Daily security scan

Unauthenticated loopback control API with file write into ~/.dsh and ~/dsh lets any local app or web page overwrite MCP/daemon files and restart dsh, achieving persistent code execution.

• highUnauthenticated loopback control API lets any local app or web page start/stop/kill the DSH process · daemon/server.mjs:398
• highUnauthenticated /api/write can overwrite ~/.dsh MCP config and the daemon's own server.mjs, giving persistent code execution · daemon/server.mjs:322
• mediumUnauthenticated /api/read and /api/logs expose DSH configuration and logs that may contain credentials · daemon/server.mjs:310

Unauthenticated local TTS routes let a caller spawn an arbitrary executable (local-piper), proxy requests to arbitrary URLs, and install/delete files under ~/.dsh/tts-rvc.

• highProvider 'local-piper' spawns an arbitrary executable path taken from the /speak request body · lib/index.mjs
• mediumUnauthenticated SSRF: caller-supplied baseUrl is fetched and the response is reflected · lib/index.mjs
• mediumVoice-pack install verifies sha256 against the same untrusted manifest and writes attacker-chosen .pth/.index files · lib/index.mjs

Developer QA toolkit is mostly benign, but prior-probe's model-reachable prior_probe_run can read any file's first line and send it as a Bearer token to an attacker-chosen URL.

• highprior_probe_run reads an arbitrary file's first line as a Bearer token and sends it to a caller-chosen URL · plugins/prior-probe/index.js:171
• mediumverify CLI executes code supplied by the repository under verification · dsh-plugin-kit/lib/runner.cjs:64
• lowparse check compiles a config-named repository file with new Function (compile only) · dsh-plugin-kit/lib/checks.cjs:54

Auto-downloads the cloudflared binary with TLS verification disabled and executes it unsigned; LAN access is token-free by default and panel routes leak the access token.

• highcloudflared binary is downloaded with TLS verification disabled and executed without any integrity check · lib/download.mjs:44
• mediumlanOpen defaults to true, giving any LAN peer token-free access to the DSH agent · lib/index.mjs:117
• lowPanel routes return and rotate the proxy access token with no handler-level authentication · lib/index.mjs

No RCE or shell injection; risks are unauthenticated /amadeus/* HTTP routes that expose stored API keys and trigger billed LLM calls, plus keys embedded in the panel iframe URL.

• mediumUnauthenticated /amadeus/poll returns full config including stored API keys · plugin/src/host.js
• mediumWhole config (API keys) is embedded in the panel iframe URL query · client.mjs
• mediumState-changing GET routes with no auth/CSRF: /amadeus/chat spends the stored key on attacker-chosen prompts · plugin/src/host.js

Tauri shell is well fenced; residual risks: substring external-URL check lets attacker pages into the bridged harness webview, auth token written to logs, and unverified build/plugin downloads.

• mediumExternal-link guard uses substring match, so crafted URLs load inside the harness webview · src-tauri/src/lib.rs
• lowFile-mention host bridge authenticates with a constant and forwards an unvalidated remote path · src-tauri/src/lib.rs
• lowPer-boot dsh auth token is written to stdout and the persistent desktop log · src-tauri/src/server.rs

Memory plugin is functionally benign; the static 'critical' hits (new Function, fs reads) are false positives, but the fallback self-registered HTTP RPC routes delegate auth to an optional hook.

• mediumSelf-registered fallback HTTP RPC routes delegate authentication to an optional hook and can run unauthenticated · lib/index.js:755
• lowDynamic import built via new Function (specifier is a hard-coded constant, not attacker-controlled) · src/semantic.ts:80

Chromium popup driven by inline PowerShell; quoting/escaping is sound, but an unauthenticated localhost GET route lets any web page suspend the companion window.

• mediumUnauthenticated cross-origin GET route lets any web page suspend the companion window · index.js:358
• lowsite.id from settings is joined into the profile path without sanitisation · index.js:245
• lowPlugin installs SIGINT/SIGTERM handlers that force process.exit(0) on the host · index.js:419

index.js is an inert no-op and the two Python CLIs only touch a local state dir; one medium finding — bus.py 'ack' skips the path-traversal guard its siblings use.

• mediumbus.py 'ack' skips participant validation, letting caller-supplied strings escape mailboxes/ via ../ · .expert-mode/comm/bus.py:225
• lowtaskboard.py builds task paths from unvalidated argv despite defining an unused VALID_ID regex · .expert-mode/comm/taskboard.py:84

Electron shell for the DSH web UI: no shell injection, RCE or secret exfiltration found; residual risks are unpinned npx install via a third-party mirror and webview/path hardening gaps.

