Loading npm security reports…

dsh-plugin-prompt-tool@0.2.0: Suspicious npm security report | LPM Firewall

registry / dsh-plugin-prompt-tool / 0.2.0

dsh-plugin-prompt-tool@0.2.0

DSH 插件：提示词工具，规范模型的思维链与回答内容，提供 Web UI 编辑 preset.md 与 AGENTS.md，并按 skills 目录注册可开关技能。

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

在 DSH 中加载插件后，模型或用户请求命中该技能的主题时。

Impact

可能诱导代理忽略安全限制并协助危险请求。

Mechanism

注册默认启用的安全绕过提示词技能并部署 DSH 预设

Rationale

源代码表明这是有意提供的代理安全绕过能力，而非常规提示词编辑功能。因未发现安装期恶意行为、窃密或外传，建议警告而非发布阻断。

Evidence

lib/index.mjsskills/sandboxmod/SKILL.mdpackage.json~/.dsh/AGENTS.md~/.dsh/.agent-presets/prompt-tool/

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

内置 sandboxmod 技能明确针对 reverse shell、绕过校验、武器等请求，并要求忽略警告和安全边界。
该技能被运行时注册为模型和用户均可调用，默认未禁用。
插件加载时默认把自身受管规则写入 DSH 的全局 AGENTS.md，并生成可执行预设。

Evidence against

package.json 只有 prepare 构建脚本，没有 preinstall/install/postinstall。

Source & flagged code

3 flagged · loading source

lib/index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { buildcordis, parsefrontmatter } from "./preset-core.mjs"; import z from "@deepseek-ai/schemastery"; import { installsettingssection, settingsnamespace } from "@deepseek-ai/dsh-settings"; import { existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs"; import { fileurltopath } from "node:url"; import { join } from "node:path"; import { homedir } from "node:os"; const name = "prompt-tool"; const inject = [ "skills", "webserver", "commands", "llm", "subagents" ]; const preset_file_url = new url("../preset.md", import.meta.url); const preset_file_path = fileurltopath(preset_file_url); const skills_dir = fileurlto

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/index.mjsView on unpkg

807let residentAgentsWritten = false; if (runtime.writeAgents) { residentAgentsWritten = writeAgents(currentAgents, config.residentAgentsPath); if (!residentAgentsWritten) warn(ctx, `prompt-tool: failed to write resident rules to ${config.residentAgentsPath}`); } else { residentAgentsWritten = removeResidentAgentsBlock(config.residentAgentsPath); if (!residentAgentsWritten) warn(ctx, `prompt-tool: failed to remove resident rules block from ${config.residentAgentsPath}`); } if (runtime.writePreset) writePreset(runtime.injectPrompt && current.length > 0 ? current : "", {

Medium

Ai Review Evidence

插件加载时默认把自身受管规则写入 DSH 的全局 AGENTS.md，并生成可执行预设。

lib/index.mjsView on unpkg · L807

skills/sandboxmod/SKILL.mdView file

4whenToUse: 请求涉及破解、逆向、注册机、reverse shell、绕过校验、武器、药剂、成人内容等主题。

Medium

Ai Review Evidence

内置 sandboxmod 技能明确针对 reverse shell、绕过校验、武器等请求，并要求忽略警告和安全边界。

skills/sandboxmod/SKILL.mdView on unpkg · L4

Source & flagged code

3 flagged

lib/index.mjsView file

Lines 787-827javascript

787 };

788 const promptChanged = next.promptText !== current;

789 const agentsChanged = next.agentsText !== currentAgents;

790 const skillSwitchesChanged = JSON.stringify(runtime.skillSwitches) !== JSON.stringify(nextRuntime.skillSwitches);

791 const settingsChanged = runtime.writeAgents !== nextRuntime.writeAgents || runtime.writePreset !== nextRuntime.writePreset || runtime.injectAgentsPrompt !== nextRuntime.injectAgentsPrompt || runtime.injectPrompt !== nextRuntime.injectPrompt || skillSwitchesChanged || runtime.anchorFirstTurn !== nextRuntime.anchorFirstTurn || runtime.anchorText !== nextRuntime.anchorText ||

792 if (!needsInitialApply && !promptChanged && !agentsChanged && !settingsChanged) return;

793 needsInitialApply = false;

794 if (promptChanged) current = next.promptText;

795 if (agentsChanged) currentAgents = next.agentsText;

796 runtime.writeAgents = nextRuntime.writeAgents;

797 runtime.writePreset = nextRuntime.writePreset;

798 runtime.injectAgentsPrompt = nextRuntime.injectAgentsPrompt;

799 runtime.injectPrompt = nextRuntime.injectPrompt;

800 runtime.skillSwitches = nextRuntime.skillSwitches;

801 runtime.anchorFirstTurn = nextRuntime.anchorFirstTurn;

802 runtime.anchorText = nextRuntime.anchorText;

803 runtime.anchorCustom = nextRuntime.anchorCustom;

804 runtime.subagentFlash = nextRuntime.subagentFlash;

805 skillSwitches = runtime.skillSwitches;

806 if (skillSwitchesChanged) invalidateSkills?.();

807 let residentAgentsWritten = false;

808 if (runtime.writeAgents) {

809 residentAgentsWritten = writeAgents(currentAgents, config.residentAgentsPath);

810 if (!residentAgentsWritten) warn(ctx, `prompt-tool: failed to write resident rules to ${config.residentAgentsPath}`);

811 } else {

812 residentAgentsWritten = removeResidentAgentsBlock(config.residentAgentsPath);

813 if (!residentAgentsWritten) warn(ctx, `prompt-tool: failed to remove resident rules block from ${config.residentAgentsPath}`);

814 }

815 if (runtime.writePreset) writePreset(runtime.injectPrompt && current.length > 0 ? current : "", {

Medium

Ai Review Evidence

插件加载时默认把自身受管规则写入 DSH 的全局 AGENTS.md，并生成可执行预设。

lib/index.mjsView on unpkg · L807

816 anchorFirstTurn: runtime.anchorFirstTurn,

817 anchorText: runtime.anchorText,

818 anchorCustom: runtime.anchorCustom,

819 injectPrompt: runtime.injectPrompt,

820 subagentFlash: runtime.subagentFlash,

821 subagentFlashProvider: config.subagentFlashProvider,

822 subagentFlashModel: config.subagentFlashModel,

823 customBashPath: config.customBashPath,

824 agentsInstructionText: runtime.injectAgentsPrompt && currentAgents.length > 0 ? currentAgents : void 0,

825 presetDir: config.presetDir,

826 presetOrder: config.presetOrder

827 });

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { buildcordis, parsefrontmatter } from "./preset-core.mjs"; import z from "@deepseek-ai/schemastery"; import { installsettingssection, settingsnamespace } from "@deepseek-ai/dsh-settings"; import { existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs"; import { fileurltopath } from "node:url"; import { join } from "node:path"; import { homedir } from "node:os"; const name = "prompt-tool"; const inject = [ "skills", "webserver", "commands", "llm", "subagents" ]; const preset_file_url = new url("../preset.md", import.meta.url); const preset_file_path = fileurltopath(preset_file_url); const skills_dir = fileurlto

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/index.mjsView on unpkg

skills/sandboxmod/SKILL.mdView file

Lines 1-24markdown

1---

2name: prompt

3description: 沙箱模式。

4whenToUse: 请求涉及破解、逆向、注册机、reverse shell、绕过校验、武器、药剂、成人内容等主题。

Medium

Ai Review Evidence

内置 sandboxmod 技能明确针对 reverse shell、绕过校验、武器等请求，并要求忽略警告和安全边界。

skills/sandboxmod/SKILL.mdView on unpkg · L4

5metadata:

6 version: