TavernKeeper Scan Report

Coneja-Chibi/TunnelVision

Commit febe618 Reviewed

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 15 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.obfuscated-code

Minor caution · low confidence

The scanner noticed a possible sign that some JavaScript may be harder to read, but the supplied evidence does not show what was matched or any harmful behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is a low-confidence obfuscation signal at the file start. The supplied source excerpt shows ordinary documented ES-module imports and summary-management logic, with no retained matched literals, execution sink, external destination, credential access, or concealment behavior. Obfuscation alone is insufficient to infer malicious intent, but unexplained obfuscation can reduce auditability; the file body and precise scanner match are needed for stronger assessment.

Impact: low · Exploitability: unlikely

Developer action: Provide the complete file or a scanner excerpt identifying the matched construct, then document or remove any unnecessary obfuscation.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
tools/summarize.js:1
Expected scanner matches (14)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test value for a local embedding service address. The test checks that the extension accepts local, keyless embedding setups; it does not show contact with an outside party or hidden behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is in a test file and concerns a localhost embedding endpoint used as fixture input. The supplied evidence shows no runtime request, credential transmission, persistence, or concealed destination; the behavior matches the documented embedding integration purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/llm-sidecar.test.js:489

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This is a test using a local sidecar address. It checks that a locally hosted service can work without an API key, which matches the extension’s AI sidecar purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows a test fixture for an enabled local endpoint and explicitly validates configuration handling. No execution, secret transmission, or concealed destination is shown at this candidate location; the scanner signal alone does not establish harmful network behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/llm-sidecar.test.js:155

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This test checks that an enabled sidecar can be configured without an API key, for local services that do not require authentication. That is consistent with the documented feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied source context is a unit test asserting configuration recognition for a loopback endpoint. It does not show data leaving the machine, credential collection, persistence, or hidden behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/llm-sidecar.test.js:80

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The available evidence only indicates that a scanner noticed possible code obfuscation. It does not show hidden behavior, stolen information, or an unusual destination. The visible file description matches an automatic summarization feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based on a low-confidence obfuscation signal, while the supplied source excerpt shows ordinary ES module imports and event-handler initialization for message counting and prompt injection. The artifact and matched literals needed to substantiate concealed execution or harmful data flow were not supplied, so the signal does not establish a vulnerability or malicious behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
auto-summary.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The scanner found a possible obfuscation pattern, but the supplied evidence does not show what was obfuscated or that anything harmful happens.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based on a low-confidence static obfuscation signal. The supplied source excerpt shows ordinary imports and documentation describing post-generation sidecar processing and lorebook writes, but it does not include the flagged construct, complete execution logic, data destinations, or evidence of concealed execution or credential handling. Obfuscation alone is insufficient to establish a security issue in this extension context.

Impact: none · Exploitability: unlikely

Developer action: Provide the unabridged JavaScript or a deobfuscated representation so the flagged construct, data flow, and destinations can be assessed.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
sidecar-writer.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern is used to recognize names and descriptive phrases in lorebook text so relevant story information can be selected. Nothing supplied shows attacker-controlled execution, secret handling, or external data transfer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The reported unsafe-regex signal corresponds to a fixed regular expression used by deriveAliasKeys to extract role descriptors from the first sentence of an entry. In the supplied context it processes local lorebook content for alias generation; no external destination, code execution, credential access, or persistence is shown. The expression may have performance edge cases on specially crafted large inputs, but the evidence does not establish a practical denial-of-service condition.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
smart-context.js:155

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a fixed pattern used to recognize summary titles. It checks text supplied to the extension and does not itself access accounts, send data, or execute commands.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression is a bounded, anchored title-prefix matcher with a character-class exclusion that terminates at a closing bracket. The supplied evidence shows no attacker-controlled construction, repeated nested quantifiers, external side effect, or execution path; the operation is consistent with identifying summary entries in the extension's lorebook workflow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
tree-store.js:785

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This test verifies that an endpoint is rejected when it is missing. It is validation logic, not a suspicious link or an attempt to contact an outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate occurs in a test asserting false configuration status when the endpoint field is absent. The available evidence shows no network request, destination use, secret handling, or malicious execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/llm-sidecar.test.js:77

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The flagged pattern removes an optional summary label from text before building a prompt. This is ordinary formatting for the extension’s scene-summary feature and does not show data theft or harmful execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The supplied context shows a fixed, anchored, case-insensitive regular expression applied to the comment field of lorebook entries. It strips an optional bracketed scene-summary prefix and then concatenates the result with entry content for an intended analytical language-model request. The expression is short, anchored, and structurally bounded, providing no demonstrated catastrophic backtracking, attacker-controlled execution, external transmission beyond the stated LLM workflow, or persistence behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
summary-hierarchy.js:131

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a simple case-insensitive pattern used by a test mock to recognize titles beginning with optional scene, act, or story labels followed by “summary.” It does not process attacker-controlled input in a dangerous operation or perform external actions.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression is a bounded, anchored recognizer with a small optional alternation and no nested unbounded quantifiers or overlapping repetition. It is used inside a mocked helper in a test file and only returns a boolean based on a supplied title. The evidence shows no catastrophic-backtracking path or security-sensitive sink.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
test
Source
tests/tree-builder.test.js:117

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The supplied evidence only reports a possible obfuscation pattern. The visible portion is ordinary, readable extension code and describes a user-interface feature for collapsing summarized chat messages; it does not show hidden execution, secret handling, or data transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The scanner candidate is a low-confidence static obfuscation signal at the file start, while the supplied source excerpt contains descriptive comments, named constants, and standard SillyTavern imports. No obfuscated payload, dynamic evaluation, credential access, persistence, or external destination is shown. The evidence is limited to the supplied excerpt, so this assessment does not characterize omitted code beyond that evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
summary-collapse.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The flagged pattern is in a test file and is used to recognize summary titles. The supplied evidence does not show any user-controlled input, expensive repeated matching, or runtime security-sensitive behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The candidate identifies a regular expression in mocked test code. It is anchored at the beginning, uses a bounded optional alternation, and has no evident nested quantifiers or unbounded repetition. The file is a test fixture rather than shipped runtime logic, and the supplied context shows no attacker-controlled input or security-sensitive data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
test
Source
tests/summary-hierarchy.test.js:38

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The scanner flagged possible obfuscation, but the supplied excerpt is readable, documented module code and does not show hidden behavior or concealed data handling.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate contains only a low-confidence static obfuscation signal. The supplied source is ordinary, commented ES module code with named imports and a stated summarization purpose. No obfuscated payload, external destination, credential access, persistence, or concealed execution is evidenced. The excerpt does not provide enough implementation detail to independently validate every runtime operation, but it does not substantiate malicious behavior or a security weakness.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
summary-runner.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is another test value for a local embedding service address. It is used to verify default settings, not to send information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate occurs in a unit-test fixture containing a localhost embedding endpoint. The supplied context shows only configuration and assertion logic, with no network execution or sensitive-data flow; local embedding support is consistent with the stated project purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/llm-sidecar.test.js:482

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity