerHTML. The template contains only fixed HTML elements, Font Awesome icon classes, and placeholder text with no dynamic interpolation. No user input or network-retrieved data flows into this innerHTML sink, so there is no demonstrated HTML injection or code execution path.

Impact: none · Exploitability: unlikely

Developer action: No action needed for the current static template. If dynamic values are ever added to this innerHTML, sanitize or use textContent/element construction to prevent HTML injection.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity