TavernKeeper Scan Report

zNe4/SillyTavern-ChromaticDialogue

Commit 00b1e9d Reviewed Oct 3, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 9 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: src/legacy-dialogue-scanner.js:24

Deterministic technical evidence (8)

JavaScript analysis reported javascript.xray.monkey-patch · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/message-runtime.test.mjs:525-527
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/proposal-parser.test.mjs:309
JavaScript analysis reported javascript.xray.obfuscated-code · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/panel-add.test.mjs:1
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/domain.test.mjs:61
JavaScript analysis reported javascript.xray.obfuscated-code · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/domain.test.mjs:1
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: test-documentation-data

Source: tests/regex-shell.test.mjs:44
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/pending-review-store.test.mjs:287
JavaScript analysis reported javascript.xray.obfuscated-code · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: tests/phase6-hardening.test.mjs:1

Coverage and limitations

Inventory: 109 files · 2422975 bytes
Contextual coverage: 9 of 9 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 87 files · 1525782 bytes
X-Ray review families: 10 warning occurrences compacted to 9 evidence-preserving review families
Representations: 87 raw · 21 decoded · 1 normalized · 0 bundle modules
Stage scans: 87 raw signatures · 87 raw AST · 87 raw OpenGrep · 22 derived signatures · 1 derived AST · 22 derived OpenGrep

Unresolved JavaScript stages

tests/regex-control-records.test.mjs — derived-ast / parse
tests/regex-control-records.test.mjs — normalize / parse
tests/regex-dialogue-display.test.mjs — derived-ast / parse
tests/regex-dialogue-display.test.mjs — normalize / parse
tests/regex-dialogue-display.test.mjs — normalize / unsupported

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — not-applicable
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 00b1e9d56593d97f259f162fb3bb8a0848417f40
Completed: Oct 3, 2026
History depth: 17 commits
Method: Deterministic evidence with contextual review
Reviewer: Not used — deterministic policy
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 0 fresh / 0 reused groups · 0 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 9 deterministic / 0 contextual candidates · 0 contextual / 8 total behavior cases
Model budget: 0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage: 0 input · 0 output · 0 cache read · 0 reasoning tokens
Report: a26dacc9b6dbc9d6f27acc0ac4c13f043f2c19d8e5d08bf86b1a5df8e3619ab6