TavernKeeper Scan Report

ExtensionMuncher/MemoryLoom

Commit b02ee7d Reviewed Sep 16, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 6 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: llm/writer.js:682

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: lib/lorebookImport.js:35

Contextual expected matches (2)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is the standard default local address for Ollama, used when no other address is configured. It is sent to SillyTavern's own backend so memory lookups can reach the user's own local embedding service. Nothing goes anywhere unexpected.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged a network-access literal in the vector query path. In context, that literal is again Ollama's default local endpoint address, applied in queryCollection as the final fallback of the same resolution chain used by the embedder: user-configured alternate endpoint (when enabled and filled), then SillyTavern's stored Ollama server URL, then any filled alternate URL, then the default local address. The resolved value is placed in the request body's apiUrl field and posted to SillyTavern's own relative vector-query endpoint with standard ST request headers; the host server contacts the embedding backend. Per the code comments, this fallback exists so retrieval does not fail with a server error for users who did not select Ollama as their text-generation backend. The behavior matches the project's documented purpose of supporting multiple user-configured embedding providers, involves no direct remote fetch from the extension, no obfuscation, and no credential or private-content flow to any unexpected destination. The scanner signal is a heuristic match on a localhost literal, not demonstrated exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: embed/retriever.js:263

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is simply the standard default address for a locally running Ollama program, used when the user has not configured one. It is handed to SillyTavern's own backend so it can reach the user's own local embedding service. Nothing is sent anywhere unexpected, and nothing leaves the user's machine because of this line.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged a network-access literal on the flagged line. In context, that literal is Ollama's default local endpoint address, used only as the final fallback in a provider URL resolution chain: a user-configured alternate endpoint (when enabled and filled), then SillyTavern's stored Ollama text-generation server URL, then any filled alternate URL, then the default local address. The resolved value is placed in the request body's apiUrl field and posted to SillyTavern's own relative vector-insert endpoint using standard ST request headers; the host server, not the extension, contacts the configured embedding backend. This mirrors SillyTavern's native vector-storage behavior, matches the project's stated purpose of user-configurable embedding backends (Local/Transformers, Ollama, vLLM, OpenAI, Cohere, Google, OpenRouter, Mistral), and is disclosed in the README's Vectorization settings documentation. There is no direct client-side fetch to any remote host, no obfuscation, no credential handling, and no data flow beyond the user's configured embedding backend. The flag is a benign heuristic match on a localhost literal, not demonstrated exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: embed/embedder.js:139

Related contextual observations

Flagged link is a documented local Ollama fallback address

low risk · high confidence

This is a sensible default: if the user picks Ollama but never enters an address, the extension falls back to the well-known local Ollama address instead of failing. It matches the project's documented purpose.

Technical assessment

The flagged line is the terminal fallback of the Ollama provider's URL resolution chain. It only applies when the user has not configured an alternate endpoint and SillyTavern has no stored Ollama URL, preventing an invalid-URL server error. The value travels inside the request body to SillyTavern's own relative vector API endpoint, matching the extension's stated embedding-provider configuration purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

embed/embedder.js:139

Retriever fallback chain mirrors the embedder's local Ollama default

low risk · high confidence

Memory lookups use the same sensible default as memory saving: if no custom address is set, they fall back to the well-known local Ollama address rather than erroring out. This matches the project's stated design.

Technical assessment

The retriever builds provider-specific query fields identical to the embedder's request-body builder, including the same final fallback to Ollama's default local address. The value is only a parameter passed to SillyTavern's own relative vector-query endpoint; the extension itself makes no cross-origin request, and the fallback exists to avoid server-side invalid-URL errors when no endpoint is configured.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

embed/retriever.js:263

Coverage and limitations

Inventory: 33 files · 713813 bytes
Contextual coverage: 4 of 4 candidates assessed

JavaScript coverage

Status: Complete
Candidates: 30 files · 644462 bytes
X-Ray review families: 4 warning occurrences compacted to 4 evidence-preserving review families
Representations: 30 raw · 39 decoded · 0 normalized · 0 bundle modules
Stage scans: 30 raw signatures · 30 raw AST · 30 raw OpenGrep · 39 derived signatures · 0 derived AST · 39 derived OpenGrep

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — not-applicable
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.

Technical scan identity

Full commit: b02ee7d192b04cb2878ca22fb598eb0d8938e62d
Completed: Sep 16, 2026
History depth: 1 commit
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 2 fresh / 0 reused groups · 2 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 2 deterministic / 2 contextual candidates · 2 contextual / 4 total behavior cases
Model budget: 1 model call · 2 / 12 fresh cases · 40070 / 200000 estimated input · 33183 / 250000 actual input · 2686 / 40000 output tokens
Review batching: 1 model call · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 33183 input · 2686 output · 0 cache read · 1064 reasoning tokens
Report: b4df0d57cc9349a45d7114dfc2d65153d469b508db2f2033203ee50702af6337