registry / @goodandready/dsh-cron / 0.3.28
@goodandready/dsh-cron@0.3.28
Background automation runner for DSH: isolated agent runs, script/HTTP/SSH/Docker runtimes, cost guard, notifications, heartbeats.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged SSH-key and Feishu references are for user-configured task and notification settings. The Gitea token flow is gated by an opt-in setting and a model-produced action directive, and sends to a local Gitea API; no malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
LLM issue actions require the user to enable llmActionsEnabled and a successful LLM task to emit a create_issue directive; notifications and SSH tasks use configured destinations and paths.
Impact
An enabled LLM action can create an issue in the configured or default local Gitea repository; no unrelated credential exfiltration or unauthorized default account action was found.
Mechanism
The issue helper reads a Gitea token from the environment or a configured local credentials file and sends an issue request to the local Gitea API.
AI rationale
The flagged SSH-key and Feishu references are for user-configured task and notification settings. The Gitea token flow is gated by an opt-in setting and a model-produced action directive, and sends to a local Gitea API; no malicious behavior was identified.
Network endpoints2
127.0.0.1:3005/api/v1/repos/${repo}/issuesopen.feishu.cn/open-apis/bot/v2/hook/...
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a DSH automation runner with script, HTTP, SSH and Docker runtimes.
- LLM actions are disabled by default and execute only when enabled in settings after a successful LLM task produces output.
- The Gitea issue action reads a token and posts to a local Gitea API; it is reachable through the opt-in LLM action flow.
- The SSH-key pointer is a user-entered key-path field for an SSH task.
- The Feishu host appears as a configurable webhook destination in notification settings.
Evidence against
- When LLM actions are enabled, an LLM directive can create an issue in the default goodandready/dsh-cron repository using a token from the environment or a configured credentials file.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedlib/tui-settings.jsView file
68label: 'Feishu Webhook URL',
L69: placeholder: 'https://open.feishu.cn/open-apis/bot/v2/hook/...',
L70: format: textFormat,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
lib/tui-settings.jsView on unpkg · L68lib/client.jsView file
128'form.sshTargetLabel': 'Fallback target (user@host, optional)',
L129: 'form.sshKeyLabel': 'Private key path (fallback, optional)',
L130: 'form.dockerImageLabel': 'Container image', 'form.sk[redacted]': 'Skill name',
...
L155: 'form.promptLabelLlm': 'Instruction / Prompt for the agent',
L156: 'form.promptPlaceholderScript': 'curl -fsSL https://... || exit 1',
L157: 'form.promptPlaceholderLlm': 'Describe exactly what the agent should do...',
...
L255: 'form.preflightLabel': 'Pre-flight check', 'form.preflightNone': 'None',
L256: 'form.preflightHttp': 'HTTP (2xx probe)', 'form.preflightShell': 'Shell command (exit code 0)',
L257: 'form.preflightDisk': 'Disk space (path:minPercent)',
...
L790: try {
L791: data = await res.json();
L792: } catch (jsonErr) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Findings
3 Critical2 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tui-settings.js
CriticalCredential Exfiltrationlib/client.js
CriticalTrigger Reachable Dangerous Capabilitylib/client.js
HighTrigger Reachable Credential Exfiltrationlib/client.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @goodandready/dsh-cron@0.3.28.
See all versions of @goodandready/dsh-cron for other recorded verdicts.
- Review the evidence and your use of @goodandready/dsh-cron@0.3.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.