TavernKeeper Scan Report

willasaywhat/SillyTavern-Voicebox-TTS

Commit d80b3ae Reviewed Aug 26, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged link is a local address for a self-hosted voice tool running on the same machine, which is exactly what this extension is meant to connect to.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The scanner flagged the fixed URL literal at line 35 (provider_endpoint default). This is a localhost endpoint for a self-hosted TTS service. All network calls use this user-configurable endpoint and target only the Voicebox REST API (/profiles, /generate, /status, /audio). No credentials, API keys, or private content are sent anywhere beyond the user's own configured TTS endpoint. This matches the stated project purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: voicebox.js:35

Coverage and limitations

Inventory: 7 files · 20358 bytes
Contextual coverage: 1 of 1 candidates assessed

JavaScript coverage

Status: Complete
Candidates: 2 files · 14499 bytes
X-Ray review families: 2 warning occurrences compacted to 1 evidence-preserving review families
Representations: 2 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 2 raw signatures · 2 raw AST · 2 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — not-applicable
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.

Technical scan identity

Full commit: d80b3ae4cb584ad038f0f8314faa793fae65517b
Completed: Aug 26, 2026
History depth: 3 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 0 deterministic / 1 contextual candidates · 1 contextual / 1 total behavior cases
Model budget: 1 model call · 1 / 12 fresh cases · 20349 / 200000 estimated input · 15440 / 250000 actual input · 401 / 40000 output tokens
Review batching: 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 15440 input · 401 output · 0 cache read · 0 reasoning tokens
Report: 8df0bb9ab306010908b0b600b002f23c2ee0c411be087b68dca1b1828c4d2f37