TavernKeeper Scan Report

IkarusV/IkarusAutoImage

Commit 8df1549 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner flagged this file as potentially obfuscated, but the actual code is plainly written and easy to read. It is a normal SillyTavern extension that manages image generation prompts and settings. There is no hidden or deceptive code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged an obfuscated-code signal on line 1 with low scanner confidence. The supplied source context shows a well-structured, clearly commented SillyTavern extension with readable variable names, standard ES module imports, and no minification, encoding, eval, or string-concealment techniques. The regex literals and template strings in constants are normal for this type of prompt-processing extension. No obfuscation or suspicious execution patterns are present in the reviewed code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
index.js:1

Related contextual observations

Standard SillyTavern extension API usage

low risk · high confidence

The extension imports and uses standard SillyTavern APIs for managing settings and responding to chat events, which is expected for its stated purpose.

Technical assessment

Imports from SillyTavern core modules (extensions.js, script.js, utils.js, SlashCommandParser.js) are standard extension APIs. Usage of extension_settings, getContext, eventSource, saveSettingsDebounced, and generateRaw matches the stated project purpose of auto-image generation and prompt management. No external network calls or credential access beyond these expected APIs are visible in the reviewed code.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity