TavernKeeper Scan Report

Supker/ST-Copilot

Commit 1480960 Reviewed

1 material concern identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 1 material 22 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.obfuscated-code

Minor caution · low confidence

The file is a large bundled JavaScript artifact, which makes review difficult. The evidence does not establish that the code is hiding harmful behavior, but clearer build output would improve accountability.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The scanner reported obfuscated code with low confidence, while the supplied representation is a large production bundle containing readable identifiers, prompts, and settings. No specific concealed payload, secret harvesting, or malicious persistence is shown.

Impact: low · Exploitability: unlikely

Developer action: Provide an unminified or source-mapped build, document any generated bundling or transformation, and identify dynamic execution sites for focused review.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
index.js:1

JavaScript analysis reported javascript.download-to-execution

Minor caution · low confidence

The scanner found network access and a possible execution mechanism somewhere in the bundled file, but the supplied excerpt does not show them working together or downloading and running harmful code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The candidate is a correlation signal spanning the bundle, not a demonstrated data flow. The available context shows a frontend extension with configurable model connections and local file reading, but does not identify the retrieval destination, execution sink, trigger timing, input provenance, or payload.

Impact: low · Exploitability: plausible

Developer action: Document and isolate any intentional dynamic execution and network retrieval; otherwise remove unnecessary dynamic execution and add tests or policy controls for downloaded content.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:1-1620
Expected scanner matches (20)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This section identifies text in responses from several normal AI service formats. It does not show a suspicious link or an attempt to contact an undisclosed destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows response-field extraction inside the generation client. It processes provider response structures and returns text or reasoning; no link construction, navigation, or outbound destination is shown at this candidate location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/api.js:479

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

The flagged text is part of ordinary response parsing for AI output. The supplied evidence does not show it creating or following a suspicious link.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate is within the same deep response extraction logic. It selects textual content from structured completion responses and performs no independent network operation or execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/api.js:480

JavaScript analysis reported javascript.download-to-execution

Expected behavior · medium confidence

The network request sends the selected roleplay context to the AI service chosen in settings and reads the returned stream. The supplied code does not show downloaded content being run as a program.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The shown retrieval is a configured chat-completion request, with an optional user-supplied API key, JSON payload, streaming response parsing, and callback delivery. No dynamic evaluator, command launcher, or execution sink is present in the supplied bounded code window; the scanner correlation is therefore insufficient to establish download-to-execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.download-to-execution
File role
production
Source
src/api.js:308-558

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This creates an SVG chart point for displaying usage statistics in the extension interface. It does not show suspicious network activity or data collection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied context shows creation of an SVG circle used as a statistics-chart data point, with locally calculated coordinates and presentation attributes. No external destination, credential access, persistence, or concealed execution is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:3506

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is normal handling of streamed responses from the custom AI service selected in the extension settings.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged operation checks each server-sent event line, parses JSON response chunks, extracts generated text and reasoning, and forwards them to the UI callback. It does not create a destination or transmit data independently.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:14373

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The reported signal is located in code handling a confirmation dialog and file reading. The supplied evidence does not show a suspicious destination or harmful use of the detected value.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The retained context around the reported location shows ordinary modal lifecycle, event handlers, timers, and a FileReader utility. Matched literal values were not retained, so the scanner signal cannot be tied to credential collection, exfiltration, or concealed behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:1443

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The extension sends chat messages to the custom AI endpoint that the user configured, which is its advertised purpose.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The shown request builds a custom endpoint from user settings, posts the selected model and messages, and optionally includes the user-supplied bearer key. The destination is configurable and consistent with an AI-provider integration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:14334

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This creates a graphical highlight circle for the statistics chart. It does not contact a network or expose information.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied code creates an SVG circle element using the browser's SVG namespace and configures presentation attributes and pointer behavior. No destination, user data flow, or execution beyond chart rendering is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/features/feature-stats.js:381

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This draws horizontal guide lines on a usage chart. It is ordinary display code and does not indicate a harmful link.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code constructs SVG line elements for chart gridlines and assigns visual attributes. The scanner signal is a false positive in this context; no link navigation, network request, sensitive-data flow, or execution behavior is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:3560

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This adds a highlighted point to the chart when the user moves over it, so the graph can show which value is selected.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The supplied code creates a non-interactive SVG highlight circle for chart hover feedback, styling it and appending it to the chart. It contains no external URL, outbound request, credential handling, or suspicious control flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:3574

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

This is ordinary handling of model reasoning and text fields from an AI response. Nothing provided indicates a hidden destination or harmful action.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The evidence shows extraction of provider-specific response parts, including thinking fields, followed by aggregation into response text. It does not demonstrate link use, persistence, credential theft, or code execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/api.js:441

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · low confidence

The scanner found a generic network-related JavaScript signal, but the supplied evidence does not show a suspicious destination, hidden link, credential theft, or unexpected transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The candidate provides only a scanner rule name, a retained line reference, and an explanation that matched literal values were not retained. The surrounding source shows ordinary extension configuration, including a user-configurable local model endpoint and API routing settings, which is consistent with the stated AI assistant purpose. No actual outbound data flow or concealed destination can be established from the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/session.js:34

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is a normal color-format parser used by the theme color picker. The input is matched against a fixed, simple color pattern and the evidence shows no network access, credential handling, or hidden execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged expression parses bounded-format rgb/rgba color strings using numeric character classes, whitespace, and fixed delimiters. It performs no external I/O or security-sensitive operation. Although the scanner labels it unsafe-regex, the supplied code shows no meaningful catastrophic-backtracking structure or attacker-relevant processing path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/utils/util-colorpicker.js:5

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This adds an SVG chart gridline for the extension's statistics display. Nothing in the shown code accesses accounts or sends information elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The relevant operation creates an SVG line representing a y-axis gridline and inserts it into the statistics visualization. The evidence does not show a link or network destination; the static signal is inconsistent with the demonstrated file role and behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:3556

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The code skips empty stream markers and processes actual response data, as expected for streaming AI output.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged conditional filters comments, empty lines, and the stream terminator before parsing data events. This is response-protocol handling and provides no evidence of concealed network activity or credential theft.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
index.js:14372

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · low confidence

The supplied material only reports a weak static signal and does not show hidden or harmful behavior. The visible file content is primarily configuration and prompt text for the extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The candidate is based on a low-confidence obfuscation detector result, while the supplied source excerpt shows readable exported constants and prompt templates. No obfuscated execution, concealed payload, credential access, persistence, or external exfiltration flow is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/constants.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This creates a horizontal guide line in the usage graph. It is ordinary chart drawing and does not send data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code constructs an SVG line, sets coordinates and visual styling from locally calculated chart values, and inserts it into the chart. No external destination or credential handling is present in the supplied context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/features/feature-stats.js:363

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged pattern is a color-parsing expression that reads ordinary RGB or RGBA style values. The supplied code does not show credential access, data transmission, or harmful execution.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regular expression parses bounded numeric color components within an rgba-style string. Although the scanner labels it as an unsafe-regex signal, the expression has no nested ambiguous quantifiers or unbounded repeated groups that establish practical catastrophic backtracking in this context. Its use is local UI color parsing and is unrelated to security-sensitive data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:8583

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This adds numeric labels to the statistics graph. It only affects what is displayed on screen.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code creates an SVG text node, assigns a locally derived label and presentation attributes, and inserts it into the statistics SVG. The supplied flow shows no network access, persistence, or sensitive-data transmission.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/features/feature-stats.js:367

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This adds small data points to a usage chart. It is normal visual interface behavior and does not indicate a suspicious link or connection.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The code creates SVG circle elements for positive locally calculated statistics, assigns chart coordinates and styling, and inserts them into the graph. No URL, request, credential access, or external data destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
src/features/feature-stats.js:313

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity