TavernKeeper Scan Report

leandrojofre/SillyTavern-Mathcros

Commit 9c12b14 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 9 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
public/bundle.min.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:47

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
public/bundle.min.js:1902

zizmor reported archived-uses

Minor caution · high confidence

The release workflow uses an outdated GitHub action that is no longer maintained. This is a maintenance issue rather than a security threat. It does not put users of the extension at risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule archived-uses. The match applies to this repository.

Contextual assessment: The workflow references a deprecated GitHub-provided release action pinned to a major version tag rather than a commit SHA. This is a maintenance and supply-chain hygiene concern: the action is no longer maintained and major-version tags can move. No attacker-controlled input reaches the action in a way that causes concrete harm, and the token used is the standard scoped GitHub Actions token. No exfiltration, persistence, or code execution beyond normal release automation is demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Replace the deprecated release action with a maintained alternative or the GitHub CLI release command, and consider pinning actions to commit SHAs.

Scanner
zizmor 1.28.0
Rule
archived-uses
File role
tooling
Source
.github/workflows/release.yml:70
Deterministic technical evidence (3)
  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:21-24

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:70

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:22

Related contextual observations

Checkout pinned to major version tag

low risk · high confidence

The workflow checks out code using a movable version label instead of a fixed reference. This is a minor best-practice issue, not an active security problem.

Technical assessment

The checkout step uses a major version tag instead of a commit SHA, which is a common supply-chain hygiene weakness. No attacker-controlled data flow is demonstrated here.

Impact: low · Exploitability: unlikely

Developer action: Pin actions to immutable commit SHAs for reproducibility.

Sources:

Token written to filesystem

low risk · medium confidence

The workflow briefly saves a GitHub token to a file on a temporary build machine. This is not ideal practice but does not expose the token to outside parties.

Technical assessment

A step writes the GitHub token to a file on the runner. The token is the standard scoped Actions token and the runner is ephemeral, so this is a hygiene issue rather than a demonstrated exposure.

Impact: low · Exploitability: unlikely

Developer action: Avoid writing tokens to disk; pass them through environment variables only.

Sources:

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity