SillyTavern Rolecard Security
Shared communication
Apply TW plain-language and guidance rules to user-facing work. Explain terms in context; preserve the user's chosen 新人/入门/熟练/老手 level without inferred changes. 新人 and 入门 receive detailed explanations; every level receives needed and bug explanations unless the user explicitly waives that scope. Soul and prose modes never disable this baseline. Load the shared reference for task entry, level management, or explanation decisions.
Use $consult-tavernweave-library with the sillytavern-rolecard-security route for the public XSS/security guide. Add A0 before any authorized remediation; a static guide or scan does not authorize executing suspicious content.
Treat rolecard content as an executable supply-chain surface. Scan read-only first,
then separate suspicious patterns from verified vulnerabilities.
Establish the boundary
- Record the exact files, artifact hashes, and exclusions.
- Separate model/user-controlled text, embedded markup, background helper scripts,
remote loaders, host extensions, and development tools.
- Never read or print credential values. Report only file, location, rule ID, and a
redacted explanation.
- Read rolecard-threat-model.md for trust
boundaries and security-findings-contract.md
for severity and baseline rules.
Run the static audit
node scripts/audit-rolecard-security.mjs target --report security-report.json
The scanner checks UTF-8 text and JSON for dangerous DOM sinks, dynamic execution,
remote JavaScript loaders, wildcard postMessage, executable URL schemes,
credential-shaped literals, suspicious iframe relaxation, and selected regex
backtracking shapes. It never evaluates the content.
Use --fail-on high, --fail-on medium, or --fail-on none to match the requested
gate. The default is high.
Compare an approved baseline
node scripts/check-security-baseline.mjs --current security-report.json --baseline approved-report.json
Fail when a rule count increases. Do not suppress a new finding by moving code,
renaming a file, or lowering severity locally.
Triage
For each finding:
- trace whether untrusted data can reach the sink;
- identify sanitization, escaping, CSP, sandbox, origin, and permission controls;
- distinguish embedded, host-required, remote-runtime, optional, and development-only
dependencies;
- route exact API claims to
$sillytavern-api-reference;
- route safe live reproduction to
$sillytavern-runtime-debug only when authorized.
Do not import the card, contact remote loaders, weaken sandboxing, or attempt an
exploit as part of the static audit.
Report
Lead with high and medium findings. Include the scanned hash set, rule counts,
baseline delta, false-positive candidates, unavailable live evidence, and a clear
release recommendation.
Resources
scripts/audit-rolecard-security.mjs: produce a redacted machine-readable report.scripts/check-security-baseline.mjs: reject new rule-count regressions.references/rolecard-threat-model.md: SillyTavern-specific trust boundaries.references/security-findings-contract.md: rule IDs, severity, and evidence rules.
1---2name: sillytavern-rolecard-security3description: Audit SillyTavern rolecard JSON, embedded HTML, regex replacements, Tavern Helper scripts, loaders, and related source for injection, dynamic execution, remote-code, wildcard messaging, credential-shape, and permission risks. Use for a read-only rolecard security review, a pre-import or pre-release safety gate, or comparison against an approved security baseline. Do not execute suspicious code, reveal secret values, perform exploitation, or auto-fix findings.4---56# SillyTavern Rolecard Security78<!-- tw-guidance-entry:begin -->9## Shared communication1011Apply [TW plain-language and guidance rules](../consult-tavernweave-library/references/communication-and-guidance.md) to user-facing work. Explain terms in context; preserve the user's chosen 新人/入门/熟练/老手 level without inferred changes. 新人 and 入门 receive detailed explanations; every level receives needed and bug explanations unless the user explicitly waives that scope. Soul and prose modes never disable this baseline. Load the shared reference for task entry, level management, or explanation decisions.12<!-- tw-guidance-entry:end -->1314Use `$consult-tavernweave-library` with the `sillytavern-rolecard-security` route for the public XSS/security guide. Add A0 before any authorized remediation; a static guide or scan does not authorize executing suspicious content.1516Treat rolecard content as an executable supply-chain surface. Scan read-only first,17then separate suspicious patterns from verified vulnerabilities.1819## Establish the boundary20211. Record the exact files, artifact hashes, and exclusions.222. Separate model/user-controlled text, embedded markup, background helper scripts,23 remote loaders, host extensions, and development tools.243. Never read or print credential values. Report only file, location, rule ID, and a25 redacted explanation.264. Read [rolecard-threat-model.md](references/rolecard-threat-model.md) for trust27 boundaries and [security-findings-contract.md](references/security-findings-contract.md)28 for severity and baseline rules.2930## Run the static audit3132```text33node scripts/audit-rolecard-security.mjs target --report security-report.json34```3536The scanner checks UTF-8 text and JSON for dangerous DOM sinks, dynamic execution,37remote JavaScript loaders, wildcard `postMessage`, executable URL schemes,38credential-shaped literals, suspicious iframe relaxation, and selected regex39backtracking shapes. It never evaluates the content.4041Use `--fail-on high`, `--fail-on medium`, or `--fail-on none` to match the requested42gate. The default is `high`.4344## Compare an approved baseline4546```text47node scripts/check-security-baseline.mjs --current security-report.json --baseline approved-report.json48```4950Fail when a rule count increases. Do not suppress a new finding by moving code,51renaming a file, or lowering severity locally.5253## Triage5455For each finding:56571. trace whether untrusted data can reach the sink;582. identify sanitization, escaping, CSP, sandbox, origin, and permission controls;593. distinguish embedded, host-required, remote-runtime, optional, and development-only60 dependencies;614. route exact API claims to `$sillytavern-api-reference`;625. route safe live reproduction to `$sillytavern-runtime-debug` only when authorized.6364Do not import the card, contact remote loaders, weaken sandboxing, or attempt an65exploit as part of the static audit.6667## Report6869Lead with high and medium findings. Include the scanned hash set, rule counts,70baseline delta, false-positive candidates, unavailable live evidence, and a clear71release recommendation.7273## Resources7475- `scripts/audit-rolecard-security.mjs`: produce a redacted machine-readable report.76- `scripts/check-security-baseline.mjs`: reject new rule-count regressions.77- `references/rolecard-threat-model.md`: SillyTavern-specific trust boundaries.78- `references/security-findings-contract.md`: rule IDs, severity, and evidence rules.
liarmttt