TavernKeeper Scan Report

MultihogAurelius/SillyTavern-MultihogDnDFramework

Commit b978f81 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 60 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
adventure-companion.js:1126

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/state/router-utils.js:411

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
llm-client.js:367

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/state/combat-persistence.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
theme-manager.js:347

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
renderer.js:540

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
memo-processor.js:155

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
game-systems.js:531

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/state/dice-compare.js:14

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
portraits.js:214

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
narrative-hooks.js:253
Deterministic technical evidence (5)
  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:c301f7c72c558e741e2a83a0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:19e09cf566459df2b32f4e11 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:11

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:8-18

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:12

Contextual expected matches (39)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

The security scanner thought this file might contain hidden code, but looking at the actual code, it's all readable and straightforward. There's nothing suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner flagged this file for obfuscation, but the provided source shows standard, readable JavaScript with clear imports and well-documented functions. No obfuscation, encoded strings, or concealed execution paths are present. The signal is a false positive likely due to the static analysis heuristic.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
immersion.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This test file includes a fake image data URI to test how the extension handles images. It doesn't connect to any outside server. The scanner warning is a false positive.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Scanner flagged shady-link at line 39, but the value is a data URI 'data:image/png;base64,abc' used as a test fixture for multimodal content. No network access occurs; it is an inline image placeholder.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/cyoa-prompt-history.test.js:39

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner noted a regex that could be unsafe if used on untrusted input, but here it's only used in a test to check the settings page HTML structure.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
test
Source
tests/settings-drawers.test.js:8

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner flagged some text in a test file that looks unusual, but it's just harmless placeholder markers used for testing a party-tracking feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner detected an 'obfuscated-code' signal on a test file containing inline rendering markers like ((BAR)). These markers are part of the D&D framework's UI rendering system and are used in test data to simulate party member headers. No actual obfuscation, concealed execution, or harmful behavior is present. The test file has no runtime impact on shipped extension behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
test
Source
tests/memo-processor-party-markers.test.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found something that might look suspicious, but the actual flagged text wasn't provided. The code around it just stores settings for AI services like Ollama and OpenAI, which is normal for this type of RPG tool. There's no evidence of harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: A static analysis scanner flagged a candidate as potentially containing a shady link, but the actual flagged literal was not retained in the evidence. The surrounding source code shows normal configuration fields for AI service endpoints such as Ollama and OpenAI URLs. These are expected for an extension that connects to external AI models for RPG features. Without the actual flagged value, there is no demonstrated security concern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:2595

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The code is clean and readable — no hidden tricks or secret behavior. A security tool flagged it incorrectly because it was too cautious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
game-cartridges.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

A security scanner thought this file might have hidden code, but looking at the actual code shows it is normal, readable JavaScript for a game extension. No hidden or dangerous behavior is present.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The signal is a false positive, likely triggered by the presence of emoji characters and long template literals used for RPG game logic — common patterns in this SillyTavern D&D framework extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
character-creator.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file helps developers debug the scheduler. It's written in clear, readable JavaScript and does not hide anything. The security scanner's warning is incorrect.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: JS-X-Ray flagged obfuscated-code on line 1, but the actual source is a well-documented debug instrumentation module with clear header comments, imports, and functions. There is no obfuscation, minification, or concealed logic. The scanner signal appears to be a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
swipe-scheduler-debug.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

A security scanner thought this file might have hidden code, but the actual code is just normal game constants and prompts. Nothing to worry about.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The file file consists entirely of exported constant definitions, template strings with emoji and game mechanics text, and a small function. The signal is a false positive — no obfuscation or harmful behavior exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
constants.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This code checks whether a portrait image is embedded as a data URL so it can be saved properly. It only talks to the SillyTavern server you are running, not to any outside site.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line (59) is a simple type check and string prefix test ('data:image/') to identify embedded base64 portrait data URLs. This is used to decide whether to upload the image to SillyTavern's own image storage API. No external network destinations beyond the local ST server are involved. This is legitimate portrait management behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
portrait-storage.js:59

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

A scanner flagged a regular expression used in a test to check that damage dice descriptions are spelled out fully (not abbreviated) in the game's system prompts. The regex only runs on the project's own files, so there's no way for an attacker to exploit it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The scanner flagged an 'unsafe-regex' signal at line 56 in this test file. The regex is `/\b\d+d\d+(?:[+-]\d+)?\s*[BPS]\b/i` used to detect abbreviated damage expressions like '3d8 B' in shipped system prompt files. The regex is applied only to static, project-owned text files read from disk. There is no user-controllable input or network data involved, and the regex is used solely for a test assertion. The signal is a false positive; no security concern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
test
Source
tests/sysprompt-content.test.js:56

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file was flagged as possibly obfuscated, but the actual code is clear and readable JavaScript that runs the game system wizard and settings panel. It's just normal code for the RPG framework, nothing hidden or suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner signal 'obfuscated-code' is a false positive. The file file contains extensive, well-commented JavaScript implementing a Game System Wizard, section management, and narrator configuration. All code is readable, purpose-driven, and proportional to the RPG framework's functionality. No obfuscation, concealed logic, or malicious behavior is observed in the supplied source.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
game-systems.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A security scanner thought this file might contain hidden code, but looking at the actual code shows it is normal, readable JavaScript. It just builds HTML and handles game data, nothing suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The static scanner signal flagged the file as containing obfuscated JavaScript, but the supplied source text is entirely plain, readable JavaScript with standard imports, string manipulation, and HTML template generation. No encoded strings, dynamic code construction, or concealment techniques are present. The file's purpose—generating HTML strings and managing localStorage—matches the visible code. The scanner result is a false positive; no obfuscation is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
renderer.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is just a default address for a local AI program used to create character portraits. Nothing is being stolen or sent to an unexpected place.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged signal is a URL literal on line 385: the default local Ollama endpoint in getPortraitConnectionSettings. This function assembles connection settings for portrait-prompt LLM calls, which matches the project's stated AI Portrait Generation feature. The surrounding code passes user-configured provider settings, including an API key, to the project's own LLM client for generation requests; there is no evidence of exfiltration, unexpected destinations, or concealed behavior. The scanner labeled this 'shady-link' without retaining matched literals, and the visible code shows only a localhost default consistent with the extension's purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
portraits.js:385

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file was flagged by an automated scanner as possibly containing obfuscated code, but looking at the actual code shows it's just normal, readable JavaScript that handles a settings popup for grouping modules. There's nothing hidden or suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner signal 'obfuscated-code' is a false positive. The file file contains clear, readable, well-commented JavaScript code that implements a UI manager for grouping tracker modules. All imports, functions, and DOM manipulations are proportionate to the stated project purpose of a modular RPG framework. No obfuscation, concealed execution, or malicious data flow is present in the supplied source.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
display-groups.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The code sets a starting web address for an AI model service, defaulting to one on your own computer. That's expected for programs that connect to local AI tools.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line is a default value assignment for an Ollama URL in the extension's configuration defaults object, set to localhost:11434. Multiple similar defaults for local AI API endpoints appear throughout the file. These are standard defaults that users can override. No evidence of malicious external network targets or data exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/state/defaults.js:134

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged code uses a pre-filled local address for the Ollama AI service, which is typical for programs that run on your own computer. No hidden or dangerous behavior was found.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged a line containing a default localhost URL used as the default Ollama endpoint. This is standard configuration for local LLM backends and is not indicative of malicious or concealed behavior. The extension transparently uses user-provided API endpoints and keys to fetch model lists, which is expected functionality for an RPG framework that supports multiple AI providers.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
character-creation-connection.js:15

