What it doesAI
Detects pasted secrets, stores them securely, and sends placeholders to the model.
- Detects pasted secrets
- Stores secrets in credentials seam
- Sends [secret:REF] placeholders to model
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add dsh-secret-pasteInstall method: npm · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
No critical or warning findings in the automated scan. The result is valid only for the commit hash shown.
0.2.0dsh manifest3876baea36852026-08-203876baea3685The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
vet verdict: vet: suspicious · score 0
- R2 · info [likely] — require()（客户端加载器 factory 形参注入，DSH bundle 标准写法）
- R2 · info [likely] — require()（客户端加载器 factory 形参注入，DSH bundle 标准写法）
- R7 · high [likely] — 硬编码密钥：Slack token
- R7 · high [likely] — 硬编码密钥：Slack token
- R7 · high [likely] — 硬编码密钥：Slack token
vet is advisory and does not change dsh’s four-tier level.
• Static heuristic scan: done (6 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
Activity
Last commit 2026-08-20 · activity: Active
• Repo created: 2026-08-20
• Stars: ★ 2 · Forks: 0
• Health: Active — committed within last 30 days