TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

ZapoVerde/SillyTavern-Triggeryze

Commit 56a1f67 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 28 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
triggers/lb-query.js:289

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
actions/template.js:69
Deterministic technical evidence (20)

  • Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:821253a22c3d87a034daa956 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-5xrq-8626-4rwp:pkg:9050b80cbfdd759d03b3d57f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: tests/transforms.test.js:584

  • JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: tests/transforms.test.js:286

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:2c6a626dc52bd9af79c86b60 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: tests/load-image.test.js:20

  • JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: tests/triggers.test.js:831

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:4a6bce6b1ed4b848fe37e071 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:d9de591f6b7272d0d17e4e9f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:32565e5915130b51271b4195 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-r28c-9q8g-f849:pkg:6f926e74aaf2969f045549e9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: tests/format.test.js:29

  • Dependency advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:46968ba7f775ec580db4bbb2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:c9523a0885d757426ed83e80 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:4ccc458e17e9edf57fcb5743 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:d681b9f3617b82bd6b835445 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

Contextual expected matches (3)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged a line that looks like it might contain links, but it is just a list of text-transform token names like 'chars:' and 'last:'. The file performs only string operations with no network calls or external links of any kind.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The JS-X-Ray shady-link heuristic matched string literals in the TRANSFORM_PREFIXES array (line 27), which contains colon-prefixed token names like 'chars:', 'last:', 'replace:', 'match:'. These resemble protocol-prefixed URLs to the heuristic but are purely string constants used to identify template transform tokens. Review of the entire file confirms zero network primitives: no fetch, XMLHttpRequest, WebSocket, URL construction, or dynamic import. The module is purely synchronous string transformation (trim, upper, lower, regex match, pad, etc.) with no external I/O as confirmed by the @contract annotation (external_io: none, purity: pure). The signal is a false positive from the heuristic misinterpreting colon-terminated string literals as link-like values.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
actions/transforms.js:27

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension uses a JavaScript function-builder to evaluate math expressions in templates. Before any expression runs, it is filtered to allow only numbers, arithmetic operators, and a fixed list of math function names. Any letters or code keywords are rejected, so this cannot be used to run arbitrary JavaScript. This is a standard approach for a template math evaluator and fits the project's purpose.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
actions/template.js:320

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
settings/profiles.js:24-171

Related contextual observations

Character whitelist effectively prevents code injection into the Function() constructor

low risk · high confidence

The math evaluator only permits arithmetic characters and a fixed set of math function names, blocking any code injection through template variables.

Technical assessment

The character whitelist at line 317 ensures that after stripping known function names, only numeric and operator characters survive. Any variable content containing letters or code-like syntax fails this check and the function returns an empty string, preventing code injection through interpolated variables.

Impact: low · Exploitability: unlikely

Developer action: none

Sources:

No network or external I/O present in the transform resolver module

low risk · high confidence

The file contains only string manipulation functions with no network access, confirming the scanner signal is a false positive.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Examples gallery fetches from same-origin bundled files, not external endpoints

low risk · high confidence

The example files are loaded from the extension's own directory, the same trust level as the extension code itself, and require explicit user action to import.

Technical assessment

_EXAMPLES_BASE resolves to a relative path within the extension's installation directory via import.meta.url. The fetch targets index.json and example JSON files that are part of the extension's own bundled assets. This is equivalent in trust level to the extension's own source code being loaded. No dynamic or external URL construction is present; filenames come from the fetched index.json, which itself is a local bundled file.

Impact: low · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory
127 files · 1371946 bytes
Contextual coverage
25 of 25 candidates assessed

JavaScript coverage

Status
Complete
Candidates
92 files · 969597 bytes
X-Ray review families
18 warning occurrences compacted to 8 evidence-preserving review families
Representations
92 raw · 3 decoded · 1 normalized · 0 bundle modules
Stage scans
92 raw signatures · 92 raw AST · 92 raw OpenGrep · 4 derived signatures · 2 derived AST · 4 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
56a1f679a3e470c06e5dda4260386fb09fcb1ce9
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
3 fresh / 0 reused groups · 3 fresh / 0 reused candidates
Review source reports
none
Evidence triage
22 deterministic / 3 contextual candidates · 3 contextual / 12 total behavior cases
Model budget
1 model call · 3 / 12 fresh cases · 54726 / 200000 estimated input · 48348 / 250000 actual input · 4396 / 40000 output tokens
Review batching
1 model call · up to 3 groups and 3 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
48348 input · 4396 output · 0 cache read · 0 reasoning tokens
Report
f6864446d3b80dcc41cca6d0b2f6bc284d1e5d0c18657d1205544c80480a5aff