A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
This is a developer tool that tests code snippets from the project's own files to generate help documentation. It doesn't access user data or the internet and is not included in the extension users install.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval on line 90 is used in a build script to test whether gathered lines of slash command registrations form valid JavaScript. It reads only from local repository source files (no network or user input) and is not part of the shipped extension runtime. The purpose is to generate documentation, making this dynamic execution proportionate to the stated task.
This script reads the project's own JavaScript source and uses eval to understand its command definitions, then writes the README automatically. The eval runs only on the project's own code, so it's not a security problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-stmt in this repository.
Contextual assessment: The eval(cmd) at line 90 of file executes JavaScript code that has been assembled from lines of the project's own file file. The cmd variable is built from a controlled set of lines matching SlashCommandParser.addCommandObject calls; no user or external input is involved. The overall script also uses new Script(allTxt).runInThisContext() at line 147 to run the concatenated project source with mocked dependencies in order to extract command metadata for README generation. Both dynamic execution points operate exclusively on project-owned source code and are part of a build/dev tool, not a runtime component.
Impact: none · Exploitability: unlikely
Developer action: Consider using a safer parsing technique or structured code analysis, but the current approach is acceptable for a build-time tool and does not introduce security risk.
The extension fetches its own help file from the server to show documentation, not from the internet. It doesn't run any code from that file. The security alert was a false alarm because the two features (fetching and running commands) are used separately.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The scanner correlates a 'network retrieval' (fetch) with a 'code execution sink' (executeSlashCommands). The fetch in the /lalib? command retrieves a local README.md file from the extension's own directory, not an attacker-controlled URL. The fetched content is converted to HTML and displayed via sendSystemMessage, not executed as code. executeSlashCommands elsewhere in the file runs user-provided slash commands, but the fetch does not supply any input to that sink. No unsafe data flow is demonstrated.
This script reads the project's own source code to automatically create help documentation. The use of eval here is only on data from the project's own files, not on anything a user could inject, so it's safe in context.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.python-eval-or-shell in this repository.
Contextual assessment: The eval(arg) call at line 101 operates on string data extracted from the project's own file source file via regex. The arg variable is built from a controlled subset of the project's source code; no user or external input reaches this eval. This is a build-time script that auto-generates README documentation by parsing slash command registration objects. The use of eval is a convenience for converting the captured Python-dict-like string into an actual dictionary, but the input is entirely project-owned and not attacker-controllable.
Impact: none · Exploitability: unlikely
Developer action: Consider replacing eval with a safer parsing approach like ast.literal_eval for robustness, but the current usage is not a security risk.
This is part of the same developer tool that runs project code in a sandbox to generate documentation. It does not interact with user input or external resources.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The vm.Script execution on line 147 runs assembled code in the same Node.js context to extract command metadata for README generation. All input originates from local repository files; no attacker-controlled data reaches this execution path. This is a development-time tool, not runtime extension code.
The code is written normally and clearly, not hidden or scrambled. The security scanner's alert about obfuscation was incorrect.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The scanner signal 'obfuscated-code' is a false positive. The provided source code is plain, readable JavaScript with standard imports and helper functions. There is no encoding, minification, or concealment that would hide malicious logic. The low scanner confidence and clear code confirm this is legitimate extension behavior.
Same as above: the script uses eval only on its own source code to build the README, so there is no security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.python-eval-or-shell in this repository.
Contextual assessment: The eval(arg) call at line 104 is identical in nature to line 101, operating on project-controlled source code strings. No user input reaches this eval. Same build-time documentation generation purpose.
Impact: none · Exploitability: unlikely
Developer action: Same recommendation as for line 101: consider ast.literal_eval for improved code quality, but no security fix needed.