dsh-grok-tui
把 [grok-build](https://github.com/xai-org/grok-build) 的 TUI 作为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh) 的前端：界面是 grok 的，内核（提示词、工具、模型路由、会话持久化）由 dsh 提供。
This report shows the evidence for dsh-grok-tui@0.3.3, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete install-time mutation of a foreign AI-agent configuration, meeting the firewall block boundary despite its limited intended UI effect.
Decision evidence
public snapshot- npm postinstall invokes a Python config mutator automatically.
- The mutator writes ~/.config/herdr/config.toml, a separate agent UI’s configuration.
- It creates or changes sidebar rows without an explicit user command.
- No credential exfiltration, remote payload download, or external network endpoint was found in the install path.
- The config content is limited to dsh usage-metric display rows.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
scripts/verify-models-live.mtsView on unpkg · L29Findings
Affected versions and remediation
This report applies to dsh-grok-tui@0.3.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing dsh-grok-tui@0.3.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.