The installer adds the tool's folder to your shell startup file so the tool is available in new terminal windows. It checks before writing to avoid duplicates, tells you what it did, and only touches files in your own home folder. This is normal and expected for an install script.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The install script shows the common one-command install pattern. When it needs to install a helper tool, it downloads it to a temp file first and checks it is not empty before running it, rather than blindly piping. This is normal behavior for a software installer the user deliberately runs.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The scanner matched a comment in file that documents the one-line install pattern. The actual script does not pipe curl directly into sh for execution; instead, ensure_uv downloads the uv installer to a temporary file, verifies it is non-empty, then executes it. This is a standard, transparent install-script pattern for an open-source CLI tool, explicitly invoked by the user. The script avoids sudo, stays within the home directory, and is disclosed in comments and the README.
This is just the README telling users how to install the tool. It is text, not code, and the user must choose to copy and run the command themselves. This is a normal way to document installation.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The scanner matched the documented install command in file, a documentation file with no executable behavior. The line is installation instructions for users to copy and run deliberately. The actual install script behavior is reviewed separately. Documentation showing a curl-pipe-to-sh one-liner is a standard, widespread install pattern and does not itself constitute shipped executable behavior.
The installer adds the tool's folder to your bash startup file so the tool works in new terminal sessions. It avoids duplicate entries, tells you what it changed, and stays within your home directory. This is normal install script behavior.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The app can run a command you specify in your own settings file to fetch your encryption key from a password manager or hardware token. You choose and write the command yourself; the app does not receive it from anyone else. This is a legitimate feature for users who want to control how their encryption key is retrieved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.python-eval-or-shell. The match applies to this repository.
Contextual assessment: The CommandKek._run method calls subprocess.run with shell=True using the value of self._enc.retrieve_command. This value originates from the user's own configuration file under the [encryption] section, not from any external or untrusted input. The feature is explicitly designed to let users retrieve their encryption key from an external source such as a password manager or hardware-token script, which is disclosed in the class docstring and the README. The command is user-authored and user-invoked on their own machine, which is the expected and proportionate capability for this stated purpose.