TavernKeeper Scan Report

myanadi/risuai-gpt-image

Commit b2e37ec Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (2)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner thought it might find hidden code, but looking at the actual source, the code is clean, open, and easy to read. There is no hidden or scrambled code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner flagged 'obfuscated-code' at line 1 with low confidence. The supplied source code is plain, readable JavaScript with clear comments in Korean and English, standard variable names, and no minification, packer signatures, eval-based dispatching, or encoded payloads. The IIFE wrapper at line 7 is a standard module pattern. No obfuscation is evident.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
GPTImage.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The plugin sends your OpenAI API key and image data to OpenAI's servers to generate images, which is exactly what the plugin is designed to do. There is no evidence of it sending your data to any other hidden or suspicious websites.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged 'shady-link' near line 355. The code at that location handles collecting reference images from local plugin storage and building multipart form data for the OpenAI image edits API. The only network destinations are the user-configurable config.endpoint and config.editsEndpoint, which default to api.openai.com. The API key is sent only as a Bearer token to these endpoints via risuai.nativeFetch. This is the expected data flow for a plugin whose stated purpose is direct OpenAI image generation. No hardcoded suspicious URLs or data exfiltration to third parties is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
GPTImage.js:355

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity