TavernKeeper Scan Report

sewerzone/SillyTavern-SillyToast

Commit 1bceed6 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 5 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (1)
  • JavaScript analysis reported javascript.xray.sql-injection · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: javascript-xray-structured-weakness · Execution scope: runtime

    Source: index.js:1945

Contextual expected matches (2)

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The code is plainly written and easy to follow. It manages the extension's saved settings and notification history using SillyTavern's built-in storage. There is no hidden or malicious behavior.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner flagged an obfuscated-code signal on line 1, but the supplied source is clear, well-structured JavaScript with standard imports and extensive inline documentation. It defines a Settings class that reads and writes SillyTavern extension_settings, normalizes saved configuration, and manages toast history, themes, animations, and sound presets. No obfuscation, hidden execution, credential access, or external network calls are present. Data stays within the local SillyTavern settings persistence mechanism, which matches the stated purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/Settings.js:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The code is clearly written and easy to read, with no hidden or scrambled behavior. The scanner alert is a false positive; the file simply imports SillyTavern modules and sets up a notification history extension.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The scanner flagged an obfuscated-code signal on line 1, but the supplied source is plain, readable, well-commented JavaScript with standard ES module imports and no obfuscation, encoding, or concealed execution. The visible code implements toast notification history, theming, animation, and sound features consistent with the stated project purpose. No obfuscated payload, hidden eval, credential access, or exfiltration data flow is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
index.js:1

Related contextual observations

Readable, non-obfuscated entry point with standard imports

low risk · high confidence

The file is straightforward JavaScript that imports the tools it needs and sets up the extension. Nothing is hidden or scrambled.

Technical assessment

The file begins with standard ES module imports from SillyTavern extension APIs and defines readable constants and helper functions for toast theming and animation. No obfuscation indicators are present in the supplied source.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Readable settings module with no obfuscation

low risk · high confidence

The settings file is clean and well-organized. It stores and validates the extension's preferences using SillyTavern's standard settings system.

Technical assessment

The file opens with standard ES module imports and defines clearly named default constants, normalization functions, and a Settings class using extension_settings and saveSettingsDebounced. No obfuscation, encoded payloads, or suspicious data flows are present.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity