TavernKeeper Scan Report

p-e-w/sorcery

Commit 77b885b Reviewed

No material or high-risk concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 0 material 1 low

What this review found

No material or high-risk item was identified.

Expected scanner matches (1)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This code runs JavaScript that the user wrote themselves in the extension's settings. That is exactly what the extension is designed to do, so it is not hidden or unexpected behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The candidate uses the Function constructor to execute a JavaScript string. The string comes from script.javascript, which is user-authored configuration managed through the extension's settings UI. Executing arbitrary user-configured JavaScript is the extension's core documented purpose, as stated in the project README, and the model can only select among preconfigured scripts rather than supply its own code. The supplied evidence shows no hidden data flow, obfuscation, or external destination beyond the intended local execution of user-defined scripts.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
main.js:103

Coverage and limitations

Tools

Limitations

Technical scan identity