dsh-plugin-prompt-tool@0.3.0: Clean npm security report (Allow)

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 160 KB of source

Source & flagged code

1 flagged

lib/index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { buildcordis, parsefrontmatter } from "./preset-core.mjs"; import z from "@deepseek-ai/schemastery"; import { installsettingssection, settingsnamespace } from "@deepseek-ai/dsh-settings"; import { existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs"; import { fileurltopath } from "node:url"; import { join } from "node:path"; import { homedir } from "node:os"; const name = "prompt-tool"; const inject = [ "skills", "webserver", "commands", "llm", "subagents" ]; const preset_file_url = new url("../preset.md", import.meta.url); const preset_file_path = fileurltopath(preset_file_url); const skills_dir = fileurlto

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/index.mjsView on unpkg

Source & flagged code

1 flagged · loading source

lib/index.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { buildcordis, parsefrontmatter } from "./preset-core.mjs"; import z from "@deepseek-ai/schemastery"; import { installsettingssection, settingsnamespace } from "@deepseek-ai/dsh-settings"; import { existssync, mkdirsync, readfilesync, readdirsync, rmsync, writefilesync } from "node:fs"; import { fileurltopath } from "node:url"; import { join } from "node:path"; import { homedir } from "node:os"; const name = "prompt-tool"; const inject = [ "skills", "webserver", "commands", "llm", "subagents" ]; const preset_file_url = new url("../preset.md", import.meta.url); const preset_file_path = fileurltopath(preset_file_url); const skills_dir = fileurlto

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code