TavernKeeper Scan Report

Jeka201216/Silly-Map

Commit a632eb8 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The security scanner saw that the extension can download data from the internet and also has some powerful JavaScript features, but that doesn't mean it's dangerous. The extension only makes calls to an AI service (OpenRouter) to help direct the story, and it does not run downloaded code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.

Contextual assessment: The scanner flagged the file for containing both network retrieval and a potential code execution sink. The cited lines (324–374) include a jQuery click handler and a fetch call to OpenRouter's API. The fetch response is used as text in the AI director function and is never passed to eval, new Function, or any dynamic execution primitive. The file also uses jQuery's .html() with hardcoded template strings, which does not introduce code execution. No actual dynamic code execution sink is present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:324-374

Related contextual observations

Scanner false positive: network retrieval without executable sink

low risk · high confidence

The automated scan flagged this as risky because it saw both downloading data and powerful JavaScript features, but a human check shows the data is only used for generating story text, not for running code.

Technical assessment

The scanner rule 'javascript.download-to-execution' correlates the presence of fetch with any dynamic execution primitive in the same file. In this extension, the fetch to OpenRouter is a legitimate API call for the AI Director feature. The response is consumed as text and never executed. The file does not contain eval, new Function, innerHTML with user-controlled data, or other code execution sinks. The scanner's correlation is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity