TavernKeeper Scan Report

tavern-rpg-suite/Tavern-Doors

Commit 7108d04 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches data from an AI model API to produce summaries of roleplay scenes, which is exactly its stated purpose. No evidence of downloading and running hidden code was found in the provided source. The scanner's alert appears to be a broad pattern match that does not correspond to any dangerous behavior visible in the code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The scanner flagged a correlation between a network retrieval primitive and a code execution sink across lines 273-917. The visible network retrieval is the callAI function, which uses fetch to POST to an OpenAI-compatible /chat/completions endpoint whose URL is derived from user-configured settings (settings.baseUrl) or borrowed from neighboring extension settings, consistent with the extension's stated purpose of arc summarization. The response is parsed as JSON and only the text content of the model output is extracted and stored. No eval, Function constructor, innerHTML assignment from network data, or other dynamic code execution sink is present in the supplied source. The only setTimeout usage is a benign delay promise. The scanner's wide-range correlation does not identify a concrete execution sink or a data flow from fetch output into code execution. The fetch destination and API key usage are proportionate to the extension's documented summarization feature and are visible in the extension's settings UI.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
index.js:273-917

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity