@ikevss/dsh-ima

For up to the 3-minute authorization window the browser exposes a CDP endpoint on 127.0.0.1:9333. Any local process can query /json/list and attach to the ima tab, read the ima login cookies stored in the plugin profile, drive the page, or replace the debug endpoint entirely - the code only reads /json/version and /json/list over that port and never verifies they belong to the process it just spawned, so a squatting local service could return a crafted webSocketDebuggerUrl and feed attacker-chosen clientId/apiKey that are then saved to credentials.json. The dedicated profile with the live ima

The single handler at path '/api/ima' dispatches purely on url.pathname (`const result = await fn(req, url)`) and never inspects req.method, Origin or Sec-Fetch-Site, and none of the routes carry a token. Because these are simple GET requests, any web page the user visits can fire them cross-origin without a preflight: /api/ima/unbind wipes the stored credentials and sets the revoked marker (denial of service requiring manual rebind), /api/ima/acquire spawns a Chrome with remote debugging, and /api/ima/bind overwrites the stored credentials. The read routes (knowledgeBases, media, mediaContent

The regex is not anchored to scheme/host, so a tab whose URL merely contains the string (e.g. https://evil.example/?ima.qq.com) is treated as the ima page. The plugin then runs fetch(QUERY_PATH, {credentials:'include'}) in that page's origin and forwards whatever {clientId, apiKey} comes back into credentials.json. A hostile page open in the plugin's dedicated profile while /api/ima/acquire runs could therefore plant credentials that all later agent tool calls would use.

Whenever the plugin's own credentials.json is absent or unreadable, loadCredentials() falls back to reading the ima skill's client_id/api_key files outside the plugin's storage area and uses that key for every tool and route call (sent only to ima.qq.com). /api/ima/adoptLocal additionally copies the key into the plugin's own store. This cross-application secret access happens without an explicit per-use consent, though the UI does surface it and notBound() mentions the location.

The list of knowledge-base names (including shared knowledge bases created by other people) is inserted unescaped into a user-role message that also contains tool-usage instructions and is re-injected into the conversation every 10 minutes. A knowledge base named with instruction-like text therefore reaches the model as trusted context on every step-1 of a conversation, an indirect prompt-injection surface into an agent that holds file-reading and search tools.