@xienda/dsh-jev-verify

The handler never authenticates the caller and never checks Origin or Content-Type; it accepts any POST, parses JSON and issues a real System One call using the plugin's configured API key with attacker-chosen state/model, then returns the answers as JSON. A local process, or a cross-origin page using a content-type-less 'simple' POST (which bypasses CORS preflight), can burn the user's TypeSafe credits and use the endpoint as an oracle. Requires the opt-in dashboard.enabled=true (default false).

This route is registered even when dashboard.enabled is false, and the handler ignores the request object entirely. Any local process can read the machine's measured calls, token counts, cost, guard statistics and the user-declared balance. Cross-origin reads are blocked only by the absence of CORS headers, so the practical exposure is local/in-process.

bench/ is part of the published files[] list, so this debug script ships to every consumer. It discloses the author's Windows username and credential-store location, and reads the TypeSafe API key from that fixed foreign path. It is never imported by the host runtime and fails harmlessly elsewhere, so impact is information disclosure and a credential-handling hygiene problem rather than a live exploit.

answerChoice() only requires a non-empty string, so an arbitrary choice value returned by the configured baseURL is concatenated raw (no length cap, no allow-list) into a plugin-sourced user message that is appended to the agent's message list. With a hostile or compromised baseURL this is a path from remote data to agent instructions; the recommended tool name itself is allow-listed via TOOL_LABELS.