TavernKeeper Scan Report

ZDOSt/Story-Engine

Commit 717bacf Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 22 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:3584

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

The code has a pattern-matching line (regex) that could be slow if someone sends a specially crafted input. This could cause the evaluation tool to hang, but it's not a security threat because the tool is not used during normal chat and the problem can be fixed by restarting.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The regex `/^relationshipEngine\[([^\]]+)\](?:\.(.*))?$/` at line 44 of `file` is used to parse user-supplied report paths. While not a severe ReDoS pattern, a crafted input with many bracket-like characters could cause excessive backtracking due to the combination of a negated character class with `+` and a trailing `.*`. However, the function is only invoked during semantic golden evaluation, which is a development/test utility, not part of the core extension runtime. The attacker would need to control the `captures` input to this function, and the impact is limited to denial of service of the evaluator process, which is recoverable. No concrete exploit is demonstrated.

Impact: low · Exploitability: plausible

Developer action: Consider anchoring the regex more tightly by removing the trailing `(?:.*)` or using a non-backtracking approach. Alternatively, validate input length or syntax before matching. For a test-only utility, the risk is low, but hardening is recommended.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-golden-evaluator.mjs:44

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-validation.js:108

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
prose-guard-edits.js:292

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
pre-flight.js:1194

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
narration-sanitizer.js:67

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:345

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:183

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:3855
Contextual expected matches (12)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string. This is a common pattern for testing internal functions without exporting them.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:19838-19846

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

A test file uses JavaScript's built-in function creator to build small test functions from the project's own code. This is a normal testing technique and does not expose users to any security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This candidate identifies a dynamic function construction using new Function in a test file. The source string passed to the constructor is extracted from the project's own index.js by slicing between known function boundaries, not from any untrusted input. The resulting function is used to test widget layout logic in a controlled test harness. No attacker-controlled data enters the evaluated code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11192-11198

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation is part of the same test file (file). It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:20003-20018

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is just a test that builds a temporary function from part of the extension's own code to check that internal settings work correctly. It's not a security issue.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The candidate matches a `new Function(...)` call inside a unit test (file) that constructs a dynamic function from a sliced string of production source code. This is a standard testing technique to access internal module functions without exporting them. The source string is derived from the project's own index.js, not from user or external input. No remote code execution or credential access is possible via this test-only path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:16333-16341

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:19826-19829

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This candidate matches another new Function call in the same test file. It constructs a migration function from a source slice extracted from the project's own index.js. The input to the function constructor is hardcoded template strings and a slice of the project's own code. No untrusted data is used. The test verifies widget settings migration behavior without any runtime injection risk.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11199-11202

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:19855-19870

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:19847-19851

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:19830-19835

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is just a test that builds a temporary function from part of the extension's own code to check that internal settings work correctly. It's not a security issue.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The candidate matches a `new Function(...)` call inside a unit test (file) that constructs a dynamic function from a sliced string of production source code. This is a standard testing technique to access internal module functions without exporting them. The source string is derived from the project's own index.js, not from user or external input. No remote code execution or credential access is possible via this test-only path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:16287-16302

Gitleaks reported generic-api-key

Expected behavior · high confidence

A security scanner found what looks like an API key in the testing file, but it's actually a made-up example used to check that the extension hides secrets in error messages. No real passwords or keys were exposed.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged line (16918) is inside a unit test that constructs a semantic diagnostic error message containing placeholder secret-like strings (e.g., 'Authorization: Bearer [REDACTED_SECRET:b80965ff4cbf]' and 'google-sensitive-key'). These are test fixtures specifically designed to verify that the annotateSemanticDiagnosticError function redacts credentials before logging. No real API keys, secrets, or credentials are present. The error object is constructed with fake values and never transmitted anywhere. The test subsequently asserts that the redacted output does not contain the original secret strings, confirming the intended protective behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
test-behavior.mjs:16918

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: This candidate corresponds to a new Function call that creates a set of layout clamping functions from a slice of index.js. The extracted source is obtained by reading the project's own file and locating function definitions by name. The resulting function is invoked with a hardcoded globalThis mock to test position clamping logic. There is no user-controlled input or external data in the evaluated string, making this standard test behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11182-11191

Related contextual observations

Test file misclassified as production

low risk · medium confidence

A testing file was wrongly labeled as a regular extension file. This doesn't cause a security problem but could confuse automated scanners.

Technical assessment

The file file is clearly a test file (uses assert, imports test utilities, contains test functions) but was marked with file_role 'production'. This does not introduce a vulnerability but may cause security scanners to flag test-only patterns as production issues.

Impact: none · Exploitability: unlikely

Developer action: Consider updating the file classification to 'test' or 'fixture' to improve automated scanning accuracy.

Sources:

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity