dsh-code-review

selection.js builds `title` from `git log -n 100 --format=%H%x09%s`, i.e. the raw commit subject of the repository under review, and request.js splices it unescaped into the task text that becomes the review sub-agent's prompt. Commit subjects are arbitrary attacker text in a cloned repository, so a malicious subject can carry instructions ('ignore the above, run X') directly at the instruction level of an agent that has file and shell tools. No user-typed input is required — only selecting a commit from the menu. Exploitation still depends on the sub-agent model complying, which is why this i

When the chosen ref cannot be resolved by `git rev-parse --verify --end-of-options` (typo or nonexistent branch), the free-form user ref is written into a runnable shell snippet that the sub-agent is told to execute; a value containing `$(` or backticks executes inside the double-quoted substitution. The actor here is the local user typing the ref, so it is largely self-inflicted, but an unvalidated string crossing into a shell template is still a hardening gap worth closing. Normal (resolvable) refs only reach prose, and git itself is never invoked through a shell by this plugin.

finding.path originates from the review model, which reads untrusted repository content and can be steered by it. Only `?`, `#`, `)` and `]` are neutralised; encodeURI leaves `:` and `=` intact, so a path such as `javascript:location.href=...` produces a link with that scheme inside the rendered report. Whether this is clickable/executable depends on the host's Markdown renderer, which is outside this plugin, hence low.