TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

mekineer-com/OpenAlma

Commit 54effca Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 27 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (26)

  • Dependency advisory PYSEC-2026-1473:pkg:7aa5d849032f813d4e5396e6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-v9pg-7xvm-68hf:pkg:f9806f0dcc79a81601eccc23 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-q2x7-8rv6-6q7h:pkg:6b54606ec8875ea97d5b7191 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-6jv3-5f52-599m:pkg:f080cc8c69401251820e2e10 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1472:pkg:42301ab3fa058c530430ad86 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-h75v-3vvj-5mfj:pkg:0a5bf2ae4c836ff28bcfc665 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1475:pkg:93ea0bc6e50686a975bb661f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-h5c8-rqwp-cp95:pkg:9afe0ac551636b9c255ad355 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1852:pkg:905f8066fdcb4968742470d2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-gmj6-6f8f-6699:pkg:00b51d642d77794a04ec3bd7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-mj87-hwqh-73pj:pkg:e43e776a0e95c997a8b56058 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1474:pkg:915ea6350131371689b73dfa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-5rvq-cxj2-64vf:pkg:86773285863dfc77c95412e5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-cpwx-vrp4-4pq7:pkg:91202ebb37aed05e7cf322d0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-vffw-93wf-4j4q:pkg:1050d3c9d827ed865326ac0d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1471:pkg:dc6caa1f386a8cb98930da9a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-pp6c-gr5w-3c5g:pkg:a5b9ad4a61e6d59c054ec7b5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-wp53-j4wj-2cfg:pkg:2186f7443db0c80e8275be19 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3037:pkg:74b9228c64f62bb86c4528ab applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3036:pkg:a49d089bcf8003a0ddf40bb9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1851:pkg:4931fe8c489a671e86516895 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3039:pkg:14680a7b42525bf94071e12c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3038:pkg:8c302df415f37b7a8bdce01b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3040:pkg:02e6df712480e1ce9652cf54 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-59g5-xgcq-4qw3:pkg:a1ec7327f2d984608322efc5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3041:pkg:80a9df5873ad78c9f17f9a5b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This small helper script handles a dropdown-and-text-box picker for choosing or naming a memory profile, and submits that form to the project's own launcher page running on your machine. After the local page answers, the browser simply goes to the page the launcher returned, and any failure message is shown as a plain text popup. The scanner flagged it because a network request and a page-navigation statement appear in the same file, but nothing downloaded is ever run as code, so the warning does not hold up here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The flagged correlation pairs a fetch POST of a FormData body to the enclosing form's action URL with a success-path navigation that assigns the response's final URL to location.href. Neither primitive is a code execution sink: there is no eval, dynamic Function construction, script or HTML injection, or command execution anywhere in the file, and no fetched bytes are interpreted as code. The request targets the project's own locally served launcher endpoint, and the navigation destination is that same-origin response URL. Server-supplied error text is rendered only through text-only dialogs (confirm and alert), which do not interpret markup or script. The single retry on a 409 status is gated behind explicit user confirmation and cannot loop unbounded. This is ordinary same-origin form submission behavior for a launcher UI, matching the project's stated purpose of soul selection and creation in the local stack.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
launcher/static/soul-selector.js:4-37

Coverage and limitations

Inventory
56 files · 1598925 bytes
Contextual coverage
27 of 27 candidates assessed

JavaScript coverage

Status
Complete
Candidates
3 files · 28237 bytes
X-Ray review families
0 warning occurrences compacted to 0 evidence-preserving review families
Representations
3 raw · 1 decoded · 1 normalized · 0 bundle modules
Stage scans
3 raw signatures · 3 raw AST · 3 raw OpenGrep · 2 derived signatures · 1 derived AST · 2 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
54effca5f330a11cf1940cab23edacf1b5846529
Completed
History depth
17 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports
none
Evidence triage
26 deterministic / 1 contextual candidates · 1 contextual / 5 total behavior cases
Model budget
1 model call · 1 / 12 fresh cases · 9868 / 200000 estimated input · 6204 / 250000 actual input · 1486 / 40000 output tokens
Review batching
1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
6204 input · 1486 output · 0 cache read · 1000 reasoning tokens
Report
2d26668cbb2a6cb524cca9ee4b6e8ee97a203002f2e8549a16e53444dcafa07c