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This test file checks display group features. It is written in plain, readable JavaScript and contains no hidden code. The security scanner's warning is incorrect.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: Scanner flagged obfuscated-code on line 1, but the test file is a well-structured unit test with clear imports, functions, and test cases. There is no obfuscation, minification, or hidden logic. The scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
test
Source
tests/display-groups.test.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The security scanner noticed some web addresses (URLs) in this file, but they are just settings for which AI service to use (like Ollama or OpenAI). The extension needs these to talk to AI models, and they are saved locally on your device. No data is being sent anywhere secretly.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The JS-X-Ray 'shady-link' signal flagged URL strings within the profile save function, but these are configuration values for connecting to AI model providers (Ollama, OpenAI) deliberately exposed in the extension's settings. The file only persists settings to local storage via saveSettings; no network requests are made from this module. The flagged URLs are user-configured endpoints (defaults include localhost) necessary for the project's stated purpose of integrating external AI services.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/state/profiles.js:218

JavaScript analysis reported javascript.download-to-execution

Expected behavior · medium confidence

The extension connects to AI models over the internet, which is expected for this kind of RPG tool. There is no sign that it secretly runs downloaded code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner flagged a correlation between network retrieval and a code-execution sink, but the provided code shows only standard API calls via fetch (e.g., fetchOllamaModels) with JSON responses, no eval, Function, or dynamic code execution from network data. The extension communicates with LLM APIs as part of its stated RPG simulation purpose, and no dangerous data flow is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:59-241

zizmor reported artipacked

Expected behavior · high confidence

This test workflow only runs the project's unit tests. It does not save any files or handle passwords, so there is no risk of credential leaks from this file.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The GitHub Actions workflow at file performs only checkout, setup-node, npm ci, and npm test. No artifacts step is defined, no secrets are referenced, and no credentials are persisted. The 'artipacked' signal from zizmor is a false positive because there is no artifact upload that could leak credentials.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
test
Source
.github/workflows/test.yml:11

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension sets up a default connection to a local AI model server on your own machine, which is expected for this type of tool. It doesn't send data to unknown external servers.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line defines a default Ollama API endpoint for the project's AI wizard feature, defaulting to localhost:11434. This is a standard configuration for local model serving and is user-configurable. The code is transparent and serves the project's stated purpose of AI-assisted RPG system generation. No evidence of external exfiltration or malicious intent is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
game-systems.js:178

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

A security scanner flagged a web address in a test file. The address is just a placeholder used in a test to check that the settings function works correctly. No actual connection is made.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The static signal matches a literal URL string in a test file at line 53. The code is a unit-test call that passes an object with an ollamaUrl set to a test-only local address to a settings-mapping function. This test validates the shape of the output; it does not perform any network request. The URL is hardcoded test data with no runtime reachability beyond the test suite. No attacker-controlled input or data flow to an external destination is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/character-creation-connection.test.js:53

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

A security scanner thought this file might contain hidden code, but it is actually just the game extension's editor interface. It uses normal JavaScript to create popups and settings panels. No harmful code was found.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The obfuscated-code signal was raised on file, a production file. The evidence shows standard JavaScript with ES modules, template literals, DOM manipulation, and normal function definitions. There is no minification, encoded strings, or concealed execution. The scanner likely flagged the large inline HTML strings inside template literals as potential obfuscation due to high density of special characters, but the code is purpose-built for UI generation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
ui-editors.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file handles button clicks and user interface interactions for the RPG panel. The code is written in a normal, understandable way.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file is a standard SillyTavern extension UI module. It contains readable JavaScript with imports, event listeners, and DOM manipulation. No obfuscation patterns (encoded strings, minified variables, eval, or dynamic code generation) are present. The scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/ui/panel/card-events.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The security scanner thought the code might be hidden or scrambled, but when we look at the actual file it is normal, easy-to-read code. There is no hidden or dangerous behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The static analysis scanner flagged this JavaScript file for possible obfuscation with low confidence. However, the complete source code provided in evidence shows clean, well-structured, and readable JavaScript with normal imports, exports, and function definitions. No obfuscated strings, encoded payloads, or concealed execution paths are present. The scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
portraits.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension uses a default address for a local AI service. This is normal and not a security risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged a literal string at line 505 as a shady link, but the only visible literal in that vicinity is the localhost default URL. This is a standard configuration value for connecting to a local Ollama instance, which is expected behavior for a SillyTavern extension that supports local LLM inference. No external or suspicious destination is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
adventure-companion.js:505

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The code is written plainly and is easy to read. The alert about obfuscated code appears to be a mistake.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The obfuscated-code signal was raised with low confidence and the examined source code is clear, readable, and not obfuscated. No encoded strings, packed scripts, or concealment techniques were found. This is a false positive from the static analysis tool.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
index.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

A security scanner flagged a web address in a test file because it looks like a link. But the address is just an example used in a test to make sure the extension's settings work correctly. No real network call is involved.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The static signal fires on a literal URL string appearing in a test file at line 132. The code is a unit-test assertion that passes a plain object with an ollamaUrl property set to a hardcoded test value to a settings-mapping function. This test simulates how the extension would combine connection settings; it does not initiate any network request. No data flow to an external destination exists from this line. The scanner rule flags any URL as potentially shady, but the context confirms it is a benign test fixture.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/adventure-companion.test.js:132

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file just stores lists of character sections (like 'Species', 'Body') in a clear, readable format. There is no hidden or scrambled code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file exports plain data arrays and a module name constant. The source is entirely human-readable JavaScript with JSDoc comments, no encoding, minification, string obfuscation, or suspicious transformations. The 'obfuscated-code' signal is a false positive; no actual obfuscation exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/state/schema-sections.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · medium confidence

The extension connects to AI services and responds to tool commands, but it does not run any risky code. The scanner warning is not a real concern.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner detected both network retrieval and a code execution sink in the same file, but the file does not contain any eval, Function constructor, or similar dynamic execution. The tool call handling uses structured function definitions for LLM tool calling, which is a standard pattern in SillyTavern extensions. Network requests are made to LLM APIs as expected. No actual code execution from untrusted input exists, so the correlation is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
adventure-companion.js:14-700

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A scanner thought this file might be hiding its code, but when you look at it, it's just normal code that creates the panel's user interface. Nothing is hidden or tricky.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner rule 'javascript.xray.obfuscated-code' flagged panel-markup.js at line 1 with high severity but low confidence. The actual file content is a well-documented JavaScript module exporting a buildPanelMarkup function that returns a template literal containing HTML markup. The code is not obfuscated; it is clean, readable, and follows standard patterns for generating UI strings. The scanner likely reacted to template literal complexity or string escaping, not actual obfuscation. No encrypted, minified, or concealed code is present. This is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/ui/panel/panel-markup.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This extension talks to AI models you configure (like Ollama or OpenAI) to track your game state. The flagged line is just a normal part of reading the AI's response. No suspicious behavior was found.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line (422) is part of a standard SSE streaming response parser that checks whether a line starts with 'data:'. The extension makes network requests to user-configured LLM endpoints (Ollama, OpenAI-compatible) as part of its core RPG state tracking and generation purpose. No evidence of unexpected or unauthorized network destinations was found.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
llm-client.js:422

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

A scanner thought a line of test code might contain encoded or hidden text, but it's just a simple test that checks if a function correctly handles a normal string like 'abc123'. There's nothing secret or dangerous.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.

Contextual assessment: The scanner flagged an 'encoded-literal' signal at line 21 in this test file. The literal at that line is the string `'abc123'` used in an assertion: `expect(sanitizeCampaignPrefixString('abc123')).toBe('abc123');`. This is a plain alphanumeric test string, not encoded or obfuscated. The signal is a false positive; no security concern exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.encoded-literal
File role
test
Source
tests/schema-helpers.test.js:21

