TavernKeeper Scan Report

ExtensionMuncher/MemoryLoom

Commit 6cd20be Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 6 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
lib/lorebookImport.js:35

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
llm/writer.js:464
Contextual expected matches (2)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged a localhost web address, but it is simply the default local address for Ollama, a common local AI tool. It is used as a last-resort fallback so the extension works out of the box. No data is sent to any suspicious external site.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
embed/embedder.js:118

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged a localhost web address, but it is just the default local address for Ollama, a common local AI tool. It serves as a fallback so retrieval works without manual configuration. No data is sent to any suspicious external site.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
embed/retriever.js:257

Related contextual observations

All fetch calls target SillyTavern's own vector API endpoints

low risk · high confidence

All network calls in this file go to the extension's own host server, not to any external address. The only URL literal present is the standard local Ollama address used as a fallback.

Technical assessment

The embedEntry and deleteEntryVector functions both issue fetch calls to relative ST endpoints (/api/vector/insert, /api/vector/delete) using getRequestHeaders. The only absolute URL literal in the file is the Ollama default localhost address used as a provider fallback. No external destination is contacted directly by client-side code.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

The sole fetch call targets SillyTavern's own vector query endpoint

low risk · high confidence

The only network call in this file's query function goes to the extension's own host server, not to any external address. The only URL literal is the standard local Ollama address used as a fallback.

Technical assessment

The queryCollection function issues a fetch to the relative ST endpoint /api/vector/query using getRequestHeaders. The only absolute URL literal present is the Ollama default localhost address, used as a provider fallback in the request body. No external destination is contacted directly by client-side code.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity