TavernKeeper Scan Report

SkyJinXX/SillyTavern-FinalPromptViewer

Commit b750812 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The flagged code simply wraps the standard browser fetch function for use by a token-counting utility and loads the extension's own bundled settings UI file. There is no download-and-execute pattern or remote code execution risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:22-36

Related contextual observations

postMessage listener accepts messages from any origin

low risk · medium confidence

The extension listens for messages from any source without checking who sent them, which is a minor best-practice gap but unlikely to cause real harm in a local browser context.

Technical assessment

The window message listener at line 161 accepts messages with e.data._fpv from any origin without validating e.source or e.origin. A malicious page or script in another iframe could post a crafted message with _fpv=true and a messages array, which would be added to captureHistory. The impact is limited to injecting spurious entries into the local prompt viewer panel with no exfiltration, persistence, or code execution.

Impact: low · Exploitability: unlikely

Developer action: Consider adding origin validation to the message event listener to only accept messages from expected iframe sources, though the practical risk in a local SillyTavern context is low.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity