TavernKeeper Scan Report

TavernAI/TavernAI

Commit c8046de Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 11 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (11)

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The install guide shows a standard download-and-run install command from the project's own website. This is normal for install documentation and is not executable code in the repository.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: This is a documentation markdown file. The matched line is a curl-pipe-bash install instruction from the project's own domain, plainly visible in install docs. This matches the README's stated VPS install method. No executable code, no hidden data flow, no obfuscation. The scanner matched the pattern but the file role is documentation with no runtime behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/de/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The English install guide shows a standard download-and-run install command from the project's own website. Normal documentation, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: English installation documentation. The matched line is a curl-pipe-bash install command from the project's own domain, displayed openly in the VPS install section. This matches the README's stated install method. No runtime behavior, no concealed execution.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Russian install guide shows the same install command with a custom folder option. Normal documentation content, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Russian installation documentation. The matched line is the same curl-pipe-bash install command with install directory override, from the project's own domain, openly displayed. Documentation file with no runtime behavior; matches the README's stated install method.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/ru/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Russian install guide shows a standard download-and-run install command from the project's own website. Normal documentation, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Russian installation documentation. The matched line is the standard curl-pipe-bash install command from the project's own domain, openly displayed in the VPS install section. Documentation file with no runtime behavior; matches the README's stated install method.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/ru/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Spanish install guide shows a standard download-and-run install command from the project's own website. Normal documentation, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Spanish installation documentation. The matched line is the same curl-pipe-bash install command from the project's own domain, openly displayed. Documentation file with no runtime behavior; matches the README's stated install method.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/es/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The Spanish install guide shows the same install command with a custom folder option. Normal documentation content.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Same curl-pipe-bash install instruction with install directory override, in Spanish documentation markdown. Plainly visible, project's own domain, no concealed execution or untrusted input.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/es/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

This is the same install command with a custom folder option, shown openly in the install guide. Normal documentation content, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Same curl-pipe-bash install instruction with an environment variable override for install directory, in a documentation markdown file. The source is the project's own domain and the command is openly displayed as an install option. No concealed execution or untrusted input path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/de/docs/installation.md:94-95

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The English install guide shows the same install command with a custom folder option. Normal documentation content.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Same curl-pipe-bash install instruction with an install directory environment variable, in English documentation markdown. Plainly visible, project's own domain, no obfuscation or hidden data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is an install instruction in the project's README that users would manually copy and paste on a server. It is not something the application runs automatically or hides from the user. The curl-then-bash pattern is a common way to provide a server install command, though users should always review remote scripts before running them.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The scanner matched a curl-pipe-to-bash pattern in a README documentation file. The matched text is a user-facing installation instruction for a VPS or Linux server, not executable code shipped or triggered by the project. The command is plainly visible in the README, requires the user to manually copy and run it, and is a widely used convention for project install scripts. There is no concealed execution, no automatic triggering, and no code path in the repository that executes this command. The install script itself is not supplied, so no downstream behavior can be assessed from this evidence. This is documentation text, not demonstrated shipped or executable behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
README.md:39-40

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The French install guide shows a standard download-and-run install command from the project's own website. Normal documentation, not executable code.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: French installation documentation. The matched line is the same curl-pipe-bash install command from the project's own domain, openly displayed in the VPS install section. Documentation file with no runtime behavior; matches the README's stated install method.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/fr/docs/installation.md:43-44

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The French install guide shows the same install command with a custom folder option. Normal documentation content.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Same curl-pipe-bash install instruction with install directory override, in French documentation markdown. Plainly visible, project's own domain, no obfuscation or hidden data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs-site/docs/fr/docs/installation.md:94-95

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity