registry / dsh-plugin-prompt-tool / 1.0.0
dsh-plugin-prompt-tool@1.0.0
⚠ Under reviewDSH 插件：提示词工具，规范模型的思维链与回答内容，提供 Web UI 编辑 preset.md 与 AGENTS.md，并按 skills 目录注册可开关技能。
Static Scan Results
scanned 20d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcelib/client.jsView file
6Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
L7: let react = require("react");
L8: let react_jsx_runtime = require("react/jsx-runtime");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/client.jsView on unpkg · L6lib/module-package-Cm3fHHlp.mjsView file
2import { appendFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs...
L3: import { spawn } from "node:child_process";
L4: import { fileURLToPath, pathToFileURL } from "node:url";
...
L8: import { Buffer as Buffer$1 } from "node:buffer";
L9: import { inflateSync } from "node:zlib";
L10: import { Uint8ArrayReader, Uint8ArrayWriter, ZipReader, ZipWriter } from "@zip.js/zip.js";
...
L21: function resolveDshHome() {
L22: const ambient = process.env.DSH_HOME;
L23: if (typeof ambient !== "string" || ambient.trim().length === 0) return join(homedir(), ".dsh");
L24: const expanded = ambient === "~" ? homedir() : ambient.startsWith("~/") || ambient.startsWith("~\\") ? join(homedir(),
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/module-package-Cm3fHHlp.mjsView on unpkg · L2Findings
2 High4 Medium5 Low
HighSemantic Analysis Limitedengine/sdk-strip.mjs#virtual:string-array:round1
HighPrevious Version Dangerous Deltaengine/tool-config-engine.mjs
MediumDynamic Requirelib/client.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/module-package-Cm3fHHlp.mjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dsh-plugin-prompt-tool@1.0.0.
See all versions of dsh-plugin-prompt-tool for other recorded verdicts.
- Review the evidence and your use of dsh-plugin-prompt-tool@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.