Verification
L1 · Found
Security
Medium
Health
Active
Trust
Unrated
What it does
Installation
dsh plugin --profile web add github:Wang-Lin-Chang/dsh-witnessInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
DSH.SO AUDITMEDIUM67cb09
Security reviewAutomated review · daily
MEDIUM
Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.
7 critical·9 warning·0 info·8 files scanned
code-exec ×7plugin version
0.2.0scanned commit
67cb09eb5fe82026-08-21latest commit
67cb09eb5fe8The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.
`[](https://www.dsh.so/artifact/dsh-witness/)`Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
Risk details
| Risk | Rule | Location | Description |
|---|---|---|---|
| critical | Child process module usage (Node.js) | detach-runner.cjs:23 | const { spawn } = require('node:child_process') |
| critical | Child process module usage (Node.js) | detach-runner.cjs:34 | const r = require('node:child_process').spawnSync('powershell', ['-NoProfile', '-Command', `[int](Get-Date -Date (Get-Process -Id ${process. |
| critical | Child process module usage (Node.js) | detach-runner.cjs:126 | try { require('node:child_process').spawnSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', ps], { windowsHide: true, timeout: |
| critical | Child process module usage (Node.js) | lib/WitnessJobRegistry.js:4 | import { spawn, spawnSync } from 'node:child_process'; |
| critical | Child process module usage (Node.js) | lib/spawnDirCleanup.js:8 | import { spawnSync } from 'node:child_process'; |
| critical | Child process module usage (Node.js) | src/WitnessJobRegistry.ts:9 | import { spawn, spawnSync } from 'node:child_process' |
| critical | Child process module usage (Node.js) | src/spawnDirCleanup.ts:8 | import { spawnSync } from 'node:child_process' |
| warning | Filesystem write operations | detach-runner.cjs:40 | fs.writeFileSync(lockFile, `${process.pid}:0`, { flag: 'wx' }) // wx = O_EXCL 独占；lock 立即存在（收养观测窗口） |
| warning | Filesystem write operations | detach-runner.cjs:44 | if (lockCreated) { try { myStartSec = procStartSec(); fs.writeFileSync(lockFile, `${process.pid}:${myStartSec}`) } catch {} } // startSec |
| warning | Filesystem write operations | detach-runner.cjs:50 | try { fs.writeFileSync(exitFile, '', { flag: 'wx' }) } catch {} // 预创建 exit.txt（防任务抢建伪造；wx 防覆盖已有） |
| warning | Filesystem write operations | lib/WitnessJobRegistry.js:185 | fs.writeFileSync(path.join(d, 'autopsy.json'), JSON.stringify({ |
| warning | Filesystem write operations | lib/WitnessJobRegistry.js:196 | fs.writeFileSync(path.join(d, 'state', 'done'), String(code)); |
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-20 · activity: Active
• Repo created: 2026-08-21
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days