No material or immediate-danger item was identified.
Expected scanner matches (13)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that reads the extension's own source code, pulls out stored text constants using pattern matching, and evaluates them to check that old version upgrades work. The code being run comes from the project itself, not from anything a user or attacker could control. This is a normal testing technique.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function()` call in a test file (file). The argument to the dynamic function constructor is a regex-extracted constant definition from the project's own source code (SRC), specifically a frozen legacy prompt string. The evaluated data originates entirely from the extension's own committed source, not from user input, network data, or external sources. The purpose is to verify that legacy prompt constants are extractable and that migration predicates work correctly. No attacker-controlled input reaches this code path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:686
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that reads the extension's own code, pulls out text constants, and checks them. The dynamic execution only runs on the extension's own committed text, not on anything a user or attacker could control.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness file uses new Function to evaluate a regex-extracted string constant (HOOK_LINE) from the extension's own source code. The regex capture originates from committed source, not external or user-controlled input. The evaluated value is a string literal used to reconstruct prompt constants for migration-logic assertions. No network, credential, or persistence side effects are present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:665
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test reads a text constant from the extension's own code and evaluates it to verify that old saved prompts can be correctly identified and upgraded. No outside input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness reconstructs the frozen V265 prompt constant by evaluating a regex-extracted array-literal expression from the extension's own source. The input to new Function is a captured source-code fragment matching a specific array-join pattern, not external data. The result is used solely for SHA-256 hash verification and migration-predicate assertions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:685
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test pulls a stored text constant out of the extension's own code and checks it. Nothing from outside the codebase is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness reconstructs the frozen V263 prompt constant by evaluating a regex-extracted array-literal expression from the extension's own source. The captured fragment is a committed source constant, not user or network input. The evaluated result feeds only into migration-predicate and text-content assertions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:652
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test reads a text constant from the extension's own code and evaluates it to confirm old prompts are preserved exactly. No external input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness reconstructs the frozen V264 prompt constant by evaluating a regex-extracted array-literal expression from the extension's own source. The input is a committed source-code fragment matched by a specific regex pattern. The result is used for SHA-256 pin verification and migration-predicate tests.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:666
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is the same testing pattern: the test file extracts a code constant from the extension's own source and evaluates it to set up a test. Nothing a user or attacker can influence is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is another `new Function()` call in the same test file, constructing a function from a regex-extracted hook definition (hookM[1]) sourced from the project's own source code. The evaluated expression is a committed constant in the extension source, not user-supplied or network-derived data. It is used to build a HOOK6 value that is then passed into a subsequent test evaluation. No external or attacker-controlled input reaches this path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:706
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test extracts a text constant from the extension's own code and checks that old saved prompts will be correctly recognized for upgrade. No outside data is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness reconstructs the frozen V262 prompt constant by evaluating a regex-extracted array-literal expression from the extension's own source, passing the previously extracted HOOK_LINE constant as an argument. Both inputs are committed source-code fragments. The result is used for migration-predicate assertions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:607
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Same as the other two: the test file pulls a stored text constant out of the extension's own source code and evaluates it to verify that version migration and hash checks pass. No user or attacker input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is a `new Function()` call that evaluates a regex-extracted legacy prompt constant (v266M[1]) from the project's own source code, passing in the HOOK6 value built from the prior candidate. The data flow is entirely internal to the test file and the extension's committed source. The result is used to verify SHA-256 hash pinning and migration predicate behavior. No external input reaches this evaluation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:707
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a word that looks like it could be an API key, but it is actually just the name of a built-in SillyTavern prompt slot. It is not a password or secret of any kind.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the string literal '2_floating_prompt' on line 5163. This is not a credential; it is a well-known SillyTavern extension-prompt identifier used as a comparison key to skip that entry while iterating over extensionPrompts in the memoryReport function. No secret value is present, and the string is a hardcoded constant with no data flow to any external service or authentication mechanism.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- index.js:5163
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test reads a text constant from the extension's own code so it can be reused in later checks. Nothing from outside the codebase is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness extracts the HOOK_LINE string constant from the extension's own source via regex and evaluates it with new Function. The captured fragment is a single-quoted string literal from committed source, not external input. The result is passed as an argument to subsequent constant reconstructions for migration testing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:606
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a word in the code that looks like it could be a secret, but it is actually just the name of a built-in SillyTavern prompt slot being checked so the extension can skip it. There is no password or API key here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched a string literal on line 3878. The surrounding code is a memory-report function that iterates over SillyTavern extension prompts and compares each prompt's key name against a known internal key identifier to skip it. The matched value is a hardcoded key-name string used in an equality comparison, not a credential, token, or secret. No credential is assigned, transmitted, persisted, or used for authentication.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- index.js:3878
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test reads a text constant from the extension's own code to use in later verification checks. No external or user-controlled input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness re-extracts the HOOK_LINE string constant from the extension's own source via regex and evaluates it with new Function. The input is a committed source-code string literal. The result is used as an argument for reconstructing the V263 frozen prompt constant in migration tests.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:651
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test reads the extension's current default prompt text from its own code and checks it against older versions. No outside data is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test harness reconstructs the DEFAULT_DIRECTOR_PROMPT constant by evaluating a regex-extracted array-literal expression from the extension's own source, passing the extracted HOOK_LINE constant as an argument. Both inputs are committed source-code fragments. The result is used for migration-predicate and default-content assertions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- load_test.mjs:608