dsh-md-picker

When an operator sets config.token to harden LAN exposure, any client that can reach the GUI origin can simply GET /dsh-md-picker/client.js and read the token, then use it as X-Dsh-Md-Picker-Token. The token check therefore provides no protection against a network attacker, who can still write files into the agent workspace.

With the default empty token, any client that can reach the web server (e.g. an instance bound to the LAN) can POST arbitrary bytes to /store or /convert; the content is written to <workspace>/md-picker-attachments, and the target workspace is chosen from the caller-supplied X-Session-Id (or the most-recently-used one). Those files are exactly the ones the agent later reads with its file tools, so this is an unauthenticated content-injection path into agent context, not just a disk-write.

Every convert request runs `npx -y @firecrawl/anydoc` with the DSH host's privileges. There is no version pin and no integrity check, so a compromised or republished npm package (or an npm/name-resolution issue) leads to arbitrary code execution on the host, triggered by a plain upload; the processed document is attacker-influenced input handed to that third-party code.

The token is substituted raw into `var TOKEN = "__DMP_TOKEN__"` in lib/client.js, which runs on the DSH GUI origin. A token containing a quote, backslash or newline breaks out of the literal and can turn operator configuration into script injection on the harness origin. The value comes from host configuration, so this is a hardening gap rather than an attacker-reachable path.

The static scanner's shell-execution alert is not attacker-reachable today: input/output are fixed names (input.<ext>/output.md) inside a fresh mkdtemp directory, the extension is restricted to [a-zA-Z0-9]{1,10}, and the user filename never enters the command line. Residual assumption: the os.tmpdir() prefix is only wrapped in double quotes, so a temp path containing '"', '%' or a trailing backslash would be re-parsed by cmd.exe. On POSIX, timeout handling kills only the npx process, not its children.