TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

l1kiru/SillyTavern-LorebookAtlas

Commit 7afe0a4 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 7 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (7)

  • JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: test/filenames.test.js:9

  • JavaScript analysis reported javascript.xray.short-identifiers · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: test/manifest.test.js:1

  • JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: test/lists.test.js:125

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:11

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:11

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:8-18

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/test.yml:12

Coverage and limitations

Inventory
56 files · 383168 bytes
Contextual coverage
7 of 7 candidates assessed

JavaScript coverage

Status
Complete
Candidates
47 files · 336897 bytes
X-Ray review families
3 warning occurrences compacted to 3 evidence-preserving review families
Representations
47 raw · 1 decoded · 0 normalized · 0 bundle modules
Stage scans
47 raw signatures · 47 raw AST · 47 raw OpenGrep · 1 derived signatures · 0 derived AST · 1 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
7afe0a45b214eb68514f104666a62191a1f6b4f9
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
Not used — deterministic policy
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
0 fresh / 0 reused groups · 0 fresh / 0 reused candidates
Review source reports
none
Evidence triage
7 deterministic / 0 contextual candidates · 0 contextual / 4 total behavior cases
Model budget
0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage
0 input · 0 output · 0 cache read · 0 reasoning tokens
Report
2ed11e6e9eb0592d5f1450f7a75bf840ceeb57e0185628389e64c420ba0d4186