TavernKeeper Scan Report

MentallyQuill/Directive

Commit 2b4ba06 Reviewed Aug 12, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 23 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/hosts/sillytavern/preset-manager.mjs:15

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/time/time-advance-adjudicator.mjs:1

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/runtime/v1-accepted-pair-source.mjs:3

Deterministic technical evidence (17)

JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-journey.mjs:93
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-character-creator-assist-layout.mjs:201
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/helpers/fake-dom.mjs:82
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-episode-evaluator.mjs:260
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-evidence.mjs:398
JavaScript analysis reported javascript.xray.prototype-pollution · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

Source: src/runtime/state-delta-gateway.mjs:7
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: tools/scripts/test-expanded-interface-shell.mjs:92
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/capture-runtime-route-live.mjs:6
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/capture-runtime-route-live.mjs:6
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-duty-report-runtime.mjs:146
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/serve-expanded-interface-preview.mjs:56
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/serve-expanded-interface-preview.mjs:8
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-duty-report-planner.mjs:170
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-browser-runtime-safety.mjs:28
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-certified-ui-authority.mjs:10
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-mission-entry-capabilities.mjs:142
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: tools/scripts/test-v1-command-bearing.mjs:75

Contextual expected matches (3)

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · low confidence

This test script launches a local preview server and passes along the current environment settings. That's normal and not a security problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The scanner flagged passing process.env to a child process spawned via spawn() on line 59. In this tooling-only test script, this is standard practice to forward environment variables to the local preview server. No credentials are exfiltrated or logged; the environment is spread into the child's environment object for normal process operation. The scanner signal is a false positive in this context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: tooling
Source: tools/scripts/test-expanded-interface-visual-conformance.mjs:59

JavaScript analysis reported javascript.download-to-execution

Expected behavior · low confidence

This test script checks that a local preview server is running and then launches it. It only connects to its own computer, not the internet, and only runs its own code. There's no way for an attacker to exploit this.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner correlated a network retrieval primitive (fetch to localhost) with a code execution sink (spawn). The fetch is used to poll a local test server until it becomes available, and spawn runs a known local script (serve-expanded-interface-preview.mjs) in the same repository. There is no dynamic code execution from untrusted network data; the code path is entirely self-contained for testing. No vulnerability exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.download-to-execution
File role: tooling
Source: tools/scripts/test-expanded-interface-visual-conformance.mjs:47-508

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

This script is used by the developer to take screenshots of the SillyTavern extension's interface during testing. It opens a browser window to the local SillyTavern site, which is harmless and expected. The scanner warning about sending credentials over the network does not apply here.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network. The match applies to this repository.

Contextual assessment: The script capture-runtime-route-live.mjs is a developer tooling script that launches a headless browser and navigates to a SillyTavern instance using Chrome DevTools Protocol. Line 234 sends a Page.navigate command with a URL sourced from the environment variable SILLYTAVERN_BASE_URL or a localhost default. This is not credential exfiltration; it is an expected navigation to a controlled local host for UI screenshot capture. No credentials are transmitted, and the URL is not a credential source. The rule match is a false positive because the 'network sink' is a local debugging endpoint used for legitimate automation purposes.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role: tooling
Source: tools/scripts/capture-runtime-route-live.mjs:234

Coverage and limitations

Inventory: 865 files · 50117247 bytes
Contextual coverage: 23 of 23 candidates assessed

JavaScript coverage

Status: Complete
Candidates: 233 files · 2294515 bytes
X-Ray review families: 37 warning occurrences compacted to 21 evidence-preserving review families
Representations: 233 raw · 5 decoded · 0 normalized · 0 bundle modules
Stage scans: 233 raw signatures · 233 raw AST · 233 raw OpenGrep · 5 derived signatures · 0 derived AST · 5 derived OpenGrep

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.

Technical scan identity

Full commit: 2b4ba067c815be51eff662a2c0db5214f9c65434
Completed: Aug 12, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 1 fresh / 1 reused groups · 2 fresh / 1 reused candidates
Review source reports: 253550b1c11be5291aab0b2e013bfe80a6b428bd2420a71a25a179d4e24287e8
Evidence triage: 20 deterministic / 3 contextual candidates · 2 contextual / 20 total behavior cases
Model budget: 2 model calls · 1 / 12 fresh cases · 62437 / 200000 estimated input · 48664 / 250000 actual input · 3800 / 40000 output tokens
Review batching: 2 model calls · up to 1 groups and 2 candidates per call · 1 retry call · 0 over-budget singleton calls
Review usage: 48664 input · 3800 output · 0 cache read · 0 reasoning tokens
Report: 2572c0fd03706453e10ee928853af7a980f55d184826e0d777486bd2f174e816