TavernKeeper Scan Report

starlitcode/Lumiverse-Auto-Retry

Commit 03b3031 Reviewed Oct 7, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 14 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: test
Source: test/ui.mjs:3055

Deterministic technical evidence (8)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/account-writes.test.ts:49
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/notifications.test.ts:41
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/refusal-note.test.ts:43
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/backend-version.test.ts:40
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/prompt-viewer.test.ts:50
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/prompt-viewer.test.ts:433
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/tries-at-once.test.ts:76
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: test-documentation-data

Source: test/prompt-viewer.test.ts:365

Contextual expected matches (5)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The suspicious-looking web address is a made-up placeholder used only inside the project's automated tests. The test tool intercepts any attempt to visit it and serves a fake page locally instead, so nothing is ever sent over the internet and the code never runs on users' machines.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged literal is a synthetic test origin string defined in a Playwright automation harness. Every request to that origin is intercepted by a route handler that fulfills it locally with inline HTML; no real network request is made, and the string never leaves the test runner. This is a standard technique for giving a test page a real origin so browser storage APIs work, and it matches the file's role as a test script that is not shipped to users.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: test
Source: test/ui.mjs:288

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is in a setup script for people working on the project, not in the extension users install. When the required build tool is missing, it downloads and runs the tool's own standard installer from its official website. This is a common, openly documented way to install the tool, though it does trust that website each time it runs. The evidence shows nothing malicious or hidden.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The matched line is a fallback in a developer-environment bootstrap script: it runs only when the bun runtime is absent and the npm-based install already failed, and it fetches bun's own official installer over HTTPS and pipes it to bash. This is the runtime vendor's documented installation method, the destination is fixed and disclosed in comments, the script is not part of the shipped extension that the host application loads, and it is proportionate to the script's stated purpose of preparing a development environment. The pattern does mean the executed content is whatever the vendor's server serves at run time with no local integrity check, so a compromise of that origin would translate into arbitrary code in the developer's environment. That would require the vendor's domain or the HTTPS channel to be compromised, which the supplied evidence does not demonstrate, and no attacker-controlled trigger or untrusted input path is shown.

Impact: low · Exploitability: unlikely

Developer action: Optionally pin or verify the installer (for example by checking a published checksum or version) before executing it, to remove the trust in the live download.

Scanner: opengrep 1.26.0
Rule: tavernkeeper.download-and-execute.shell-pipeline
File role: production
Source: setup.sh:46

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This file is the project's automated test suite, which opens a fake browser page, loads the extension into it, and checks that its pop-ups, timers, and settings panel behave correctly. The test tool's normal way of working - putting the project's own code into a test page and inspecting the result - looks superficially like 'fetching something and then running code,' but nothing is downloaded from anywhere untrusted and nothing runs on users' machines. It is ordinary test plumbing with no security effect.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: This candidate comes from the project's UI test harness, not the shipped extension code. The flagged correlation between a network-retrieval primitive and a dynamic-execution sink reflects standard browser automation: the harness launches browser pages, injects the extension's local source and theme into a staged test page, and runs in-page evaluation callbacks to assert on dialog behavior, countdown layout, timer lifecycle, and theme rendering. The injected content is the project's own local build artifacts and test constants, not remote or attacker-controlled data. There is no data flow from retrieved content into an execution sink, no external destination, and no shipped-runtime behavior at all, since this file runs only under developer automation. The scanner's same-representation correlation is candidate-locating evidence only and does not demonstrate any download-to-execution path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: test
Source: test/ui.mjs:4384-5251

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The scanner flagged some pattern-matching code as possibly able to make a computer hang. Looking at the actual code, the patterns were written with hard limits on how far they can scan, specifically to avoid that problem. At worst, an unusual chat reply might take slightly longer to check, and nothing is sent anywhere or damaged.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged patterns in the generated frontend file use bounded repetition (capped character-count quantifiers) and alternation branches that cannot match the same leading character, which the in-code documentation states was done deliberately to prevent catastrophic backtracking. The tag-matching, refusal-detection, and error-parsing expressions visible in the evidence windows all cap their repetition ranges, and the container-matching logic was rewritten to use index scanning instead of a backtracking pattern. The static scanner signal identifies regex constructs it considers risky, but the supplied code shows the quantifiers are bounded, so the worst case is linear-ish per pattern rather than exponential. Even a pathological reply would at most cause a brief local slowdown while inspecting text the extension already received, which is a recoverable local performance issue, not a concrete security harm.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/frontend.js:920

