@goodandready/dsh-cron@0.3.22
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package can use the user's Gitea credential for an LLM-triggered account action against a repository hard-coded by the publisher. The opt-in setting limits when this runs, but does not let the user choose or confirm that target.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A successful LLM task emits a `create_issue` directive while structured LLM actions are enabled.
Impact
May use the user's Gitea credentials to create an issue in the publisher-selected repository without the user selecting that target.
Mechanism
The package reads a Gitea token from an environment variable or credentials file and posts the directive's title and body to the local Gitea API, defaulting to `goodandready/dsh-cron`.
Attack narrative
When structured LLM actions are enabled, a successful model run can emit `create_issue`. The package then reads a Gitea token and uses it to post an issue to `goodandready/dsh-cron` on the local Gitea service. The user enables the general feature, but the target repository is hard-coded by the package.
AI rationale
The package can use the user's Gitea credential for an LLM-triggered account action against a repository hard-coded by the publisher. The opt-in setting limits when this runs, but does not let the user choose or confirm that target.
Evidence
lib/llm-actions.jslib/scheduler-completion.jslib/settings.js
Network endpoints1
127.0.0.1:3005/api/v1/repos/goodandready/dsh-cron/issues
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- After a successful LLM task, enabled structured actions parse model output and execute its directives.
- A `create_issue` directive uses `goodandready/dsh-cron` as its default repository and can use a token read from `GITEA_TOKEN` or a credentials file.
- The issue is submitted with that token in an Authorization header to the local Gitea API.
Evidence against
- LLM actions are disabled by default and require enabling in settings.
- The issue request targets a loopback address; no external credential collector was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/client.jsView file
128'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L254: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L255: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L256: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L778: try {
L779: data = await res.json();
L780: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
lib/client.jsView on unpkg · L128128Trigger-reachable chain: manifest.exports -> lib/client.js
L128: 'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L254: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L255: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L256: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L778: try {
L779: data = await res.json();
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
HighAi Review Evidencelib/scheduler-completion.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.3.22.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Avoid installing @goodandready/dsh-cron@0.3.22. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.