dsh-plugin-ChronoAgent

Once the user turns on allowShell, the command string comes straight from the LLM tool call and is not validated, allow-listed or escaped; any content the agent reads or fetches (web pages, files) can steer it into running arbitrary commands with the user's privileges. The tool is only added to the tool list when allowShell is true, and the setting defaults to false and is labelled 'dangerous', so exploitation needs that explicit opt-in as a precondition.

read_file/write_file/list_files have no workspace confinement and no write toggle; the model (again steerable through injected web/file content) can read secrets such as ~/.ssh or credential files, or overwrite persistence paths (shell rc files, autostart entries, the app's own data.json) with the user's privileges. Only a size cap and a binary check apply.

Memory entries hold up to 2000 chars of previous task results, which can include attacker-supplied web content, and are re-injected as a user message on every later run with the same tool privileges. A single malicious fetch can therefore persist instructions across runs. Impact is limited because the text is prefixed as reference-only and the sources are the agent's own prior runs.