TavernKeeper Scan Report

cgstever/StatefulLore

Commit 715fae8 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Several regular expressions in the prompt-building code could slow down or freeze the browser if fed specially crafted input. The input comes from lore modules the user loaded and from character card text, so exploitation would require a malicious lore module or crafted card content. The worst case is a frozen browser tab, not data loss or theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Consider anchoring regex patterns derived from lore-engine data (pending.cardStripPatterns, pending.stripWords) by escaping user-supplied metacharacters before passing them to new RegExp, and add a length cap or timeout guard on the multi-line block-matching regexes to prevent pathological backtracking on large card content.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
core.js:664
Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This extension is designed to load and run JavaScript lore modules from the internet or from the SillyTavern server. That is its core feature, clearly documented in the README. The code does exactly what it says: fetches a JS file and runs it as a module. There is no hidden execution or credential theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner flags co-located network retrieval (fetch) and dynamic code execution (import()). The extension's stated purpose is a programmable lore engine that loads JS modules implementing processTurn()/handleResponse(). loadLoreFromUrl fetches JS source from a user-provided URL and passes it to loadLoreFromSource, which creates a Blob, generates an object URL, and calls import() to execute it. The fetch('/api/files/upload') calls upload debug sidecar files and lore modules to the local ST server. All network destinations are either the user-provided lore URL (GitHub raw, documented), the local ST server API endpoints, or stored server paths for cross-device sync. No credentials, API keys, or private content are sent to external destinations. The auto-update feature polls a version.json and downloads updated lore modules, which is documented in the README. This data flow is proportional to and directly implements the stated project purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
core.js:83-187

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity