dsh-toutiao-reader

Only the URL scheme is validated; hostname/IP is never checked against a blocklist. The tool therefore works as an SSRF primitive: it can read http://127.0.0.1:*/json/list (the plugin's own CDP endpoint), cloud metadata (169.254.169.254), and internal admin panels, returning the response body to the model and optionally writing it to a file. Only the model's URL choice stands in the way, and that choice can be steered by prompt injection from previously scraped pages.

resolveOutfile returns any absolute path unchanged (line 42: `if (path.isAbsolute(p)) return p`) and the write is preceded by mkdirSync(path.dirname(dest), { recursive: true }). The content is the page title plus full body, i.e. fully controlled by whoever serves the URL. A page that successfully prompt-injects the agent can get its own text written over shell profiles, startup scripts or editor configs, and directories are auto-created, so there is no confinement to the configured workspace.

startDaemon spawns a detached Edge/Chrome that is never shut down, listening on 127.0.0.1:<cdpPort> with no token, and getTab() blindly trusts whatever answers on that port (the pid file is written but never verified). A local process that grabs the port first receives every URL the user asks to fetch via Page.navigate and can return chosen content into the model context. The profile directory (os.tmpdir()/webfetch-profile) also accumulates cookies of any authenticated site the user reads and is reused by other scripts.

tmpHtml is a predictable path (os.tmpdir()/webfetch-dom.html) opened without O_EXCL/O_NOFOLLOW. On shared temp directories another local user can pre-create that name as a symlink and the browser's dump-dom output will then truncate/overwrite whatever the file points at. Low impact because %TEMP% is per-user on the Windows targets this plugin is written for.