Daily security scan

Host routes expose unauthenticated local admin actions (install/uninstall/toggle) without Origin/Host checks; catalog fields also build shell commands and the host security shim is stripped for installs.

• highLocal admin routes lack Origin/Host/CSRF checks, enabling drive-by install/uninstall/toggle · lib/index.js
• mediumCatalog fields are interpolated into copyable shell commands without validation · lib/index.js
• mediumInstall subprocess strips the host safe-delete shim from PATH/NODE_OPTIONS · lib/index.js

Installer bootstraps code from unofficial GitHub proxies without hash verification, and the host half logs all command output to default-permission files with no enforced cap.

• mediumInstaller fetches plugin code from unofficial GitHub proxies without any integrity check · install.sh:61
• mediumEvery command's stdout/stderr is persisted by default to default-permission logs with no enforced size cap · lib/host.js:378
• lowWS/status endpoints are guarded only by loopback Host/Origin checks, so any local process can read all captured output · lib/host.js:677

Local-file preset editor: host-side new Function evaluates hand-editable !!js predicates; no network or credential access; deletion trusts a caller-supplied directory path.

• mediumHost process evaluates !!js predicates from a hand-editable composition with new Function · preset-backend/declarative.mjs:38
• lowPreset deletion renames and recursively removes a caller-supplied directory without validating it · preset-backend/declarative.mjs:217

Graft CLI wrappers shell out from model-supplied args (Windows fallback), a postinstall auto-runs a global npm install, and an unescaped repo name is document.written in the browser-tab fallback.

• mediumWindows bare-name fallback spawns graft with shell:true, allowing command injection from model-supplied tool args · src/graft-tools.js:92
• mediumpostinstall runs an unpinned `npm install -g @nanonets/graft`, executing third-party install scripts with user privileges · scripts/postinstall.mjs:77
• mediumUnescaped repo name written into a same-origin about:blank document via document.write enables DOM XSS · src/client.js

Two medium issues: the loopback OAuth callback page reflects error_description into HTML unescaped, and the plugin's HTTP routes can register without the host request fence.

• mediumHTTP routes register and serve with no request fence whenever the `connection` service is absent · src/routes.ts:132
• mediumReflected XSS on the loopback OAuth callback page via the error_description query parameter · src/oauth.ts:170

Legitimate SSH monitoring plugin; real residual risk is deliberate remote-command execution (agent tools, auto-updater) behind an auth helper not included in the bundle.

• mediumAgent tool server_monitor_exec runs arbitrary SSH commands with stored credentials · lib/agent-tools.js:63
• mediumPOST to update endpoint spawns `dsh plugin add`, executing npm lifecycle scripts of a remotely resolved version · lib/plugin-updater.js:166
• lowWindows ACL enforcement failure on the secrets file is only warned, never fatal · lib/vault-service.js:23

Plugin installs a host-wide proxy route that deliberately bypasses web_fetch's SSRF/DNS guard for all URLs; other static flags are contextually benign.

• mediumHost-wide proxy route removes web_fetch's SSRF/DNS validation for every URL · lib/manager.js:137

Two medium risks: a CORS-open local model endpoint ('*') any web page can rewrite, and an unauthenticated loopback bridge letting cross-site POSTs inject prompts into the agent.

• mediumModel endpoint sends Access-Control-Allow-Origin: * with no auth or origin check · dsh-wechat-bot/index.js:659
• mediumUnauthenticated loopback bridge accepts cross-site POST /message that drives the DSH agent · dsh-wechat-bridge/index.js:56
• lowWeChat tool approvals are keyed per conversation, so any sender in that chat can approve · dsh-wechat-bot/index.js:335

Static-scan warnings all sit in developer build/test scripts; the runtime-loaded host entry points are empty, so no runtime risk is reachable from the shipped plugin.

• lowDev test harness fetches React UMD from unpkg and runs it in headless Chrome without integrity check · scripts/check-settings-controls.sh:40

Static scan's critical flag is the documented `new Function` dynamic-import helper in llm-wiki; its only call site passes a hardcoded literal, so no reachable code-execution risk.

• low`new Function` dynamic-import helper is a scanner hotspot but all visible call sites pass literal specifiers · plugins/llm-wiki/src/shared/optional.ts:16
• lowllm-trace bundle patch enables `print: full`, dumping whole model requests to stderr · plugins/llm-trace/cordis.patch.yml:8

Heuristic warnings are refuted: the sole child-process spawn uses fixed args for macOS scutil, and global dispatcher/env rewriting is the plugin's disclosed, settings-driven purpose.

• lowmacOS system-proxy detection spawns scutil via PATH with fixed arguments · lib/index.js:360

Windows computer-use plugin: reviewed entry points pass untrusted tool args to a serialized, token-authenticated local control channel; no injection, exfiltration or backdoor found, only two low hardening gaps.

• lowPrebuilt native executables are shipped and executed but are not part of the reviewed source · package.json:78
• lowHost protocol module is resolved from an environment-supplied directory · lib/host-integration.js:55

Local DSH UI plugin; notification and HTTP paths are correctly escaped. Residual low risks: unauthenticated loopback status server, unreviewed native HUD source, pid-file kills.

• lowLoopback status server returns session metadata to any requester without Host/Origin checks · xy-dsh-lamp/index.mjs:132
• lowNative HUD is compiled from hud.swift and renders overlay.html, neither of which is in the audited source · xy-dsh-lamp/index.mjs:108
• lowSIGTERM is sent to whatever pid the pid file holds, so a stale file can hit an unrelated process · xy-dsh-lamp/index.mjs:68