registry / dsh-plugin-prompt-tool / 0.8.1

dsh-plugin-prompt-tool@0.8.1

⚠ Under review

DSH 插件：提示词工具，规范模型的思维链与回答内容，提供 Web UI 编辑 preset.md 与 AGENTS.md，并按 skills 目录注册可开关技能。

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 116 file(s), 2.45 MB of source

Source & flagged code

4 flagged

preset/pt-cordis/skills/cordis-plugin-development/templates/decoration/client.jsView file

Lines 1-23javascript

1window.__ModuleLoader__.load({

2 id: '@local/my-decoration',

3 factory(require) {

4 const React = require('react');

5 const h = React.createElement;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset/pt-cordis/skills/cordis-plugin-development/templates/decoration/client.jsView on unpkg · L3

6 function Decoration() {

7 return h('svg', {

8 viewBox: '0 0 64 64', width: 48, height: 48,

9 'aria-hidden': true,

10 style: { display: 'block', pointerEvents: 'none' },

11 }, h('circle', { cx: 32, cy: 32, r: 24, fill: '#247bbf' }));

12 }

13 return {

14 inject: ['slots'],

15 apply(ctx) {

16 ctx.slots.inject('conversation.composer.dock', () => ctx.slots.register({

17 name: 'conversation.composer.dock', id: 'my-decoration', order: 5,

18 }, Decoration));

19 },

20 };

21 },

22});

lib/preset-package-BnJqrU4R.mjsView file

2import { basename, dirname, isAbsolute, join, posix, resolve, sep } from "node:path"; L3: import { spawn } from "node:child_process"; L4: import { fileURLToPath, pathToFileURL } from "node:url"; ... L8: import { Buffer as Buffer$1 } from "node:buffer"; L9: import { inflateSync } from "node:zlib"; L10: import { Uint8ArrayReader, Uint8ArrayWriter, ZipReader, ZipWriter } from "@zip.js/zip.js"; ... L21: function resolveDshHome() { L22: const ambient = process.env.DSH_HOME; L23: if (typeof ambient !== "string" || ambient.trim().length === 0) return join(homedir(), ".dsh"); L24: const expanded = ambient === "~" ? homedir() : ambient.startsWith("~/") || ambient.startsWith("~\\") ? join(homedir(), ambient.slice(2)) : ambient; ... L1243: * in section 24.5.1.1 "Runtime Semantics: InternalizeJSON

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/preset-package-BnJqrU4R.mjsView on unpkg · L2

engine/sdk-strip.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

engine/sdk-strip.mjs#virtual:string-array:round1View on unpkg

engine/tool-config-engine.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dsh-plugin-prompt-tool@0.7.2 matchedIdentity = npm:ZHNoLXBsdWdpbi1wcm9tcHQtdG9vbA:0.7.2 similarity = 0.716 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

engine/tool-config-engine.mjsView on unpkg

Source & flagged code

4 flagged · loading source

preset/pt-cordis/skills/cordis-plugin-development/templates/decoration/client.jsView file

3factory(require) { L4: const React = require('react'); L5: const h = React.createElement;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preset/pt-cordis/skills/cordis-plugin-development/templates/decoration/client.jsView on unpkg · L3

lib/preset-package-BnJqrU4R.mjsView file

Findings

2 High4 Medium5 Low

HighSemantic Analysis Limitedengine/sdk-strip.mjs#virtual:string-array:round1

HighPrevious Version Dangerous Deltaengine/tool-config-engine.mjs

MediumDynamic Requirepreset/pt-cordis/skills/cordis-plugin-development/templates/decoration/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/preset-package-BnJqrU4R.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to dsh-plugin-prompt-tool@0.8.1.

See all versions of dsh-plugin-prompt-tool for other recorded verdicts.

Review the evidence and your use of dsh-plugin-prompt-tool@0.8.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 11:20:40.697Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.