• mediumDSH package is installed unpinned and executed at launch, by default through a third-party npm mirror · main.js:510
• lowwebviewTag enabled without will-attach-webview sanitization or window-open handler · main.js:686
• lowWallpaper IPC uses a string-prefix containment check and an unvalidated extension for file paths · main.js:805

Mobile plugin deliberately opens the loopback Harness to the LAN via an unauthenticated proxy that rewrites Host/Origin to defeat the /api trust fence; intended but risky.

• mediumUnauthenticated LAN proxy exposes full Harness and rewrites Host/Origin to bypass the loopback trust fence · src/lan-proxy.ts:78

Both static criticals are false positives (consent-gated gh star; generated bridge code is never executed by this plugin). One medium: the generated OpenCode bridge runs project-scope hook commands without consent.

• mediumGenerated OpenCode bridge executes project-scope Claude hook commands with no consent gate · lib/opencode-hook-plugin.mjs:146
• lowCLI prints model-directed instructions telling the host agent to run a star confirmation command · lib/star.mjs:100
• lowSuccessful migration triggers a self-star written to the user's GitHub account via gh credentials · lib/star.mjs:37

Unauthenticated host routes take a client-supplied `cwd` that defines the skill roots, so the containment check is self-defeating; skill move/rename and path disclosure follow.

• mediumSkill-operation route derives its 'skill roots' from the client-supplied `cwd`, defeating the containment check · src/index.js:436
• lowUnauthenticated catalog route takes arbitrary `cwd` and returns absolute skill paths · src/index.js:508
• lowShared-state write route has no client-header/CSRF guard, unlike its sibling · src/index.js:378

Vision plugin works as described; default config lets the model read and upload arbitrary local files, and a local unauthenticated queue port is exposed. No backdoor or RCE.

• mediumDefault config lets the vision tool read any local file and upload it to a remote vision service · src/index.ts:651
• lowOAuth tokens and API keys transit a shared Windows temp file and curl argv · src/index.ts:120
• lowUnauthenticated local vision queue exposes images/prompts and accepts injected results · src/web-channels.ts:86

Static 'critical' is likely schemastery's unreachable new Function; the real issue is unauthenticated /api/weshop POSTs accepting text/plain JSON, which can overwrite canvas state and the stored API key.

• mediumUnauthenticated /api/weshop POST routes parse text/plain JSON, allowing cross-site state and API-key overwrite · lib/index.js
• lowPredictable world-readable temp paths allow local disclosure or symlink-based file overwrite · lib/index.js
• lowAgent-supplied localPath is copied into a served directory, creating a local-file read/serve channel · lib/index.js

Audited files are ACP/Cordis config rows, trivial re-export stubs and a standard postinstall hook; no reachable critical/high/medium risk found, static warnings refuted.

• lowInstall-time postinstall hook runs local build scripts before review · package.json:23
• lowProfile-configurable host binary path mounted by the extension patch · extensions/dsh-openbitfun/cordis.patch.yml:10

Refuted: the flagged critical is a defensive Win32 job-object containment helper; no reachable code-exec, exfiltration or injection path in the harvested code.

Harvested files show no attacker-reachable sink: spawns use fixed args, curl stays on 127.0.0.1, escaping/redaction are defensive; residue is the unharvested HTTP server.

• lowOptional cloudflared quick tunnel publishes the local approval service to the public internet · src/tunnel.mjs:62

Verified the wallet host plugin: no reachable RCE or credential exfiltration; only two low-severity residual risks. Static-scan warnings refuted.

• lowPlan credentials are sent to adapter.endpoint defined in the unreviewed lib/plans.js · index.js:1481
• lowWindows DPAPI helper spawns powershell.exe with -ExecutionPolicy Bypass · index.js:1617

The scan's exec/child_process flag is a false positive (constant host, Number()-coerced port); only low-severity dev-server hardening gaps and unreviewed imported modules remain.

• lowMalformed percent-encoding in the request path crashes the local server (uncaught URIError) · serve.js:25
• lowRuntime modules imported by the client entry point were not included in the audited source set · harness-plugin/src/client/index.ts:19

No critical/high risk found: the 17 heuristic warnings are guarded child-process, filesystem and loopback-HTTP paths; only two low-severity hardening gaps remain.

• lowExecutable pnpm shim is written into shared $DSH_HOME/bin and given PATH precedence over system pnpm · src/pnpm-runtime.js:97
• lowOwnership-marker adoption uses loose image matching before terminating the adopted process tree · src/ownership-marker.js:163

jarvis-index is a docs/MCP-packaging plugin; its only runtime hook is a non-executing status probe; setup.sh is an opt-in installer with checksum-verified downloads, so the 4 static warnings are not reachable high risk.

• lowBootstrapper is piped from unpinned main and installs unpinned latest packages/binaries · setup.sh:5
• lowHook interpolates local `jarvis list` fields into a JSON string without escaping · plugin/hooks/jarvis-index-status.sh:53