dsh-plugin-prompt-tips
DSH 悬浮精灵「Prompt 小精灵」：每小时从内置资源库推荐一条 OpenAI/Anthropic 官方近期 prompt 技巧并讲清为什么；支持换肤、‹›翻历史（≤10 条）、手动捞一条与一键同步更新。
This report shows the evidence for dsh-plugin-prompt-tips@0.2.2. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically uses configured model credentials for recurring hourly requests by default, which can consume paid API usage without a separate user request for each call. Although that behavior supports the advertised personalization feature and uses the user’s configured DSH model, the automatic recurring use of keys falls under the package firewall’s rule for using user keys without a request.
Decision evidence
public snapshot- The plugin is enabled by default and schedules a run after a 90-second first delay, then every hour by default.
- For personalization, it reads credential references from the DSH credentials file and injects missing configured API keys into the child process environment.
- The child process runs the configured `dsh` command with the prompt; personalization is enabled by default.
- After initialization, the plugin arms its scheduler, which automatically runs recommendations and repeats them at the configured interval.
- The package describes hourly prompt recommendations and offers an offline fallback when model personalization fails.
- The subprocess uses the configured DSH profile and its model settings, rather than a hard-coded credential destination.
- Remote resource synchronization is exposed through a user-triggered POST route; fetched resources are validated before being saved.
- The package has no preinstall, install, or postinstall hook.
Source & flagged code
5 flaggedThe plugin is enabled by default and schedules a run after a 90-second first delay, then every hour by default.
index.jsView on unpkg · L76For personalization, it reads credential references from the DSH credentials file and injects missing configured API keys into the child process environment.
index.jsView on unpkg · L474Findings
Affected versions and remediation
This report applies to dsh-plugin-prompt-tips@0.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing dsh-plugin-prompt-tips@0.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.