🗑️ The original repository has been deleted or made private. This page is an archival snapshot from indexing time; the install command may no longer work.
Install verification: Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — the L1-L5 install ladder does not rate it; the security scan still runs.Install verification details →
What it does
DSH Grok Bot dispatch plugin (public). Private deploy config is not in this repo.
Installation
dsh plugin --profile web add github:semantic-craft/dsh-grokbot-dispatchInstall method: GitHub · runtime test inconclusive (L5 unknown)
Verification & Compatibility○ Ecosystem plugin
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
package manifest not collected — the declared range is unknown.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 |
|---|---|---|
| d4bc71 | ○ | ○ |
| 0d1f0b | · | · |
d4bc71github○ 2 ecosystem plugin2026-10-19
https://github.com/semantic-craft/dsh-grokbot-dispatch
○dsh 0.2.1-rc.2current2026-10-19Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/semantic-craft/dsh-grokbot-dispatch (version unstated)
ID: dsh-grokbot-dispatch@d4bc71@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
↳ carried from earlier record dsh-grokbot-dispatch@0d1f0b@dsh0.2.1-alpha.4 (l3-fullscan)
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.42026-10-18Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/semantic-craft/dsh-grokbot-dispatch (version unstated)
ID: dsh-grokbot-dispatch@d4bc71@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
↳ carried from earlier record dsh-grokbot-dispatch@0d1f0b@dsh0.2.1-alpha.4 (l3-fullscan)
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
0d1f0blocal2026-10-18
Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — its level reads L5 · Ecosystem plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-grokbot-dispatch/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic medium — stricter wins → overall medium.
—aef37460a8a9git2026-10-19aef37460a8a9same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (9)
- warningshellExec · shell
plugin/config.js:39const out = execFileSync(bin, ['status', '--json'], { timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'] }); - warningchildProcess · code-exec
plugin/core.js:224const child = spawn(cfg.dsh, ['--profile', cfg.profile, '--json', promptText], { cwd: spec.cwd, env, stdio: ['ignore', 'pipe', 'pipe'], deta - warningfsWrite · files
plugin/core.js:153fs.writeFileSync(tmp, JSON.stringify(job, null, 2), { mode: 0o600 }); - warningfsWrite · files
plugin/core.js:234fs.writeFileSync(path.join(store.dir, `${id}.events.jsonl`), stdout, { mode: 0o600 }); - warningfsWrite · files
plugin/index.js:313else { fs.mkdirSync(cfg.stateDir, { recursive: true, mode: 0o700 }); fs.writeFileSync(marker, String(process.pid), { mode: 0o600 }); } - warningfsWrite · files
plugin/job-map.js:61fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 }); - warningfsWrite · files
plugin/job-map.js:186fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() })); - warningfsWrite · files
plugin/log.js:19try { rotate(); fs.appendFileSync(file, line, { mode: 0o600 }); } catch {} - warningshellExec · shell
plugin/transport.js:49execFile(file, args, {
show 3 audit findings
- mediumInbound /v1/jobs lets the caller choose permission_mode; default is danger-full-access
plugin/core.js:40Any allowlisted tailnet peer (or whoever obtains the shared Bearer key) can POST /v1/jobs with arbitrary text and permission_mode='danger-full-access'; the session/agent then executes tool calls with full filesystem/network access and no approval prompts, in any ~/Projects child not matching the default /finance/i deny regex. The most permissive mode is both the default and never capped by a separate config gate, so a leaked key equals unrestricted code execution.
- lowUnauthenticated /health reachable from the bind IP discloses config diagnostics
plugin/index.js:138Any local process that connects to the tailnet bind address has remoteAddress == cfg.host and bypasses the Bearer check, reading health(): checkCompat errors/warnings (key file path, projectsRoot, peer keyFile paths), transport state and runner info. Useful reconnaissance for a local unprivileged process; no job data is exposed.
- lowShared key with no per-peer identity allows forging any job outcome and reading all mappings
plugin/index.js:172/v1/callbacks accepts a result for any 16-hex job_id and merges it into the persistent map with no check that the caller dispatched that job; /v1/job-map then returns every entry, including stored outbound task text. A single compromised allowlisted peer can overwrite another job's recorded state/result and read other dispatch contents.
Tailnet-only dispatch service with solid bind/allowlist/Bearer-key gating; residual risk is request-selected danger-full-access agent runs plus a minor local /health info leak.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-17 · activity: Active
• Repo created: 2026-10-15
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).