TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

SillyTavern/Extension-Weather

Commit c169a3c Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 4 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.shady-link

Minor caution · high confidence

The extension calls the AccuWeather weather service using an unencrypted web address, which means the user's API key could potentially be seen by someone monitoring network traffic. This is a minor security weakness, not a deliberate threat.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Use HTTPS endpoints for all AccuWeather API calls to prevent the API key from being transmitted in cleartext. AccuWeather's API supports HTTPS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/providers/accuweather.js:251
Contextual expected matches (1)

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged link is just a standard reference label identifying which JSON Schema version is being used. It is not a network call and does not send any data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
src/functions.js:20

Related contextual observations

Second JSON Schema $schema identifier in forecast schema

low risk · high confidence

A second occurrence of the same schema reference label appears in the forecast tool definition. It is equally harmless.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Additional HTTP (non-HTTPS) AccuWeather API calls with API key

low risk · high confidence

The same unencrypted API call pattern is used for fetching current weather and forecasts. The same minor weakness applies.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Switch these URLs to HTTPS as well.

Sources:

Coverage and limitations

Inventory
14 files · 114499 bytes
Contextual coverage
2 of 2 candidates assessed

JavaScript coverage

Status
Complete
Candidates
11 files · 75219 bytes
X-Ray review families
3 warning occurrences compacted to 2 evidence-preserving review families
Representations
11 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
11 raw signatures · 11 raw AST · 11 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
c169a3cacaefd032d2857417564e0330b516a1b3
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
2 fresh / 0 reused groups · 2 fresh / 0 reused candidates
Review source reports
none
Evidence triage
0 deterministic / 2 contextual candidates · 2 contextual / 2 total behavior cases
Model budget
1 model call · 2 / 12 fresh cases · 31251 / 200000 estimated input · 26399 / 250000 actual input · 2259 / 40000 output tokens
Review batching
1 model call · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
26399 input · 2259 output · 1472 cache read · 0 reasoning tokens
Report
1e2c859373f371b10bd00ecd9dfdfd634bccd74c1ddb9a882a69b332a3f1bd83