Daily security scan

The host RPC picks its file-access fence root from a client-supplied `cwd`, so any loopback caller can watch an arbitrary directory and read files under it via readText/readImage.

• highClient-supplied `cwd` on `list` selects the watch root, widening the read fence to arbitrary directories · src/index.js:118
• medium`list` accepts any `sessionId` with no caller binding, exposing other sessions' absolute file paths · src/index.js:119

Windows command injection via attacker-controlled lorebook name in openInSystem, plus an unauthenticated local JSON-RPC API and untrusted lorebook text injected as plugin instructions.

• highWindows command injection: world document name passed unquoted into `cmd /c start` · src/index.ts:621
• medium/prompt-manager/api performs state-changing ops with no origin, CSRF or auth check · src/index.ts:418
• mediumUntrusted world-book entry text injected into the turn as plugin 'instructions' · src/index.ts:818

Local PPTD/PPTX plugin: shell command injection and arbitrary file write in its export endpoint, plus SSRF in the proxy and third-party code in the editor origin.

• highShell command injection in the PPTX export path (deck title / outputPath / transition interpolated into `shell: true`) · lib/service.js:117
• highPath traversal / arbitrary file write via pages[].path in POST /api/export · lib/service.js:99
• mediumSSRF: /neo-ppt proxy trusts the raw request target instead of the validated pathname · lib/service.js:185

Marketplace plugin runs package installs via the dsh CLI; request-controlled binPath/target reach a shell:true spawn, and the catalog comes from unchecked third-party mirrors.

• highCommand injection: request-supplied binPath/target reach spawn() with shell:true · lib/host.js:762
• mediuminstall/update endpoint runs `dsh plugin add|update` with an arbitrary package spec from the request · lib/host.js:818
• mediumCatalog and package metadata are fetched through third-party GitHub proxies without integrity checks · lib/host.js:51

Unauthenticated local endpoints: /discover-models forwards stored provider keys to any baseUrl (CSRF-able), GET /config leaks plaintext apiKey, mutating routes lack /uninstall's guard.

• high/vision-opencode/discover-models forwards stored provider API key to an attacker-supplied baseUrl · index.js
• mediumGET /vision-opencode/config returns the plugin's stored plaintext apiKey · index.js
• mediumConfig-mutating routes lack the CSRF header check that /uninstall implements · index.js

Tuning Engines CLI/MCP client; the only real risk is server/config-supplied URLs interpolated into a shell exec for browser opening, plus plaintext-HTTP token use.

• highServer-returned verification_url is interpolated into a shell command in openBrowser (auth login) · src/commands/auth.ts:18
• mediumConfigurable api_url is concatenated into the same shell exec in billing add-credits · src/commands/billing.ts:19
• mediumAPI base URL is unvalidated and allows plaintext HTTP for the Bearer token and forwarded AWS/GitHub secrets · src/config.ts:56

Electron shell for dsh: no backdoor or hardcoded secrets, but it silently force-kills any process on port 3080, logs the session token, and hands unvalidated URLs to shell.openExternal.

• mediumSilently force-kills any process listening on port 3080 · electron/main.js:537
• lowwindow.open URLs: prefix-based host check and unvalidated scheme passed to shell.openExternal · electron/main.js:502
• lowdsh session access token persisted in plaintext boot.log · electron/main.js:459

Thin wrapper around an unaudited vendored rule engine; loads modules from env-var paths and can silently reject user turns and deny tool calls, but contains no shell, network or secret access itself.

• mediumEngine modules are require()d from environment-variable controlled paths without validation · lib/index.js:55
• mediumDecision logic is an unaudited vendored engine that gates user messages and tool calls · lib/index.js:54
• lowRoute whitelist is silently skipped when the route table is unavailable · lib/index.js:323

Legit DSH background launcher/tray; main risks are the unvalidated DSH_PACKAGE spec executed as an npm package and self-update running a downloaded Windows installer.

• mediumDSH_PACKAGE env var is used verbatim as an executable npm package spec (no validation) · deepseek.js:451
• lowHarness is fetched and executed unpinned (default @deepseek-ai/dsh@latest) on every start · deepseek.js:207
• lowSelf-update downloads and executes a Windows installer whose only integrity anchor is a checksum from the same release · launcher-updater.js:603

Hardened Electron wrapper (sandbox, contextIsolation, strict 127.0.0.1 navigation checks), but will-navigate hands non-http URLs to shell.openExternal and build scripts verify no download checksums.

• mediumwill-navigate forwards non-http(s) URLs to shell.openExternal without a scheme allowlist · src/main.js:544
• lowBuild script extracts a downloaded Node.js archive into the shipped backend without checksum verification · scripts/prepare-backend.mjs:157
• lowDev-only helper starts an unauthenticated local HTTP proxy with a hard-coded absolute path · scripts/wcs-mirror.mjs:25

Write-mode relay "isolation" degrades to the live workspace on a dirty git tree, and the Codex backend leaves its read-only sandbox to an optional env var.

• mediumWrite-mode relay isolation silently falls back to the live workspace when the git tree is dirty · lib/workspace.js:41
• mediumCodex backend disables approval and enforces no read-only sandbox when CODEX_SANDBOX is unset · adapters/backends/codex-backend.mjs:33
• lowModel-influenced memory query is appended to argv without a '--' terminator and its output is injected verbatim into peer context · lib/memory-bridge.js:28

Well-guarded backup/restore tool; one real weakness: unbounded zlib.inflateRawSync lets a crafted ZIP bypass the zip-bomb ratio guard and OOM the host. Core lib/index.js was not provided.

• mediumUnbounded inflateRawSync lets a crafted ZIP bypass the zip-bomb ratio guard and exhaust memory · lib/zip.js
• lowRescue console authorizes destructive API calls with a static, source-public header on loopback · rescue/rescue.mjs
• lowRescue API reads the request body with no size cap · rescue/rescue.mjs

Skill names reach path.join unsanitized (traversal) and the YAML emitter writes object keys verbatim, allowing extra rows to be injected into cordis.patch.yml from imported MCP data.

• mediumUnsanitized skill/item name joined into filesystem paths allows traversal · lib/install.mjs:26
• mediumYAML emitter writes object keys verbatim, allowing patch-row injection into cordis.patch.yml · lib/emit.mjs:50
• lowTypert RPC descriptors accept any JSON for all 29 extensionHub methods · lib/typert.host.js:14

Dev-harness plugin: tool surface (verify/promote) is path-contained, but startup home-sync mirrors plugins using unvalidated YAML names, allowing path escape and auto-enabling code.

• mediumHome sync mirrors out-of-tree plugins using unvalidated patch names (path escape + auto-enable) · src/home-sync.ts:257
• lowforge_verify executes workspace package.json scripts with the full host environment · src/verifier.ts:12

Refutes the scanner's critical: `bash -c` is the plugin's intended shell provider; residual risk is a preset that only runs with danger-full-access and coaches the agent to escalate.

• mediumPreset only runs shell commands unsandboxed and its error text coaches the agent to request danger-full-access · agent-presets/minimal-gitbash/gitbash-executor.mjs:192
• lowPreset config files installed on boot are not part of the audited source set · lib/index.js:26
• lowShell executable is resolved from GIT_BASH and PATH without any integrity check · agent-presets/minimal-gitbash/gitbash-executor.mjs:85

No critical/high issues; the plugin manages a local Headroom proxy, but API traffic carrying the DeepSeek key goes through an unauthenticated fixed loopback port.

• mediumDeepSeek API key transits an unauthenticated fixed loopback port that any local process can squat · lib/index.js:116
• lowWindows install path runs spawned commands through cmd.exe (shell: true) with homedir-derived arguments · lib/index.js:131
• lowstopProxy unconditionally shells out to Windows-only PowerShell/taskkill and can kill an unverified port owner · lib/index.js:225

Input-history plugin is mostly benign, but its host self-update route triggers pnpm installs gated only by a constant header plus an Origin check that accepts missing Origin.

• mediumUnauthenticated install route: constant header plus Origin check that accepts a missing Origin triggers pnpm add · src/update-endpoint.ts:188
• lowpnpm is spawned with shell:true (mitigated only by the upstream tag regex) · src/update-endpoint.ts:129

The scan's critical is not reproducible in the visible surface (eval is JSON-escaped, specs allowlisted), but the DSH credentials file is returned to the webview over IPC.

• mediumlist_config_files returns the raw .credentials.yaml content to any launcher webview over IPC · src-tauri/src/dsh_files.rs:64
• loweval() of an interpolated tab title in the drag-preview webview (mitigated by JSON string escaping) · src-tauri/src/windows_ui.rs:184
• lowProcess-launch layer exec.rs/service.rs is referenced but absent from the harvest, so shell-vs-argv semantics are unverified · src-tauri/src/lib.rs:17

Visible code is defensive, but the OS-notify spawner fed by model/session text (src/notify.ts) is missing from the snapshot, so shell-injection risk is unverified; settings route lacks auth.

• mediumModel/session-derived text flows into an unreviewed OS-notify spawner · src/index.ts:104
• lowSettings read/write route has no authentication or origin check · src/api.ts:125

Medium: agent-preset `!!js` values run via `new Function` with a bypassable pseudo-sandbox, giving host code execution from a controlled preset file; other paths are guarded.

• mediumAgent-preset `!!js` expressions are executed with `new Function` behind a bypassable pseudo-sandbox · lib/index.js:298

Umbrella plugin is inert; sub-plugins guard their routes, but the vision analyze route lacks a same-origin/CSRF check, allowing cross-site use of the stored API credential.

• mediumVision analyze route skips same-origin check, enabling cross-site use of stored API credential · packages/vision/index.mjs
• lowLegacy wallpaper cleanup rewrites unrelated theme bundle files under ~/.npm/_npx · packages/wallpaper/legacy-cleanup.mjs
• lowBridge injects an agent instruction to run curl reading the local bearer token file · packages/wechat/src/dsh-wechat-bridge.mjs

Static scan's 2 criticals are refuted: the bash -c/icacls execs are the plugin's designed SSH command path; the real issue is cleartext SSH password storage.

• mediumSSH login passwords are persisted in cleartext to ~/.dsh/dsh-remote-ide.json · src/store.ts:145
• lowService accessor hands the full host entry, including the cleartext password, to any in-process consumer · src/ssh-service.ts:222

Well-structured ssh tunnel manager; no critical/high code issues in the reviewed files, but the bootstrap pipes a remote NodeSource script into a root shell and relies on TOFU host-key checking.

• mediumBootstrap pipes an unpinned NodeSource script into a root shell on the remote server · scripts/bootstrap-remote.sh:49
• lowRemote-reported login name interpolated unquoted into a remote shell command · src/ssh.js:128
• lowssh uses StrictHostKeyChecking=accept-new on every connection (TOFU) · src/ssh.js:19

Local-only HTTP routes, but client.js lazy-loads third-party CDN scripts without integrity, and index.js silently installs agent skills and injects hidden system-prompt sections.

• mediumRuntime injection of third-party CDN scripts (gsap, lightweight-charts) without integrity checks · client.js:236
• mediumStartup copies bundled skills into the user's global ~/.agents/skills directory · index.js:49
• mediumHidden conditional instructions injected into the host system prompt · index.js:645

Voice-input plugin; host routes are gated only by a spoofable Host/Origin check that can leak the configured ASR API key and trigger deploy/stop; no RCE found.

• medium/config returns full resolved config including apiKey to any caller passing the Host/Origin gate · lib/index.js:449
• mediumHost/Origin trust check is a no-op for loopback hosts and bypassable via DNS rebinding · lib/index.js:93
• lowLocally spawned ASR service accepts unauthenticated cross-origin uploads (allow_origins=['*']) · server/asr_server.py:44

Plugin OCRs images locally via PowerShell and rewrites image blocks to text; main risk is an unauditable PowerShell payload plus indirect prompt injection through OCR text.

• mediumPowerShell OCR payload executed with -ExecutionPolicy Bypass is not included in the audited files · lib/index.js:235
• lowOCR text from untrusted images is inserted into the model prompt without escaping the delimiter · lib/index.js:320
• lowGlobal monkey-patching of llm.resolveModelInfo/listModels advertises image support for every model · lib/index.js:167

Installers write vendor routing rules into global agent instruction files and pull unverified remote skill content plus unpinned npm package; no critical or high issue found.

• mediumInstaller persistently injects vendor routing rules into the agent's global instruction/memory files · scripts/claudecode-minara-skill-setup.sh:28
• mediumRemote skill content fetched without integrity check and copied into the agent skill directory · scripts/claudecode-minara-skill-setup.sh:73
• lowUnpinned global `npm install -g minara@latest` runs on every setup and auto-update path · scripts/claudecode-minara-skill-setup.sh:196

Electron desktop shell for the DSH harness: all flagged spawn/exec/fs patterns are build-time scripts or token-gated local control code; only low-severity hardening gaps found.

• lowPreload exposes window-control and update-install IPC to any origin loaded in the window · preload.js:27
• lowDaemon control token persisted in plaintext inside the state JSON file · runtime/daemon-host.cjs:45
• lowBuild-time patch injects shell:true into upstream spawn/spawnSync calls · scripts/patch-upstream-windows-release.cjs:9

All harvested files are declarative patch YAML plus no-op host halves exposing only name/inject/apply; no sensitive operations are reachable in this source.

Reviewed self-restart guard sources: git/ps/lsof/pgrep calls use fixed argv arrays without a shell, installers quote operator input, and there is no network or secret handling; only low hardening gaps found.

• lowdiscoverLaunchCommand pastes raw ps argv into a shell command string (only cwd/env are quoted) · src/processes.ts:64
• lowpreflight-runner imports and boots code from an unvalidated path derived from DSH_HARNESS · src/preflight-runner.ts:49

index.js only reads packaged SKILL.md files and registers them; the flagged shell script is a dev-only deploy helper never loaded by DSH.

Document-parsing plus attachment-toolkit plugin; the Host-based trust fence and parsers look sound, with only an unbounded page_range loop that can stall the host.

• lowpage_range upper bound is not capped before the enumeration loop, so a huge range hangs the host · src/parse/range.ts:18

Harvested code is benign; one low-risk gap remains: the global-install postinstall imports an unreviewed script.

• lowGlobal-install postinstall imports an unreviewed script · package.json:103

dsh-simplify only runs escaped `git diff` via the dsh shell seam and feeds the result to the agent; no injection, exfiltration, or hidden entry point found.

• lowPrompt-building module not harvested; content sent to the LLM is unauditable · src/simplify-command.ts:46

lib/core.js guards path traversal, zip-slip, symlinks and state corruption carefully; only a low-risk folder-picker IPC that enumerates arbitrary directory names remains.

• lowbrowseDirectories lists any absolute directory on the host without an allow-list · lib/core.js

Official-endpoint OAuth plugin with tokens in DSH credential store and state-checked loopback callback; only low-severity hardening gaps found.

• lowLocal auth routes have no origin/CSRF check and read request bodies without a size limit · lib/index.js:300
• lowPKCE code_verifier is reused as the OAuth state parameter · lib/channels/chatgpt.js:76
• lowUses first-party CLI OAuth client IDs and elevated scopes instead of its own registration · lib/channels/claude.js:9

Well-guarded local OCR plugin: argv-array spawn without a shell, whitelisted temp paths, fail-closed image rewrite; only low hardening gaps remain.

• lowGlobally monkey-patches llm.resolveModelInfo/listModels to claim image support for every model · lib/index.js:199
• lowStartup sweep recursively deletes any matching tesseract-ocr-XXXXXX directory in shared tmp · lib/index.js:73

No reachable injection, secret, shell or network sink; the flagged new Function is vendored schemastery deserialization fed only by this plugin's own callback.

• lowVendored schemastery rehydrates string callbacks with new Function (not reachable with untrusted input here) · lib/client.js:247

Benign pet/balance plugin: spawned process and API calls use fixed targets, API key stays server-side, and no exfiltration or injected instructions were found; only minor local-endpoint exposure remains.

• lowUnauthenticated /api/status route exposes agent session metadata (tool names, todo summaries, approval reasons) to any local caller · plugin/dsh-balance-widget/lib/index.js:159
• lowPet UI is served same-origin and injected as an unsandboxed iframe; pet.html content was not part of the audited source sample · plugin/dsh-balance-widget/lib/index.js:172

DSH preset with disclosed anchor/bootstrap prompt steering, validated router output, and an operator-configured capability process; no reachable critical/high issue, only low hardening gaps.

• lowCapability CLI executes an operator-configured binary taken from an environment variable · bin/dshx.mjs:60
• lowCapability inputs and results are appended verbatim to a session event log file · bin/dshx.mjs:26