registry / dsh-plugin-prompt-tool / 0.5.0

dsh-plugin-prompt-tool@0.5.0

⚠ Under review

DSH 插件：提示词工具，规范模型的思维链与回答内容，提供 Web UI 编辑 preset.md 与 AGENTS.md，并按 skills 目录注册可开关技能。

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 870 KB of source, external domains: www.w3.org

Source & flagged code

3 flagged

lib/client.jsView file

Lines 1-26javascript

1window.__ModuleLoader__.load({

2 id: "dsh-plugin-prompt-tool",

3 factory: (require) => {

4 var module = { exports: {} };

5 var exports = module.exports;

6 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

7 let react_dom_client = require("react-dom/client");

8 let react = require("react");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/client.jsView on unpkg · L6

9 let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");

10 let react_jsx_runtime = require("react/jsx-runtime");

11 //#region node_modules/.pnpm/clsx@2.1.1/node_modules/clsx/dist/clsx.mjs

12 function r(e) {

13 var t, f, n = "";

14 if ("string" == typeof e || "number" == typeof e) n += e;

15 else if ("object" == typeof e) if (Array.isArray(e)) {

16 var o = e.length;

17 for (t = 0; t < o; t++) e[t] && (f = r(e[t])) && (n && (n += " "), n += f);

18 } else for (f in e) e[f] && (n && (n += " "), n += f);

19 return n;

20 }

21 function clsx() {

22 for (var e, t, f = 0, n = "", o = arguments.length; f < o; f++) (e = arguments[f]) && (t = r(e)) && (n &&

23 return n;

24 }

25 //#endregion

26 //#region src/client/tab-key.ts

engine/custom-bash.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

engine/custom-bash.mjs#virtual:normalized:round1View on unpkg

lib/prompt-configs-k7wuZs0C.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-plugin-prompt-tool@0.7.2 matchedIdentity = npm:ZHNoLXBsdWdpbi1wcm9tcHQtdG9vbA:0.7.2 similarity = 0.840 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/prompt-configs-k7wuZs0C.mjsView on unpkg

Source & flagged code

3 flagged · loading source

lib/client.jsView file

6Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" }); L7: let react_dom_client = require("react-dom/client"); L8: let react = require("react");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/client.jsView on unpkg · L6

engine/custom-bash.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

engine/custom-bash.mjs#virtual:normalized:round1View on unpkg

lib/prompt-configs-k7wuZs0C.mjsView file

Findings

2 High4 Medium5 Low

HighSemantic Analysis Limitedengine/custom-bash.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltalib/prompt-configs-k7wuZs0C.mjs

MediumDynamic Requirelib/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to dsh-plugin-prompt-tool@0.5.0.

See all versions of dsh-plugin-prompt-tool for other recorded verdicts.

Review the evidence and your use of dsh-plugin-prompt-tool@0.5.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 01:16:44.006Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.