TavernKeeper Scan Report

Jeka201216/Silly-Map

Commit 82967ea Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner saw an internet download next to code that updates the page and flagged it as suspicious. Here, the extension downloads a public list of available AI model names from OpenRouter to offer suggestions in a settings field. The downloaded names are added as plain suggestion values, not executed as code, and no user credentials are sent along with the request.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The candidate flags a co-occurrence of a network retrieval and a dynamic DOM/HTML sink, but the supplied source shows no data flow from the network response into an execution sink. The fetch hits OpenRouter's public, unauthenticated model-listing endpoint once per session, and the response is reduced to model identifier strings which are inserted solely as option value attributes on a datalist used for input suggestions. The nearby HTML-writing calls write static template content, not the fetched data. The adjacent API-key handling writes the key through SillyTavern's native secret-storage API to the host server, matching the extension's stated model-override purpose and the on-screen disclosure. No eval, command execution, or HTML injection of remote data is present in the supplied evidence, so the scanner correlation does not demonstrate exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:329-369

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity