SillyTavern Rolecard Security

Shared communication

Apply TW plain-language and guidance rules: explain terms on first use, keep the user-selected 新人/入门/熟练/老手 level, and still explain needed changes and bugs at every level. Soul and prose modes never disable this baseline.

Plugin runtime

When this Skill runs through a plugin, cloud host, or remote machine, read the plugin execution contract at entry and apply its host, tool, and persistence checks before host-specific commands. Keep this Skill's scope, authorization, and acceptance gates.

Use $consult-tavernweave-library with the sillytavern-rolecard-security route for the public XSS/security guide. Add A0 before any authorized remediation; a static guide or scan does not authorize executing suspicious content.

Treat rolecard content as an executable supply-chain surface. Scan read-only first, then separate suspicious patterns from verified vulnerabilities.