dsh.so
EN
English中文
dsh-vap avatar

dsh-vap

VAP - Verifiable Agent Protocol: a tested trust machine for agent-to-agent messages (zero third-party dependencies, 217 tests, full experiment ledger)

PluginAI Models
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

VAP is a verifiable agent protocol for trustworthy agent-to-agent messages with zero dependencies and full experiment ledger.

  • Zero third-party dependencies
  • 217 tests
  • Full experiment ledger

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:Wang-Lin-Chang/dsh-vap

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITWARNING8ea915
Security reviewAutomated review · daily
WARNING

No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).

0 critical·10 warning·19 info·15 files scanned
Version binding
plugin version0.2.0
scanned commit8ea91561906d2026-08-20
latest commit8ea91561906d

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: clean

vet verdict: vet: clean · score 0

  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.argv
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.stdout
  • R3 · info [certain] (downgraded) — 能力触达面（应用型包（bin 入口，process 即产品功能））：直接访问 process.exit（Node 能力逃逸通道）
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.stderr
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.stderr

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium0 critical · 10 warning · 19 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 10 / 10

  • warningHTTP request to a raw IP addressbin/vap-relay.mjs:75
    if (healthBound != null) console.log(` health : http://127.0.0.1:${healthBound}/health`);
  • warningFilesystem write operationsexperiments/vap-experiment.mjs:43
    fs.writeFileSync(path.join(r, 'inbox', 'task-1.json'), JSON.stringify({ kind: 'scan', area: 'threat-1' }));
  • warningFilesystem write operationsexperiments/vap-experiment.mjs:110
    fs.writeFileSync(path.join(r, 'outbox', `${id}.json`), JSON.stringify(env, null, 2));
  • warningFilesystem write operationsexperiments/vap-experiment.mjs:133
    fs.writeFileSync(path.join(dl, 'task-9.json'), JSON.stringify({ kind: 'scan', area: 'threat-9' }));
  • warningHTTP request to a raw IP addressexperiments/vap-http-experiment.mjs:38
    const clientB = createHttpClient({ baseUrl: `http://127.0.0.1:${port}` });
  • warningFilesystem write operationsexperiments/vap-http-experiment.mjs:20
    fs.writeFileSync(path.join(root, 'laws.json'), `${JSON.stringify(makeLaws(), null, 2)}\n`);
  • warningFilesystem write operationskey-store.mjs:41
    fs.writeFileSync(tmp, pem, 'utf8');
  • warningFilesystem write operationskey-store.mjs:54
    fs.chmodSync(file, 0o600);
  • warningFilesystem write operationslogger.mjs:65
    fs.appendFileSync(file, line, 'utf8');
  • warningFilesystem write operationsphase0/experiments/phase0-experiment.mjs:222
    fs.writeFileSync(outPath, json + '\n', 'utf8');

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/Wang-Lin-Chang/dsh-vap

Was this page helpful?