TavernKeeper Scan Report

RetroVioletRed/SillyTavern-PicturePrompt

Commit 5aa5631 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (2)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

A scanner flagged a line as containing a suspicious link, but the flagged text is just the standard browser blob URL prefix. The code checks whether an image uses a blob URL so it can properly clean up memory. This is normal, correct practice with no network access or data leaving the browser.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The JS-X-Ray shady-link signal fires on line 413, which contains the string literal 'blob:' used in a startsWith check: $img.attr('src')?.startsWith('blob:'). This is the standard browser blob: URL scheme produced by URL.createObjectURL for locally generated object URLs. The code checks for blob: sources before calling URL.revokeObjectURL to free browser memory when deleting or replacing lorebook images. No external URL, fetch, XHR, or network destination is present anywhere in this data flow. The blob: references are entirely local and match the project's stated purpose of storing images locally in IndexedDB and displaying them via object URLs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
modules/lorebook-ui.js:413

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A scanner flagged the first line as potentially obfuscated code, but the file is plainly readable, well-commented JavaScript. The alert appears to be a false positive, likely triggered by a Unicode dash character in a comment. There is nothing hidden or suspicious here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The JS-X-Ray obfuscated-code signal fires on line 1, which is a JSDoc comment containing a Unicode em-dash. The full source is a standard, clearly written ES module that imports helpers, renders a jQuery-based image grid, manages IndexedDB image blobs, and uses a MutationObserver to inject UI into SillyTavern lorebook editors. There is no minification, encoding, eval, string concatenation to hide code, or any other obfuscation technique. All dynamic HTML construction uses escapeHtml on user-controlled values (filenames, labels, entry UIDs, world names). The code matches the stated project purpose of attaching images to lorebook entries.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
modules/lorebook-ui.js:1

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity