TavernKeeper Scan Report

TavernAI/TavernAI

Commit 3413f59 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 12 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Minor caution · medium confidence

The README tells Linux server users to download and run an installer from the project's own website in a single copy-paste command. This is a very common installation shortcut used by many open-source projects, and it is done openly at the user's own choice. The catch is that the user never sees the installer before it runs, so if the website were ever compromised, the installer could be tampered with. There is no sign that this has happened here; it is simply a less careful installation method than downloading a file and checking it first.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is a documentation snippet in the project README that shows a one-line remote install command piping a script from the project's own website directly into a shell. This is a widely used, user-initiated install idiom for Linux servers, is fully visible to the user, and matches the project's stated purpose of distributing its application. The scanner keyword match alone does not show any malicious or concealed behavior: the script's contents are not supplied, the destination is the project's own domain, and there is no evidence of obfuscation, redirect chains, or unexpected destinations. The weakness is procedural rather than demonstrated: piping an unverified remote script into a shell means a compromise of the hosting domain or an on-path attacker could execute arbitrary code during installation. Nothing in the supplied evidence shows that has occurred or that the script does anything harmful.

Impact: low · Exploitability: unlikely

Developer action: Consider documenting a two-step install (download the script, review it, then run it) and publishing a checksum or signature for the installer so server administrators can verify integrity before execution.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
README.md:39-40
Contextual expected matches (10)

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged lines are simply the installation manual telling someone how to set the app up on their own server: download the maker's official installer from the project's website and run it. That is the normal, openly documented install method, and the same command is shown on the project's front page. Nothing runs by itself; a person has to choose to type it in.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is a shell pipeline inside a fenced code block of a German localization of the installation guide. The documentation tells a user to fetch the project's official installer script over HTTPS from the project's own website and feed it into a shell on the user's own server. This is documentation text, not shipped executable code: nothing runs unless a person voluntarily copies and runs the command. The destination is the project's official domain, the identical command appears in the repository README as the documented VPS install method, and the behavior matches the stated purpose (installing the application) with full disclosure. The supplied evidence shows no attacker-controlled trigger, untrusted input path, credential access, concealed execution, or covert data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/de/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the manual's instruction for installing the app into a folder of your choice on your own server. It downloads the official installer from the project's website and runs it only because you typed it in yourself. It is openly documented and matches what the project says it does.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is in the English installation guide, inside a fenced code block showing the project's official one-line Linux installer with an environment variable for a custom install directory. The content is documentation, not executable shipped code. The command fetches the installer over HTTPS from the project's own official domain, the same domain and command are presented in the repository README as the supported server install method, and the effect matches the stated purpose with full disclosure to the user. Execution occurs only when a user voluntarily runs the command on their own server; the evidence contains no attacker-controlled trigger, untrusted input path, or unexpected destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Russian manual shows the same official install command with an option to choose the install folder. Nothing happens unless the user runs it themselves, and the download comes from the project's own website.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is the custom-directory variant of the project's official installer command in the Russian localization of the installation guide. It is static documentation inside a fenced code block: the user deliberately runs the command on their own server, the installer is fetched over HTTPS from the project's own official domain also referenced in the README, and the effect matches the documented installation purpose. The evidence shows no automatic execution, attacker-controlled trigger, credential access, or unexpected destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/ru/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the one-line install instruction in the Russian setup guide, the same one the project shows on its main page. It only does something when a person chooses to run it on their own server.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is the primary VPS installer command in the Russian localization. The pattern is the conventional convenience installer: the user pipes the project's official script, retrieved over HTTPS from the project's own website, into a shell on their own server. The README publishes the identical command, so the capability is disclosed, proportionate to installing the application, and directed at the project's official distribution point. As documentation, it ships no executable behavior, and the supplied evidence demonstrates no attacker-controlled path or concrete harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/ru/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Spanish manual shows the same official one-line install command as the project's main page. It is instructions for a person setting the app up on their own server, not something that runs by itself.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is the primary VPS installer command in the Spanish localization of the installation guide. It is prose documentation with a fenced code block instructing the user to run the project's official installer, downloaded over HTTPS from the project's own website, on the user's own server. This mirrors the command published in the repository README, so the capability is disclosed, the destination matches the project's official distribution point, and the action is proportionate to the documented purpose of installing the application. No code ships here, nothing executes automatically, and the evidence shows no attacker-controlled trigger or concrete harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/es/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the same install instruction with an option for choosing the install folder. It does nothing unless the user runs it themselves, and it comes from the project's own website.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The second match in the Spanish guide is the identical installer pipeline with an environment variable selecting a custom installation directory. It remains static documentation: the user must deliberately execute it, the source is the project's official HTTPS domain, and the outcome matches the guide's stated purpose. There is no concealed execution, credential handling, unexpected destination, or demonstrated attacker-controlled path in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/es/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the same install instruction as before, just with an option that lets the person pick which folder to install into. It only does something if the user runs it themselves, it comes from the project's own website, and it is exactly what the guide says it does.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The second match in the same localized guide is the same official installer pipeline, prefixed with an environment variable that lets the user choose a custom installation directory. It remains documentation text: the user deliberately runs the command on their own machine, the download source is the project's official HTTPS domain, the action matches the documented installation purpose, and there is no hidden execution, redirection to an unexpected destination, or attacker-controlled input. No concrete harm is demonstrated by this evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/de/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is the one-line install command in the setup guide, the same one shown on the project's main page. It only runs when a person copies it and runs it on their own server, and it comes from the project's official website.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is the primary VPS install command in the English installation guide, inside a fenced code block. It is the standard convenience installer pattern: the user pipes the project's official script, fetched over HTTPS from the project's own website, directly into a shell on their own server. The README advertises the identical command, so destination, timing, and purpose are all disclosed and proportionate to installing the application. The file is documentation; no shipped behavior executes, and no attacker-controlled path or concrete harm is demonstrated by the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The French manual repeats the official one-line install command that the project also shows on its main page. A person has to copy and run it themselves on their own server for anything to happen.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The match is the primary server install command in the French localization of the installation guide. The documentation instructs the user to pipe the project's official installer, fetched over HTTPS from the project's own website, into a shell on the user's own server. The identical command and domain appear in the repository README, so the behavior is disclosed, purpose-matched, and uses the project's official distribution point. The file is documentation and nothing executes without deliberate user action; the evidence demonstrates no attacker-controlled trigger, untrusted input, or concrete harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/fr/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the same install instruction with a folder-choice option. It only runs if the user runs it, it uses the project's own website, and it does what the guide says.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The second match in the French guide is the same official installer command with an environment variable for a custom install directory. It is documentation only: user-initiated execution, HTTPS retrieval from the project's own official domain, behavior consistent with the documented installation purpose, and no hidden or disproportionate action. No demonstrated exposure or concrete harm appears in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/fr/docs/installation.md:94-95

Related contextual observations

Remote install command documented without integrity verification

low risk · medium confidence

The one-line install command runs code from the internet without letting the user check it first. That is a common but slightly risky installation style; nothing shows the installer itself is harmful.

Technical assessment

The README documents piping a remote installer from the project's own domain directly into bash with no checksum, signature, or review step. The practice is disclosed and user-initiated, so it is not concealed behavior, but it offers no integrity check on the executed content. The installer's actual contents were not supplied, so no concrete harmful data flow is demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Offer a documented alternative that downloads and verifies the installer before running it, and publish a checksum or signature for release artifacts.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity