TavernKeeper Scan Report

prolix-oc/Lumiverse-SimTracker

Commit 59ed11a Reviewed Aug 24, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 19 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Document that imported presets can contain executable template logic and warn users against importing presets from untrusted sources. Consider sandboxing or restricting available APIs within the executed logic if feasible.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: production
Source: src/frontend.ts:1078

Deterministic technical evidence (9)

Dependency advisory GHSA-xhpv-hc6g-r9c6:pkg:4114756074b3c1883ca427a6 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-xjpj-3mr7-gcpf:pkg:2c93c7ce30edf86304d17bbe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-3mfm-83xf-c92r:pkg:146840b9eb3231ae1d463c20 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2qvq-rjwj-gvw9:pkg:bde04755dd174b8acbe6de92 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-442j-39wm-28r2:pkg:c54738cea96a333e19b8bd79 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-7rx3-28cr-v5wh:pkg:2d05cf734c06fd6d1e77b848 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-9cx6-37pm-9jff:pkg:ca52f57e7f6518348696e910 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-48c2-rrv3-qjmp:pkg:15fc6ff22ccf7f2f103da797 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-2w6w-674q-4c4q:pkg:d25708df68737694eb8e6977 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock

Contextual expected matches (8)

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The code flagged here is part of a template library's built-in security measures that deliberately block dangerous property access, not a vulnerability.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The flagged code at line 567 sets defaultPropertyWhiteList[#__proto__#] = false, which is part of Handlebars' createNewLookupObject security utility that explicitly blocks prototype property access. Similarly, line 3004 shows an isProtoString guard used by source-map utilities to prefix prototype-string keys. These are defensive whitelisting patterns, not prototype pollution sinks. No untrusted input is merged into object prototypes.

Impact: none · Exploitability: unlikely

Developer action: No change warranted; this is defensive code in a bundled dependency.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: dist/frontend.js:567

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner noticed both network and code-execution features somewhere in a large bundled file, but this is just normal library code bundled together, not evidence of downloading and running remote code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The candidate spans lines 36-18578, essentially the entire bundled file. The file is a single esbuild bundle containing Handlebars (template compiler with new Function), a YAML parser, source-map utilities, and the extension's own trackerData module. The correlation between network retrieval and execution sinks reflects the co-presence of standard library features in a large bundle, not a data flow from a fetched remote resource into an execution sink. No evidence shows downloaded content being passed to eval, new Function, or similar sinks.

Impact: none · Exploitability: unlikely

Developer action: No change warranted; the correlation spans the entire bundle and reflects normal library composition.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: generated
Source: dist/frontend.js:36-18578

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged some regular expressions as potentially unsafe, but these are standard patterns used by the bundled YAML parser to identify data types like numbers, booleans, and dates. They are simple, well-formed patterns that do not pose a denial-of-service risk in practice.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The scanner flagged 9 'unsafe-regex' occurrences, but the source context shows these are anchored, linear regex patterns from the bundled 'yaml' npm package used for scalar type detection (e.g., /^(?:[-+]?0b[0-1_]+)$/ for binary ints, /^true$|^false$/ for booleans, /^-?(?:0|[1-9][0-9]*)(?:.[0-9]*)?(?:[eE][-+]?[0-9]+)?$/ for floats). These patterns are simple alternations and character classes without nested quantifiers or catastrophic backtracking potential. The input source is tracker payload data embedded in LLM-generated messages, parsed via JSON.parse or the YAML parser. No demonstrated ReDoS exposure exists, and even a worst-case slowdown would be a local reliability issue only.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/backend.js:7874

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The flagged code is just the standard preamble that a JavaScript bundler adds when combining files, not deliberate obfuscation.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: No change warranted; bundler preambles are standard and expected.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: generated
Source: dist/frontend.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension makes a local network call to check the host software version and separately uses a template engine to render visual tracker cards. The scanner flagged these two features appearing together, but the version-check result is never fed into the template engine. This is normal, expected behavior for a card-rendering extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlates a network retrieval primitive with a dynamic code execution sink in the same file. The network primitive is fetch('/api/v1/system/info') with same-origin credentials, used solely in shouldBroadcastReadyForHost() to compare the host backend version against a minimum (1.0.6). The response payload (a version string) is consumed only by isVersionAtLeast() and never reaches any execution sink. The code execution sink is Handlebars template compilation (TEMPLATE_CACHE, CompiledTemplateCacheEntry), which compiles template strings from user-selected presets (built-in or user-imported). There is no data flow from the fetch response into Handlebars.compile or any eval/Function constructor. The two capabilities are co-located in the same module but serve independent purposes: version gating and template rendering. No download-to-execution pattern is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: production
Source: src/frontend.ts:107-1078

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The regular expressions flagged here are standard pattern-matching rules used by template and YAML parsing libraries, not dangerous patterns.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The 13 flagged occurrences are regexes in the Handlebars lexer (line 1848) and YAML schema tag test patterns (e.g., /^-+?[0-9]+$/, /^0x[0-9a-fA-F]+$/). These are simple anchored patterns used for tokenizing templates and validating scalar types. They operate on short input strings and do not exhibit catastrophic backtracking on attacker-controlled input. The YAML tag regexes are applied to individual scalar values during parsing, which is expected behavior for a YAML library.

