dsh-plugins

runEslint defaults cwd to workRoot() and launches the bundled ESLint without --no-config-lookup, so ESLint resolves and executes the project's eslint.config.* (arbitrary JS) inside the DSH host process. Reviewing a directory that contains untrusted code (e.g. a freshly cloned repository) thus executes that code's config with host/plugin privileges; the path guard only proves the directory is inside cwd, not that its content is trusted.

The plugin hooks the global tools/result event (not just text_stats) and pushes {name, agent, ok, summary: JSON.stringify(result.value).slice(0,120)} for every tool call into ctx.textStats.recent (bounded to 20), which is documented as readable by other plugins. This is undocumented cross-plugin observation of other tools' output; it stays in process memory and is only logged at debug level, so no exfiltration occurs.

This artifact asserts, inside the audited source, that earlier audit findings (arbitrary path write, HTML XSS, symlink escape, reserved names) are already fixed. Such 'audit passed' claims must not be treated as evidence; the script itself is not a plugin entry point registered by any cordis.patch.yml and is not loaded at runtime, so its only effect is to bias a human or automated reviewer.

resolveSafeOutputPath realpaths the deepest existing ancestor of path.dirname(target) but never realpaths target itself. If a symlink with the chosen name already exists in the workspace and points outside cwd, mkdir succeeds and writeFile follows the link, writing the exported session content outside the workspace. Requires a pre-existing attacker-planted symlink plus the caller choosing that exact name, hence low.