TavernKeeper Scan Report

p-e-w/sorcery

Commit 77b885b Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Contextual expected matches (2)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The flagged line executes JavaScript, but the code comes from scripts the user writes and saves in the extension's settings. The AI cannot provide its own code to run; it can only trigger scripts the user already configured. This is the extension's intended purpose, clearly described in its documentation.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The OpenGrep rule flags `Function(javascript)()` at line 103 as dynamic JavaScript execution. Tracing the data flow: `runJavaScript` is called from `runScript` (line 120) with `script.javascript`, where `script` is an object from `enabledScripts` — a filtered subset of `settings.scripts`. These script objects are created and edited by the user through the extension UI (lines 241-290), with the JavaScript field populated via textarea input (lines 283-286). The AI model's only contribution is emitting markers containing a numeric script ID (line 137), which selects which pre-configured script to run. No model-generated text is passed to `Function()`. This dynamic execution is the explicitly stated purpose of the extension (binding user-written code to model-triggered events) and is fully disclosed in the README.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
main.js:103

JavaScript analysis reported javascript.xray.unsafe-stmt

Expected behavior · high confidence

This extension is designed to run JavaScript code that the user writes and configures. The code being executed is the user's own, entered through the extension's settings UI. The AI model can only choose which pre-written script to trigger, not supply new code. This is the extension's intended feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-stmt. The match applies to this repository.

Contextual assessment: The scanner flags line 103 (`Function(javascript)()`) as dynamic execution. However, the `javascript` argument originates entirely from user-authored scripts stored in extension settings (populated via the settings UI at lines 283-286 and 288-290). The AI model does not supply JavaScript code; it only emits markers containing a script ID (parsed at line 137), which selects a pre-configured script object from `enabledScripts`. The model's output never reaches `runJavaScript` as a code string. This is the core, stated functionality of the extension: executing user-written code in response to model-emitted event markers. The capability is disclosed in the README and visible in the UI.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-stmt
File role
production
Source
main.js:103

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity