TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

datacat-run/datacat-sillytavern-browser

Commit b5451c6 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 3 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (3)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test that makes sure a fake local address is blocked. It only exists to check that the extension's security rules work correctly. It does not send any data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/bridge_security.test.js:32

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test that makes sure an unencrypted version of the site is blocked. It only exists to check that the extension's security rules work correctly. It does not send any data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/bridge_security.test.js:29

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a test that makes sure 'localhost' is blocked. It only exists to check that the extension's security rules work correctly. It does not send any data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
test
Source
tests/bridge_security.test.js:31

Coverage and limitations

Inventory
13 files · 171340 bytes
Contextual coverage
3 of 3 candidates assessed

JavaScript coverage

Status
Complete
Candidates
4 files · 53026 bytes
Representations
4 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
4 raw signatures · 4 raw AST · 4 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
b5451c69fcb874fc966fca549be812cfdb4f4fe4
Completed
History depth
6 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner
0.1.0
Scanner policy
4
Rule catalog
1
Contextual policy
4
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
1 fresh / 0 reused groups · 3 fresh / 0 reused candidates
Review source reports
none
Review usage
38420 input · 4182 output · 0 cache read · 0 reasoning tokens
Report
203c6e5b168bfef216fd15cf132256a50b8386865b11604a2237aae8f6eaffa6