TavernKeeper Scan Report

IkarusV/IkarusCheckpoint

Commit 164ef30 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension loads its own settings panel template and lets users run Quick Replies from a QR tab. These are standard SillyTavern features done for legitimate reasons. There is no evidence of downloading remote code and executing it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlates a network retrieval primitive with a code execution sink in the same file. The actual data flow shows no download-to-execution pattern. The retrieval is `ctx.renderExtensionTemplateAsync(__extPath, 'settings')`, which loads the extension's own local settings HTML template — a standard SillyTavern extension API. The execution sink is `executeCachedQuickReply`, which calls `qr.execute()` or `globalThis.executeQuickReplyByName()` to run Quick Replies when the user clicks them in the QR tab — a documented SillyTavern Quick Reply feature. These two capabilities are in separate code paths with no data flow connecting fetched content to execution. The `insertAdjacentHTML` call injects the rendered settings template, not dynamically fetched remote content. No `eval`, `Function`, `setTimeout(string)`, or similar dynamic code execution from network data is present in the supplied source. The extension's stated purpose (checkpoint/branch/swipe navigator with QR cache) is consistent with these capabilities.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:1-648

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity