TavernKeeper Scan Report

virtaava/sillytavern-woven-imprint

Commit 2356815 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 4 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (4)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension talks to a local memory service running on your own computer, using a standard address that is normal for this kind of tool.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The extension stores a default sidecar URL pointing to localhost port 8765, which is used to communicate with a local woven-imprint sidecar process. This URL is hardcoded but is the intended and documented address for the sidecar, and users can change it via settings.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:13

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The plugin reads a setting from your computer's environment to know where the memory service is running, which is a normal way to configure server tools.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The server plugin reads the WOVEN_IMPRINT_URL environment variable to locate the sidecar, falling back to localhost. Reading an environment variable is standard configuration practice and is not credential theft; the value is used solely for proxying requests.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.serialize-environment
File role
production
Source
plugin/index.js:15

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The plugin has a standard local address for the memory service, which is expected and safe because it only connects to your own computer.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The server plugin defines a default sidecar URL pointing to localhost port 8765. This URL matches the documented sidecar address and is used to forward requests from the UI extension to the memory service. It is not a suspicious external link.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
plugin/index.js:15

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches memories from your local memory service and adds them to the chat prompt as plain text, just like other memory tools do.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The extension uses fetch to retrieve memory context from the sidecar and passes the returned text into the SillyTavern extension prompt API. There is no eval, dynamic require, or command execution; the data is used only as prompt text.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:37-178

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity