dsh-plugin-prompt-tips@0.2.2
DSH 悬浮精灵「Prompt 小精灵」：每小时从内置资源库推荐一条 OpenAI/Anthropic 官方近期 prompt 技巧并讲清为什么；支持换肤、‹›翻历史（≤10 条）、手动捞一条与一键同步更新。
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically uses configured model credentials for recurring hourly requests by default, which can consume paid API usage without a separate user request for each call. Although that behavior supports the advertised personalization feature and uses the user’s configured DSH model, the automatic recurring use of keys falls under the package firewall’s rule for using user keys without a request.
Static reason
No blocking static signals were detected.
Trigger
Plugin startup, followed by a scheduled recommendation after the default 90-second delay and every hour thereafter.
Impact
This can make recurring model requests and incur usage or charges without a separate user request for each invocation.
Mechanism
By default, it reads configured API key references from the DSH credentials file, injects missing keys into the environment, and spawns `dsh` with the recommendation prompt.
Attack narrative
When the host loads the plugin, it enables a scheduler by default. After a short delay and then hourly, it builds a recommendation prompt, reads configured API key references from the DSH credentials file, and launches the configured DSH profile with those credentials. This causes recurring model use without a separate request for each call, potentially consuming paid API usage.
AI rationale
The package automatically uses configured model credentials for recurring hourly requests by default, which can consume paid API usage without a separate user request for each call. Although that behavior supports the advertised personalization feature and uses the user’s configured DSH model, the automatic recurring use of keys falls under the package firewall’s rule for using user keys without a request.
Evidence
package.jsonindex.js~/.dsh/storages/dsh-prompt-tips.headless-overlay.yml~/.dsh/storages/dsh-prompt-tips.json
Network endpoints1
raw.githubusercontent.com/yuna78/dsh-prompt-tips/main/resources/index.json
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The plugin is enabled by default and schedules a run after a 90-second first delay, then every hour by default.
- For personalization, it reads credential references from the DSH credentials file and injects missing configured API keys into the child process environment.
- The child process runs the configured `dsh` command with the prompt; personalization is enabled by default.
- After initialization, the plugin arms its scheduler, which automatically runs recommendations and repeats them at the configured interval.
- The package describes hourly prompt recommendations and offers an offline fallback when model personalization fails.
Evidence against
- The subprocess uses the configured DSH profile and its model settings, rather than a hard-coded credential destination.
- Remote resource synchronization is exposed through a user-triggered POST route; fetched resources are validated before being saved.
- The package has no preinstall, install, or postinstall hook.
Behavioral surface
ChildProcessEnvironmentVars
Source & flagged code
5 flaggedindex.jsView file
23import { readFileSync, statSync } from 'node:fs';
L24: import { spawn } from 'node:child_process';
L25: import { dirname, join } from 'node:path';
High
76enabled: raw.enabled !== false,
everySeconds: int(raw.everySeconds, 3600, 60, 7 * 24 * 3600),
firstDelaySeconds: int(raw.firstDelaySeconds, 90,
High
Ai Review Evidence
The plugin is enabled by default and schedules a run after a 90-second first delay, then every hour by default.
index.jsView on unpkg · L76474export function readCredentialRefs(env = process.env) {
try {
const file = join(resolveDshHome(env), '.credentials.yaml');
const text = readFileSync(file,
High
Ai Review Evidence
For personalization, it reads credential references from the DSH credentials file and injects missing configured API keys into the child process environment.
index.jsView on unpkg · L474Findings
5 High2 Medium5 Low
HighChild Processindex.js
HighSame File Env Network Executionindex.js#virtual:normalized:round1
HighSemantic Analysis Limitedassets/icon.svg
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-plugin-prompt-tips@0.2.2.
See all versions of dsh-plugin-prompt-tips for other recorded verdicts.
- Avoid installing dsh-plugin-prompt-tips@0.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.