omdsh-dev/dsh-security-audit
110Last commit Aug 14, 2026
dsh-security-audit DSH plugin
dsh-security-audit performs a defensive, read-only security audit of the local DSH environment. It checks configuration, credential storage metadata, installed plugin origins, critical path permissions, session file structure, and network exposure. The output is a sanitized, reproducible, and locatable risk report without modifying any files or connecting to remote services.
How to install the dsh-security-audit DSH plugin
dsh plugin --profile web add github:omdsh-dev/dsh-security-auditCopying does not run this command. Review the repository and version before installing the dsh-security-audit DSH plugin.
dsh-security-audit DSH plugin data source
dsh-security-audit DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-security-audit DSH plugin can do
- Scan DSH configuration, profiles, environment variables, and credential metadata for secret exposure and misconfigurations
- Audit installed plugin sources, paths, patches, dangerous static capabilities, and install scripts
- Check session directory permissions, symlink escape, and zstd frame structure (with decompression bomb protection)
- Analyze listening configuration, URL classification, plain HTTP, and proxy routing without active network connection
- Generate a summary report with risk verdict and coverage verdict
- Output rules directory with code, severity, and platform applicability
Where the dsh-security-audit DSH plugin fits
- Identify credentials with overly permissive file permissions or exposed in plain text
- Detect plugins from untrusted sources or with suspicious static capabilities (eval, network, process)
- Find session files with structual anomalies or symlink escape risks
- Check if DSH is listening on public interfaces or using insecure HTTP
- Produce a reproducible security audit report for compliance or incident response
Who the dsh-security-audit DSH plugin is for
- DSH users who manage local environments with API keys and tokens
- Security engineers or system administrators performing periodic audits
dsh-security-audit DSH plugin limitations
- Read-only: does not fix any issues automatically
- Local only: does not connect to remote services or scan external networks
- Budget limits: files ≤200, plugins ≤200, sessions ≤1000, findings ≤1000, single source file ≤1 MiB, canonical output ≤2 MiB
- Depends on DSH environment variables ($DSH_HOME) and npm 0.1.0-rc.6 compatibility
- Early version: capabilities may be limited and false positives possible in static source scanning
dsh-security-audit DSH plugin: from the repository README
Quoted from the omdsh-dev/dsh-security-audit README, the upstream source of the dsh-security-audit DSH plugin. Copyright remains with the original authors.
DSH 本机安全审计插件 —— 防御性、只读的安全审计：配置、凭据存储元数据、已安装插件来源、关键路径权限、会话文件结构与网络暴露面。输出脱敏、可复现、可定位的风险报告。 [](LICENSE) 仓库：[https://github.com/omdsh-dev/dsh-security-audit](https://github.com/omdsh-dev/dsh-security-audit)（public） ## 动机 DSH 本地环境承载 API Key、token、会话内容和插件加载边界，误配置（服务监听公网、凭据文件权限过宽、插件来源不可信、会话文件结构异常）会造成真实风险。现有工具没有这个视角： 1. **`plugin-check` 只做结构/合规检查**——不评估凭据暴露面、危险能力和路径逃逸 2. **`session-health` 只做健康诊断**——不涉及来源可信度与安全风险裁定 3. **手工排查不可复现**——凭据位置、权限、监听端口、插件来源分散在多处，逐项人工检查极易遗漏且无法留档 本插件以只读方式审计本机 DSH 环境并输出风险报告：**不自动修复、不连接远程、不执行被审计插件、不把"没读到"当作"安全"**。 ## 安全模型（审计器自身的边界） - **只读**：绝不修改/删除任何文件，绝不执行被审计插件的代码，绝不主动连接远程目标 - **秘密脱敏**：疑似秘密只返回类型 / 长度 / 进程内随机 HMAC fingerprint / 路径 / 行号，**完整值永不出现在 canonical 输出**（设计级保证，非截断） - **路径围栏**：所有路径经 lstat → realpath → containment 检查；`root` 固定为进程启动时解析的 `$DSH_HOME`（或管理员声明的 allowedRoot），模型参数不能扩大读取范围 - **诚实判定**：finding / pass / `skipped` / `error` 四态；`skipped` 与 `error` 不计为 pass（coverage 降为 `incomplete`）；`capability finding` 只提示人工确认、不裁定恶意 - **预算**： - 文件 ≤ 200、插件 ≤ 200、会话 ≤ 1,000、findings ≤ 1,000 - 源码单文件 ≤ 1 MiB（累计 ≤ 64 MiB）；canonical 输出 ≤ 2 MiB - 单 action 10s / report 30s（deadline + AbortSignal 全程检查） - 工具参数会记入会话
Read the full READMERepository license: MIT
dsh-security-audit DSH plugin questions
How do I install dsh-security-audit?
You can install it from GitHub using `dsh plugin --profile web add github:omdsh-dev/dsh-security-audit`. You need DSH 0.1.0-rc.6 or later. Alternatively, you can use the tarball from `npm pack`. The plugin registers a tool called `security_audit`.
Does the plugin modify any files or make network connections?
No, it is strictly read-only. It never modifies, deletes, or executes any files, and it never connects to remote targets. Network scanning (`scan_network`) only parses configuration files and classifies URLs; it does not probe endpoints.
What does the audit report look like?
The output is a JSON object with tool name, version, root path, platform, verdicts (risk and coverage), a summary of findings by severity, and a list of findings with evidence. Sensitive secrets are redacted: only a fingerprint, length, and path are shown.
What platforms are supported?
The plugin is designed to run on Windows, macOS, and Linux. The `rules` action returns rules with platform applicability. The audit actions adjust behavior based on the platform (e.g., path handling).
Can I use this plugin to automatically fix security issues?
No, it is a read-only audit tool. It does not perform any fixes. You must manually address the findings based on the report. The plugin is intended for detection and documentation, not remediation.