Impact: none · Exploitability: unlikely

Developer action: No change warranted; these are standard parser regexes in bundled dependencies.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/frontend.js:1848

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged links are actually standard YAML tag identifiers used internally by the YAML parser, not connections to external websites.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The 51 occurrences are all instances of the string tag:yaml.org,2002: (and its variants like tag:yaml.org,2002:map, tag:yaml.org,2002:int, etc.). These are standard YAML tag URIs defined by the YAML specification and used by the yaml browser library for schema tag identification. The scanner matched these because they contain a colon-slash-slash sequence resembling a URL, but they are not HTTP endpoints and are never used for network retrieval.

Impact: none · Exploitability: unlikely

Developer action: No change warranted; these are YAML standard tag URIs, not external network links.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/frontend.js:12449

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged what looks like links, but these are standard YAML specification tag identifiers used internally by the bundled YAML parser library. They are not network addresses and do not cause any data to be sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged 51 occurrences of a 'shady-link' signal, but the source context shows these are all instances of the literal string 'tag:yaml.org,2002:' from the bundled 'yaml' npm package's browser distribution. This is the standard YAML 1.2 tag URI prefix defined by the YAML specification and used as a namespace identifier for built-in YAML types (str, int, float, map, seq, etc.). It is not a network URL, does not initiate any network request, and is purely a string constant used for schema tag matching within the parser. The project's stated purpose explicitly accepts YAML data inside tracker tags, so bundling a YAML parser is expected behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: generated
Source: dist/backend.js:7066

Related contextual observations

Same-origin version check fetch is independent of template execution

low risk · high confidence

The extension checks the host version via a local API call to decide whether to signal readiness. This is a standard, safe pattern for Lumiverse or SillyTavern extensions.

Technical assessment

The shouldBroadcastReadyForHost function fetches /api/v1/system/info with same-origin credentials, parses only a backend.version string, and returns a boolean from isVersionAtLeast. The fetched data is confined to version comparison logic and does not flow into template compilation, DOM insertion, or any eval-equivalent sink. This is a benign capability-detection pattern consistent with the extension's stated purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

src/frontend.ts:1

Coverage and limitations

Inventory: 59 files · 4529517 bytes
Contextual coverage: 18 of 18 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 9 files · 1594693 bytes
X-Ray review families: 127 warning occurrences compacted to 6 evidence-preserving review families
Representations: 9 raw · 39 decoded · 0 normalized · 0 bundle modules
Stage scans: 9 raw signatures · 4 raw AST · 6 raw OpenGrep · 39 derived signatures · 0 derived AST · 39 derived OpenGrep

Unresolved JavaScript stages

dist/backend.js — derived-ast / parse
dist/backend.js — normalize / parse
dist/frontend.js — derived-ast / parse
dist/frontend.js — normalize / parse
dist/frontend.js — raw-opengrep / parse
src/backend.ts — raw-ast / parse
src/backend.ts — raw-opengrep / parse
src/frontend.ts — raw-ast / parse
src/frontend.ts — raw-opengrep / parse
src/inlineTemplates.ts — raw-ast / parse
src/templatePresets.ts — raw-ast / parse
src/trackerData.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
OpenGrep could not parse some source files; findings from successfully analyzed files are included.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 59ed11a2fca0084ee08cade5e9ff771af6a824fb
Completed: Aug 24, 2026
History depth: 3 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 5 fresh / 0 reused groups · 9 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 9 deterministic / 9 contextual candidates · 5 contextual / 7 total behavior cases
Model budget: 4 model calls · 5 / 12 fresh cases · 150852 / 200000 estimated input · 141696 / 250000 actual input · 6447 / 40000 output tokens
Review batching: 4 model calls · up to 2 groups and 5 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 141696 input · 6447 output · 5760 cache read · 600 reasoning tokens
Report: 20a8b2fcc2f6b25e213b509853812fe46864b92cadca4701be9f8677a630a526