Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it does
百通官方DSH插件市场
Installation
dsh plugin --profile web add @baitongserver/dsh-plugin-marketInstall method: npm · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 |
|---|---|---|
| 0.1.17 | · | · |
| 0.1.11 | ✓ | ✓ |
0.1.17npm2026-10-21
@baitongserver/dsh-plugin-market
No runtime install test for this version (static scan only) — compatibility unknown, never assumed.
0.1.11npm✓ 2 runtime-verified2026-10-19
@baitongserver/dsh-plugin-market
✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: npm · @baitongserver/dsh-plugin-market@0.1.11
ID: dsh-plugin-market-30@0.1.11@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-18L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: npm · @baitongserver/dsh-plugin-market@0.1.11
ID: dsh-plugin-market-30@0.1.11@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
↳ carried from earlier record dsh-plugin-market-30@0.1.17@dsh0.2.1-rc.2 (l3-fullscan)
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-plugin-market-30/)``[](https://www.dsh.so/artifact/dsh-plugin-market-30/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v0.1.17dsh manifest0.1.17npm2026-10-210.1.17same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (10)
- warningchildProcess · code-exec
lib/dsh-cli.js:1315return spawn(file, [...args], { ...spawnOptions, shell: false }); - warningchildProcess · code-exec
lib/dsh-cli.js:1318return spawn(comspec, ['/d', '/s', '/c', `"${cmdCommandLine([file, ...args])}"`], { - warningnetIp · network
lib/host.js:23apiBase: Schema.string().default(envApiBase() ?? DEFAULT_API_BASE).description(`百通 API 根地址（不含 /api）；本地联调设环境变量 BAITONG_API_BASE，如 http://127. - warningchildProcess · code-exec
lib/local-api.js:25const r = spawnSync(cmd, args, { timeout: 500, encoding: 'utf8', shell: process.platform === 'win32' }); - warningchildProcess · code-exec
lib/local-api.js:516const child = spawn(bin, args, { detached: true, stdio: 'ignore' }); - warningchildProcess · code-exec
lib/local-api.js:731const child = spawn(bin, args, { detached: true, stdio: 'ignore' }); - warningnetIp · network
lib/local-api.js:80const url = new URL(req.url || '/', 'http://127.0.0.1'); - warningnetIp · network
lib/local-api.js:1002const url = new URL(req.url || '/', 'http://127.0.0.1'); - warningchildProcess · code-exec
lib/restart.js:161const child = spawn(${JSON.stringify(isDshEntry ? node : 'dsh')}, ${JSON.stringify(isDshEntry ? [...process.execArgv, entry, 'web', '--port' - warningchildProcess · code-exec
lib/restart.js:170const helper = spawn(node, ['-e', helperScript], {
show 5 audit findings
- highUnauthenticated /baitong-market API performs privileged install, uninstall, config-write and restart
lib/local-api.js:11The handler dispatches install/uninstall/config/restart purely on a caller-supplied `method`, with no token and no Origin check. readBody ignores Content-Type, so a malicious page can send a simple cross-origin POST (content-type text/plain, mode no-cors) with a JSON body, or use a GET with ?method=… . `method=config&save=true` rewrites the overlay (apiBase/skillsDir); subsequent pluginInstall then fetches the install plan from the attacker-chosen apiBase and runs `pnpm add <source>`. Uninstall/restart give DoS. The only guard, trustedRestartRequest(), accepts any request carrying a Sec-Fetch-
- mediumAutomatically writes dangerouslyAllowAllBuilds: true, permanently disabling pnpm build-script sandbox
lib/dsh-cli.jsWhen an install hits a prepare/build-script block, addDshPlugin calls writeDangerouslyAllowAllBuilds, persisting a profile-wide flag in pnpm-workspace.yaml. From then on every dependency's postinstall/prepare script in that profile runs unsandboxed, so a later malicious or compromised package gains full code execution without any further prompt.
- lowTARGET_RE `#-+` is a character range that unintentionally admits & % ' ( ) * in install targets
lib/dsh-cli.jsThe class intends to blocklist shell metacharacters, but `#-+` is parsed as a range covering # $ % & ' ( ) * +, so `&`, `%`, quotes and parens pass validation. On Windows spawnShim routes the target through cmd.exe (/d /s /c) and %VAR% expansion still happens inside double quotes, so if the install source is attacker-controlled (e.g. an install plan from a redirectable apiBase) the last defence before the command line is weaker than intended.
- lowIcon proxy fetches an arbitrary https URL and returns the body with a caller-chosen content type
lib/local-api.jshandleIcon resolves any https URL (or relative path against apiBase) and returns the raw body, forcing the header to image/png when the upstream is not an image. This gives an SSRF/relay surface against internal https services reachable from the host and lets non-image content be laundered through the trusted origin.
- lowPlugin injects global system-prompt directives that mandate its tools and forbid built-in ones
lib/host.jsA third-party plugin alters the host's global agent instructions for every conversation, ordering the model to always route skill/plugin discovery through its own tools and to never use built-in ones. This is a behaviour-hijacking capability a malicious plugin could abuse to steer the agent's tool selection and answers.
Unauthenticated /baitong-market API exposes install/uninstall/config-write/restart with a bypassable origin check, enabling CSRF-driven installs and config rewrite.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-20 · activity: Active
• Repo created: 2026-10-16
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).