TavernKeeper Scan Report

MentallyQuill/Directive

Commit 06b7e31 Reviewed Aug 20, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 45 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/runtime/v1-accepted-pair-source.mjs:4

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/hosts/sillytavern/preset-manager.mjs:15

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/time/ship-time.mjs:2

Deterministic technical evidence (36)

JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-mobile-campaign-mission-accordions.mjs:39
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-ship-mechanics-state.mjs:146
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/test-campaign-required-empty-state.mjs:95
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/repair-sam-vickers-pending-pair.mjs:478
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-journey.mjs:93
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-character-creator-assist-layout.mjs:201
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/helpers/fake-dom.mjs:82
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-directive-launcher-button-visual.mjs:23
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-evidence.mjs:567
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/repair-sam-vickers-premature-evidence.mjs:555
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

Source: src/runtime/state-delta-gateway.mjs:7
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/test-expanded-interface-shell.mjs:92
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/test-cohesion-ship-visual.mjs:82
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/capture-runtime-route-live.mjs:6
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/repair-sam-vickers-pending-pair.mjs:39
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-state-delta-codec.mjs:47
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/capture-runtime-route-live.mjs:6
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-cohesion-ship-visual.mjs:32
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-reducer.mjs:61
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

Source: src/storage/v1-state-delta-codec.mjs:5
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-episode-evaluator.mjs:326
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-command-bearing.mjs:77
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-sam-vickers-pending-pair-repair.mjs:78
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/serve-expanded-interface-preview.mjs:56
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/repair-sam-vickers-premature-evidence.mjs:37
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/serve-expanded-interface-preview.mjs:8
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-sam-vickers-premature-evidence-repair.mjs:149
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-campaign-required-empty-state-visual.mjs:54
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-gameplay-notification-visual.mjs:62
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-turn-activity-indicator-visual.mjs:23
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-browser-runtime-safety.mjs:28
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-certified-ui-authority.mjs:10
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-duty-report-runtime.mjs:147
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-entry-capabilities.mjs:142
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-duty-report-planner.mjs:166
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-authoritative-ship-chronometer-visual.mjs:14

Contextual expected matches (5)

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The test script launches a local helper program and passes along its own environment settings so the helper can run correctly. This is normal and expected for a test tool. No sensitive information leaves the machine.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The serialize-environment signal is triggered by spreading process.env into the spawn options for a local helper script. This is standard Node.js practice to inherit the parent environment while adding a port override. The child process is a known local test server script within the same repository. No environment data is exfiltrated or sent to any external destination; it is passed locally to a trusted child process.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: tooling
Source: tools/scripts/test-expanded-interface-visual-conformance.mjs:70

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner saw a web address in the code, but it is just the official identifier the browser requires to create SVG graphics. No data is sent anywhere; it is a standard part of drawing on-screen visuals.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged a fixed string at line 158 as a suspicious link. The actual value is the standard SVG namespace URI passed to document.createElementNS, which is a mandatory constant for creating SVG elements in the DOM. No network request is made to this URI; it is a namespace identifier, not a destination. The surrounding code builds SVG polyline and path elements for visual callout layout and cohesion ring rendering. There is no network access, credential handling, or data exfiltration present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: src/ui/ship-journal.js:158

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The test script starts a local mini-server and then checks that it is running before proceeding with visual tests. The scanner flagged this because it sees both a network check and a program launch in the same file, but both are local and part of the test setup. Nothing dangerous is happening.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlates a network retrieval primitive with an execution sink in the same file. The fetch calls target only a localhost preview server on a dynamically chosen port, used to wait for the server to become ready. The spawn call launches a known local repository script for that same preview server. No remote or untrusted content is downloaded and then executed; both the fetch destination and the spawned program are local and repo-internal. This is standard Playwright test harness orchestration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: tooling
Source: tools/scripts/test-expanded-interface-visual-conformance.mjs:58-1894

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

The scanner flagged code that sends a value to a network function, but the value is just the address of the user's own local SillyTavern server. This is a developer screenshot tool that opens a local test page and takes pictures for design documentation. No passwords or secrets are involved, and this tool is not part of what users install.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network. The match applies to this repository.

Contextual assessment: The scanner matched a credential-to-network rule at line 234 where connection.send('Page.navigate', { url: BASE_URL }) is called. BASE_URL is defined as process.env.SILLYTAVERN_BASE_URL or a default of a localhost address on port 8000. It is a base URL for a local SillyTavern server instance, not a credential or secret. The script is a tooling-only visual capture utility that launches a headless browser via CDP, navigates to the local SillyTavern instance, opens the Directive runtime panel, navigates to specific UI routes, captures screenshots, and writes layout metrics to the docs directory. No credentials, API keys, or sensitive user data are read or transmitted. The environment variable controls a local server address, and all network activity is to localhost. The file role is tooling and execution scope is tooling-only, so this code does not run in the shipped extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role: tooling
Source: tools/scripts/capture-runtime-route-live.mjs:234

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

The test includes a long hex string that is a fingerprint for an expected image. It is used to verify that a visual element has not changed unexpectedly. This is a normal testing technique, not hidden or obfuscated code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.

Contextual assessment: The encoded-literal signal at line 1147 corresponds to a SHA-256 digest hex string used as an expected assertion value in a visual conformance test. The test computes a hash of image pixel data and compares it against this known-good fixture value. This is a deterministic test fixture, not obfuscation or hidden data. The string is a plain hex digest embedded for assertion purposes.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.encoded-literal
File role: tooling
Source: tools/scripts/test-expanded-interface-visual-conformance.mjs:1147

Related contextual observations

SVG namespace URI used in createElementNS calls

low risk · high confidence

The code uses the standard web address needed to draw SVG graphics in several places. This is normal browser programming, not network communication.

Technical assessment

The same standard SVG namespace URI appears in multiple createElementNS calls throughout the file for creating svg, polyline, and path elements. These are standard DOM API calls for SVG rendering and carry no network semantics.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory: 1121 files · 57677935 bytes
Contextual coverage: 44 of 44 candidates assessed

JavaScript coverage

Status: Complete
Candidates: 319 files · 3492838 bytes
X-Ray review families: 75 warning occurrences compacted to 42 evidence-preserving review families
Representations: 319 raw · 6 decoded · 0 normalized · 0 bundle modules
Stage scans: 319 raw signatures · 319 raw AST · 319 raw OpenGrep · 6 derived signatures · 0 derived AST · 6 derived OpenGrep

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.

Technical scan identity

Full commit: 06b7e3160a6c1fefe2134e5cac926843b5a0c1ee
Completed: Aug 20, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 3 fresh / 0 reused groups · 5 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 39 deterministic / 5 contextual candidates · 3 contextual / 39 total behavior cases
Model budget: 3 model calls · 3 / 12 fresh cases · 103947 / 200000 estimated input · 78445 / 250000 actual input · 4504 / 40000 output tokens
Review batching: 3 model calls · up to 2 groups and 3 candidates per call · 1 retry call · 0 over-budget singleton calls
Review usage: 78445 input · 4504 output · 4080 cache read · 0 reasoning tokens
Report: fe1132acff9d2995e26faf15993b07ee9fde482aff114e7b6f95db26e2f87b1c