dsh-plugin-sentinel

The DSH community plugin ecosystem is growing fast, but the official docs have long warned that a plugin's prepare script installed from GitHub carries permission to execute code directly on your machine, outside any sandbox the agent runs under. Few developers have the bandwidth to manually audit package.json, source files, and patch configs before every install. dsh-plugin-sentinel fills that gap: it gives DSH a built-in plugin security checkpoint so that auditing before installation becomes a single sentence to your model.

The core tool audit_plugin performs a purely static audit of a single plugin directory or .tgz archive, covering install-time lifecycle scripts, dynamic execution vectors (child_process, eval, new Function), credential access via process.env, outbound network calls, !!js expressions and silent disabling of security lines in cordis.patch.yml, tarball path traversal, and symlinks. audit_installed sweeps every community bundle in your current profile in one pass, automatically marking official built-in packages as trusted. Results are graded pass, review, or block, with a weighted risk score (critical=10, high=5, medium=2, low=1) to speed up decision-making.

The sentinel itself is designed with a zero-attack-surface profile: zero npm dependencies, zero install scripts, zero build step; tar parsing is fully in-memory so malicious payloads never touch disk; lexical scanning strips comments and string literals before pattern matching to balance false-positive avoidance against evasion resistance; and compound rules (e.g. credential reads x outbound network) pinpoint high-confidence threats. It is not a replacement for human review, but it hands you a structured, severity-ranked risk list before you ever run the install command. It suits DSH users who install community plugins regularly, teams with security-compliance requirements, and any agent administrator who wants to install without flying blind.