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test script looks at two standard environment settings to find where a copy of the browser is installed on the machine running the tests, so it can open that browser. This is a normal part of automated testing; the information is used locally and never sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The scanner matched reads of environment variables that hold browser installation paths. The helper reads two well-known Playwright/Chromium location variables, checks filesystem existence, and returns the executable path so the automation harness can launch a local browser for UI tests. The values are used only as a local launch path; they are not serialized into any outbound payload, logged to a remote destination, or persisted. This is conventional test-infrastructure code, not credential handling.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: test
Source: test/ui.mjs:352

Coverage and limitations

Inventory: 57 files · 7124476 bytes
Contextual coverage: 14 of 14 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 34 files · 2497935 bytes
X-Ray review families: 19 warning occurrences compacted to 4 evidence-preserving review families
Representations: 34 raw · 166 decoded · 1 normalized · 0 bundle modules
Stage scans: 34 raw signatures · 5 raw AST · 34 raw OpenGrep · 167 derived signatures · 1 derived AST · 167 derived OpenGrep

Unresolved JavaScript stages

dist/frontend.js — derived-ast / parse
dist/frontend.js — normalize / parse
dist/frontend.js — normalize / unsupported
src/backend.ts — raw-ast / parse
src/frontend.ts — derived-ast / parse
src/frontend.ts — normalize / parse
src/frontend.ts — normalize / unsupported
src/frontend.ts — raw-ast / parse
test/account-writes.test.ts — raw-ast / parse
test/backend-version.test.ts — raw-ast / parse
test/bridge.test.ts — raw-ast / parse
test/built-in-notes.test.ts — raw-ast / parse
test/contrast.test.ts — raw-ast / parse
test/debug-report.test.ts — raw-ast / parse
test/dependent-settings.test.ts — raw-ast / parse
test/detection-corpus.test.ts — raw-ast / parse
test/detection.test.ts — derived-ast / parse
test/detection.test.ts — normalize / parse
test/detection.test.ts — normalize / unsupported
test/detection.test.ts — raw-ast / parse
test/export-labels.test.ts — raw-ast / parse
test/fixtures.test.ts — raw-ast / parse
test/garbled-corpus.test.ts — derived-ast / parse
test/garbled-corpus.test.ts — normalize / parse
test/garbled-corpus.test.ts — normalize / unsupported
test/garbled-corpus.test.ts — raw-ast / parse
test/hint-defaults.test.ts — raw-ast / parse
test/hints.test.ts — raw-ast / parse
test/host-calls.test.ts — raw-ast / parse
test/hostile-input.test.ts — derived-ast / parse
test/hostile-input.test.ts — normalize / parse
test/hostile-input.test.ts — raw-ast / parse
test/moved-defaults.test.ts — raw-ast / parse
test/notifications.test.ts — raw-ast / parse
test/panel-sections.test.ts — raw-ast / parse
test/prompt-viewer.test.ts — raw-ast / parse
test/refusal-note.test.ts — raw-ast / parse
test/say-time.test.ts — raw-ast / parse
test/stated-wait.test.ts — raw-ast / parse
test/status-header.test.ts — raw-ast / parse
test/tries-at-once.test.ts — raw-ast / parse
test/truncation-corpus.test.ts — raw-ast / parse
test/ui.mjs — derived-ast / parse
test/ui.mjs — normalize / parse
test/ui.mjs — normalize / unsupported
test/version.test.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — not-applicable
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 03b30318b447b20b48281f3c9b45f729aea5745c
Completed: Oct 7, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 4 fresh / 0 reused groups · 5 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 9 deterministic / 5 contextual candidates · 4 contextual / 12 total behavior cases
Model budget: 3 model calls · 4 / 12 fresh cases · 103735 / 200000 estimated input · 83816 / 250000 actual input · 3220 / 40000 output tokens
Review batching: 3 model calls · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 83816 input · 3220 output · 0 cache read · 1122 reasoning tokens
Report: 6ccdcbc030e143cb5e2af4fc1b7a0cdfe237188dab70b035b9f68ee0a123da54