tencent-agent-mail-dsh-plugin

Any mail whose From matches the whitelist (email or @domain) and whose subject contains the configured keyword pushes an instruction set into a DSH executor session with full tool access; rec.subject / rec.message_id are interpolated into the prompt unescaped, so a crafted subject can add its own instructions. Guards are only autoExecute (default false), the keyword, a 10-per-hour rate limit and an advisory 'confirm destructive actions first' line; if the From header can be spoofed past Tencent's relay, this is remote command execution.

savedFile is derived from the attachment name / agently output and is executed by the OS handler immediately after download ('下载并打开'). A sender-controlled file name (invitation.exe, x.lnk, a.bat) is therefore run after one click, and the name is embedded in a cmd.exe command line where metacharacters are not escaped. Nothing verifies extension, signature or origin of the attachment.

Every write goes through a danger-full-access fs mode rooted at C:\, and path components taken from RPC args are joined without validation: invoke('download', {msgId:'..\\..\\...'}) makes ensureDirs create directories and the attachment command write outside ~/.dsh/dsh-mailbox, and purge/purge-family calls feed args.id into fileMail(id)/rmFile. Any caller able to reach the mailbox RPC (or a mail whose message_id is crafted) can therefore create/write/delete files outside the intended store.

The user's API key is visible in the process argument list (any local process/user with process-visibility can read it) for the duration of each autoProcess call. The request body is written to a temp file and removed, but the secret uses the argv channel.

Once the user creates ~/.dsh/dsh-mailbox/credentials.json, up to 3000 characters of every incoming mail (potentially containing contracts, invoices or credentials) leave the machine to whatever base_url that file names, without a per-mail prompt. The behaviour is described in the settings UI, so it is disclosed rather than covert.