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file is written in plain, easy-to-read JavaScript with helpful comments. It just organizes how certain items are shown on screen. The 'obfuscated' warning is a mistake.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file `file` is a clear, well-commented module that exports functions for normalizing and organizing display groups. The code contains no string literals suggestive of obfuscation; all variable names, comments, and logic are human-readable. The 'obfuscated-code' signal appears to be a false positive from the static analysis tool, with low confidence noted. No actual obfuscation, encoding, or concealment exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/features/display-groups.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner found something that looks like a suspicious link or address, but the actual code shows this extension is supposed to connect to AI services as part of its roleplaying-game functions. There is no evidence it sends data anywhere bad.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner signal 'shady-link' was triggered on line 1204 of panel-builder.js, but the matched literal values were not retained in the evidence. The surrounding code constructs aiSettings objects containing user-configured API keys and endpoints (openaiKey, ollamaUrl, openaiUrl) and passes them to a sendStateRequest function. This is expected functionality for an extension that makes AI requests; the extension's purpose includes AI-powered editing and NPC generation. No actual data exfiltration, concealed network access, or malicious destination is demonstrated by the provided code. The scanner_severity is low, consistent with a static pattern match rather than evidence of harmful behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/ui/panel/panel-builder.js:1204

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The code just sets a text field to a default web address that points to your own computer. That's normal for tools that let you run AI models locally.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line sets a default value for an Ollama API URL to localhost:11434 within a UI settings sync function. This is standard configuration for local model services used by the extension. No external network destination or exfiltration is involved; the value is user-configurable. The JS-X-Ray signal is a false positive for a hardcoded localhost URL.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/features/chat/chat-state-loader.js:167

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file builds the visual panel for the RPG tracker. The code is clear and easy to read, not hidden or scrambled.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The file file is a large but well-structured JavaScript module that builds the RPG tracker panel UI. It uses standard imports, DOM APIs, and event wiring. The code is fully readable with comments and no obfuscation techniques. The 'obfuscated-code' scanner signal is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/ui/panel/panel-builder.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

A security scanner thought this file might have hidden code, but the actual code is a straightforward debug viewer for game messages. Nothing to worry about.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The JS-X-Ray static analyzer flagged this file as potentially containing obfuscated code, but examination of the actual source reveals standard, readable JavaScript with no encoding, string concealment, or malicious patterns. The file file implements a debug panel UI with local storage persistence and drag/resize interactions — all normal DOM manipulation. The signal is a false positive; no obfuscation exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
debug-viewer.js:1

Related contextual observations

False positive obfuscation signal in file

low risk · medium confidence

The scanner suspected hidden code, but the file is actually plain, readable JavaScript. No issue.

Technical assessment

The static analysis rule 'javascript.xray.obfuscated-code' fired on line 1 of file, but the supplied source shows no obfuscation. This is a false positive; the file contains standard ES module imports, template strings with emoji, and game logic functions — no concealed execution or data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

False positive obfuscation signal in file

low risk · medium confidence

The scanner suspected hidden code, but the file is just plain game data. No issue.

Technical assessment

The static analysis rule 'javascript.xray.obfuscated-code' fired on line 1 of file, but the supplied source shows only static data strings, emoji, and exported constants. No obfuscation is present; the alert is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

False positive obfuscation signal in file

low risk · medium confidence

The scanner suspected hidden code, but the file is a normal UI debug panel. No issue.

Technical assessment

The static analysis rule 'javascript.xray.obfuscated-code' fired on line 1 of file, but the supplied source shows standard JavaScript with DOM operations, event handlers, and template literals. No obfuscation is present; the alert is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Network access is expected for LLM calls

low risk · medium confidence

This extension talks to AI models to run the game, which is normal and expected.

Technical assessment

The extension imports functions like sendStateRequest, fetchOllamaModels, fetchOpenAIModels, and testOpenAIConnection from './llm-client.js', which are used to communicate with language model APIs. This is consistent with the project's stated purpose of AI-powered RPG simulation and does not constitute a security threat.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Inline HTML strings triggered false obfuscation detection

low risk · low confidence

The extension's code builds user interface elements by embedding HTML inside JavaScript strings. This made the scanner think it might be obfuscated, but it's just how the code creates menus and settings. It is normal for this type of extension.

Technical assessment

The file contains extensive template literals that build HTML with many embedded expressions, symbols, and CSS. JS-X-Ray's obfuscation heuristics may flag high entropy or unusual character density, but the content is author-written UI markup. No obfuscation tools or techniques are used.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity