TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

Atlas4285/SillyTavern-ContextCompact

Commit f606b0d Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 41 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (35)

  • Dependency advisory GHSA-w5vr-8v7q-w6rv:pkg:f47d0f170b9adbf888ff8514 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-p498-v437-472g:pkg:ea60b14ff9b6948631f38822 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-f65p-4m7j-42xc:pkg:9b05fdf7b8c7389c52817bae applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-6j4f-fj2g-mc7p:pkg:7efd487b77ed76343c7e445e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-qhr7-859c-m2p7:pkg:7ff99bf6c6647fed08464ca3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:a6af0e9fdfc814bb2702c837 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-73wf-gq98-2v4g:pkg:6081c99555a9c657812a9448 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-h67p-54hq-rp68:pkg:0199d54d4e55594b20539f39 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-r28c-9q8g-f849:pkg:70fb8de3530fd7e78865a130 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:a2732cf17ea59b7c9ad7dcba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:e21c031ac1b5a36fba7dab3b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:f943bf04aa1d0078992a0950 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:38ebb15695df9277a6893d88 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:5b4aa5061dfdb1f92efc633d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-xwg4-73v4-xw9w:pkg:b0abe8c9840bfaafb5747f78 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-6g55-p6wh-862q:pkg:1462d68968dddb5a77b9811d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:56fd66430fa2724b4206a4ad applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-52cp-r559-cp3m:pkg:cf5cb3ae8e56cb4261cd5e98 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2883-xcg3-v3hh:pkg:00b0d10a50161bf371607a7b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:3c9cac5b1efe1960955c0ea1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-hrr3-gc8f-f4qj:pkg:7a468a269e455685464e5ff4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-qw65-cvwx-89v3:pkg:0aa70d0bfe17dc56547d7460 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-jqff-g426-hqxp:pkg:da58adda6c11ae873a70929a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-w9m9-85wc-3x92:pkg:ec01ad3435976a6b32fa3064 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-q2hr-2g5m-vwhr:pkg:da7ae0dc6dfdcfb10b537116 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

Contextual expected matches (6)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner flagged that the file both makes network requests and contains code-evaluation machinery. In reality, the network requests go only to SillyTavern's own chat-generation endpoints to count tokens, and the evaluation machinery is just standard build-tooling plumbing that runs the extension's own pre-packaged code. Nothing retrieved from the network is executed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The bundle contains a network primitive and a dynamic-evaluation-like construct, but the supplied code shows no data flow from network responses into code execution. The network code is a wrapper around the host fetch function that only intercepts same-origin SillyTavern generation endpoints, clones the response locally, and extracts token usage counts from the response body. The eval-like constructs come from the webpack bundle runtime (module registry and CSS style injection via style-loader), which evaluates bundled local modules, not retrieved content. No downloaded string is passed to any execution sink in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
generated
Source
dist/index.js:1

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner flagged a pattern that looked like a suspicious link. The actual code watches the extension's own copy of responses from the local SillyTavern server to count how many tokens were used, which the extension needs for its documented size-based compaction triggers. Nothing is sent to any outside location and no harmful behavior is present.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line parses server-sent-event stream chunks from responses to the host's own chat-completion and text-completion backend endpoints, filtering for data-prefixed lines to extract token usage counts. This is part of a fetch wrapper that only matches host-relative backend paths, clones the response without modifying it, and uses the extracted usage numbers to drive the documented compaction triggers. No external or suspicious destination is present, no data is sent anywhere additional, and the parsed content is used only as numeric usage metadata.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
dist/index.js:2114

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The scanner flagged code that packages data into a text format, suggesting possible capture of program or device information. In reality, the code only packages the extension's own chat summary (the condensed memory it creates) and inserts it into the prompt sent to the AI model, which is exactly what this extension is supposed to do. It does not touch settings, credentials, or any information about the user's computer, and it does not send anything anywhere other than into the local chat prompt.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged serialization call at the candidate location is a JSON.stringify invocation on the extension's own compaction memory object (a structure of situation text, event, fact, relationship, and thread lists). The resulting JSON string is substituted into a user-configurable injection prompt and passed to SillyTavern's local extension-prompt mechanism so the memory replaces covered chat history during generation. This is the documented core function of the extension. No host environment data, credentials, configuration stores, or navigator/global state is serialized; the only inputs are the extension-managed memory state and a user-editable prompt template. No network destination, persistence beyond chat metadata, or obfuscation is present in this data flow. The fetch wrapper shown in the expansion only clones responses to the SillyTavern generation endpoints to read token usage, which is separate from this candidate and consistent with the stated trigger-measurement purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.serialize-environment
File role
generated
Source
dist/index.js:2338

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner saw web addresses that looked unusual. They are actually just the addresses of SillyTavern's own internal generation endpoints, which the extension needs to watch in order to measure token usage, exactly as its documentation describes. No data is sent to any outside service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged link-like literals correspond to relative same-origin API endpoint paths for the host application's chat-completion and text-completion generation routes. These are the endpoints the extension's stated purpose requires it to observe for token usage, and the supplied code confirms requests are matched only against those local backend routes. No external or third-party destination appears in the supplied evidence, and no chat content, credentials, or tokens are forwarded anywhere by this code path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
dist/index.js:1

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The scanner saw both network code and dynamic-looking code in the same built file. Looking at the actual code, the network requests go to the SillyTavern app itself to read saved chats, and the dynamic-looking part is just standard build-tooling that inserts the extension's own stylesheet. Nothing downloaded from the network is ever executed as code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The flagged region is a webpack bundle containing style-loader CSS injection, chat-metadata memory state handling, and calls to the local SillyTavern backend endpoints for reading and verifying saved chats. The network calls use the host's own request-header helper and target host-relative API paths; no evidence shows a retrieved payload being passed into an eval, Function, script injection, or command execution sink. The apparent execution sink is the bundler's module loader and CSS style-tag insertion, which operate on bundled, non-network-derived content. There is no download-to-execution data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
generated
Source
dist/index.js:17-644

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The scanner noticed the extension reading information about its environment. It reads the browser's language setting and looks up its own on-screen controls so it can display dates and messages in the right language. None of this information is collected or sent anywhere; it stays inside the app on the user's own machine.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The signal arises from reads of ambient browser and host state, such as the global fetch reference, the document object for UI controls, and the interface language selector plus navigator language fallback for localized formatting. The values read are used locally for endpoint matching, DOM control lookup, and date formatting; none are serialized into an outbound request or persisted outside the host application's normal extension settings. This matches the extension's visible settings UI and documented localization behavior, and no credential or environment data flow to any external destination is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.serialize-environment
File role
generated
Source
dist/index.js:1

Coverage and limitations

Inventory
35 files · 436721 bytes
Contextual coverage
41 of 41 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
21 files · 210559 bytes
X-Ray review families
6 warning occurrences compacted to 4 evidence-preserving review families
Representations
21 raw · 0 decoded · 1 normalized · 0 bundle modules
Stage scans
21 raw signatures · 5 raw AST · 21 raw OpenGrep · 1 derived signatures · 1 derived AST · 1 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
f606b0d77c6a54db05a83650e680b65d8d192a2f
Completed
History depth
2 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
4 fresh / 0 reused groups · 6 fresh / 0 reused candidates
Review source reports
none
Evidence triage
35 deterministic / 6 contextual candidates · 4 contextual / 9 total behavior cases
Model budget
3 model calls · 4 / 12 fresh cases · 105400 / 200000 estimated input · 86144 / 250000 actual input · 3127 / 40000 output tokens
Review batching
3 model calls · up to 2 groups and 3 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
86144 input · 3127 output · 1360 cache read · 859 reasoning tokens
Report
a0b98d09087a8b528f93d3591d405a5236767389997acdebecda594f053ec571