TavernKeeper Scan Report

kaldigo/SillyTavern-Tracker

Commit 65e0acb Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (1)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension has a settings field where users can type their own JavaScript to customize how the tracker works. It runs that code using a standard JavaScript mechanism. This is an intentional feature of the extension and the user who types the code is the one affected by it.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: No change required for the core feature. Consider adding a visible warning near the mesTrackerJavascript field and when importing presets that contain JavaScript, so users understand the field executes code and shared presets may include executable content.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
src/settings/settings.js:613

Related contextual observations

Imported presets can carry executable JavaScript without warning

low risk · high confidence

Detailed wording was omitted by the public report safety filter.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Consider showing a confirmation or warning dialog when an imported preset contains a non-empty mesTrackerJavascript value, so users are alerted before executable code from a shared file runs.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity