Security audit

DSH Plugin Development

Security checks for vulnerabilities and agentic risk

Overview

This plugin-development guide needs review because some troubleshooting steps approve all dependency scripts and retain notes outside the project.

Use a separate development profile. Approve dependency build scripts individually, and keep recovery notes inside the project unless you explicitly want shared agent memory. Pin external packages, forward only necessary credentials, and redact configurations before sharing them. This was a static review; downloaded dependencies and upstream cleanup guarantees remain unverified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (94)

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
` 安装，也不进入任何 DSH profile；**本技能产出的那个 `dsh.bundle` 包才是能装进 DSH 的东西**。找现成插件请去社区插件市场（`references/12-community-plugins.md`）。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
md
| 选型参考；找可借鉴的社区高星插件 | `references/12-community-plugins.md` | 整读 | 中 |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
DSH 每次发版的破坏性变更集中在少数几类。**本节只展开基线所属的最新一个区间；更早的 16 个区间（`dsh-v0.1.5-rc.2` → `0.2.1-rc.3`）见 `references/13-version-history.md` §2。**

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
**更早的 16 个区间（`dsh-v0.1.5-rc.2` → `0.2.1-rc.3`）不在此处重复。** 完整破坏性变更总表（按区间逐行）见 `references/13-version-history.md` §2；作者自报渠道 `!:` 的覆盖率实测与反例见同文件 §2.5。**手上资料早于 `0.2.1-a

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
0 / 0 / 1** —— 而最狠的整族改名一条都没标 —— **`!` 既非充分也非必要，判影响只看两端文件内容的集合 diff**（完整实测与反例见 `13-version-history.md` §2.5）。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
| **目标 DSH 版本高于本技能基线时**（否则不读）；查 tag 版本史、破坏性变更 | `references/13-version-history.md` | 定点：`grep -n '^## '` | 中 |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
md
| 目标版本高于基线，要看上游到底改了什么 | `dsh-version-diff.sh <仓库路径>` | 六维度差异 + 作者自报的 `!:` 破坏性提交；输出可追加到 `13-version-history.md` |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
> **UI 插件是函数式插件的特例**，不是第四种形态——它只是多了一个「浏览器半侧」和若干登记点。判定流程见 `references/01-mental-model.md`。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
站 HTTP / 定时任务）没有独立模板，完整写法见 `references/14-inbound-http-and-timers.md`；更细的路由展开见 `references/01-mental-model.md` §1.1 与 `references/08-cheatsheet.md` A.4，**冲突时以 r

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
| 1 | 选型 | 判定三种形态之一 + 路由到模板 | 形态与模板编号都写下来了，且**没有 `export default`** | `01-mental-model.md` → `02-templates.md` |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
⚠️ **合并多个模板时只有两条规则**：**`inject` 取并集**；**需要清理的副作用包进 `ctx.effect()` 并返回 disposer**（普通注册本身即 effect、会自动回收——见 `01-mental-model.md` §3.6，但显式 `effect` 更稳）。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
| 开始任何插件前；搞不清形态 / profile / 组合包加载机制 / 该选哪个模板 | `references/01-mental-model.md` | 整读 | 中 |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
12 个模板的完整代码、常用 UI 插槽名速查（**节选，非全清单**）在 `references/02-templates.md`；**官方 7 类模板的逐字源码**在 `references/02b-official-templates.md`。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
| 1 | 选型 | 判定三种形态之一 + 路由到模板 | 形态与模板编号都写下来了，且**没有 `export default`** | `01-mental-model.md` → `02-templates.md` |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
| 3 | 最小闭环 | 先做一个能加载、能看到的空插件 | **装进真 profile 后有可见结果**（哪怕只是一条命令返回） | `02-templates.md`（T1 或 T3） |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
md
| **要抄代码时** | `references/02-templates.md` | **定点**：`grep -n '^## T[0-9]'` 取 T1~T12（纯整理稿，1.2k 行） | 中 |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.
md
grep -n '^## T[0-9]' references/02-templates.md # 定位某个模板（T1~T12）

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
12 个模板的完整代码、常用 UI 插槽名速查（**节选，非全清单**）在 `references/02-templates.md`；**官方 7 类模板的逐字源码**在 `references/02b-official-templates.md`。

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
| 要**逐字照抄官方 7 类模板**的完整源码 | `references/02b-official-templates.md` | 定点：册内 `grep -n '^## '` | 高 |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| 2 | 环境 | 版本对照、`DSH_HOME` 位置、从源码跑起来 | `dsh --profile <名字> --dump-config` 能打出组合树 | `06-workflow.md` ① |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
| 7 | 调试 | `--dump-config` 查组合树；PENDING 审计查注入失败；HMR 免重启 | 没有 PENDING 条目、没有静默失败 | `06-workflow.md` ④ |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
| 8 | 打包 | 组合包结构、`package.json`、patch 引用、分发方式对比 | **合同不变量 5 条全过** | `06-workflow.md` ③ |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.
md
| 9 | 安装验证 | `dsh plugin --profile <名字> add <包>`（`--profile` 必填） | 从**最终分发源**重装后仍通过冒烟 | `06-workflow.md` ② |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
1. 插件装上了但**完全没反应** → `06-workflow.md` 第 ④ 部分（`--dump-config` + PENDING 审计）

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
md
| 环境准备 / 安装与 CLI 机制 / 打包分发 / 调试排错（四部分按需选读） | `references/06-workflow.md` | 定点：`grep -n '^## '` | 中 |