Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill security-review-cngit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/security-review-cn)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/security-review-cn"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/security-review-cn/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/security-review-cn"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/security-review-cn.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 87 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01185 |
| Opus 5 | $0.00026 | $0.00593 |
| Sonnet 5 | $0.00010 | $0.00237 |
| Haiku 4.5 | $0.00005 | $0.00119 |
Grade B, and why
security-review-cn scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
filename 传入 `a.txt; rm -rf ~` 会执行任意命令。 Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
What it actually says
中文安全审查
从信任边界开始，不要从漏洞清单开始。
先画清楚：哪些数据来自外部、它们流经哪里、在哪一步被当成可信的。绝大多数漏洞都发生在「本来不可信的数据被当成可信」的那个交界处。
第一步：标出外部输入
外部输入不只是用户表单。这些都算：
- HTTP 请求的任何部分（body、query、header、cookie、路径）
- 文件内容、文件名、上传的元数据
- 环境变量、命令行参数、配置文件
- 数据库里的数据（如果曾经由用户写入）
- 第三方 API 的响应
- 模型的输出（在 agent 系统里尤其重要）
最后一条经常被忽略。模型输出会被拼进命令、路径、SQL、HTML 时，它和用户输入一样不可信。
第二步：跟踪它们流到哪
对每个外部输入，追它是否流入这些地方：
| 汇聚点 | 风险 | 检查 |
|---|---|---|
| shell 命令 | 命令注入 | 有没有拼字符串？用了 exec 还是 execFile/数组参数？ |
| 文件路径 | 路径穿越 | 有没有 ..？拼接后是否 resolve 并校验仍在允许根内？符号链接呢？ |
| SQL | 注入 | 参数化查询还是字符串拼接？ |
| HTML/模板 | XSS | 转义了吗？有没有 dangerouslySetInnerHTML 之类 |
| 正则 | ReDoS | 用户能控制正则本身吗？有嵌套量词吗？ |
| 反序列化 | 任意代码执行 | 在反序列化不可信数据吗？ |
| 重定向 URL | 开放重定向 | 目标在白名单里吗？ |
凭据
单独一节，因为泄漏路径太多：
- 不要写进日志，包括错误日志和调试输出
- 不要写进返回给用户的错误信息
- 不要提交进仓库，包括测试 fixture 和文档示例
- 不要放进 URL（会进浏览器历史、代理日志、Referer）
- 不要在诊断包或崩溃报告里带上完整环境变量
检查动作：搜一遍 console.log、日志调用、错误构造，看有没有把整个配置对象或整个 error 打出去。
对外提供诊断导出功能时，默认应该是白名单（只包含明确列出的字段），不是黑名单（排除已知敏感字段）。黑名单永远会漏。
权限
- 默认拒绝，不是默认允许
- 检查放在执行操作的那一层，不只在界面层。绕过 UI 直接调 API 的路径也要有检查
- 覆盖「访问别人的资源」（水平越权），不只是「访问管理员功能」（垂直越权）
- 检查的是当前请求者的权限，不是资源上记录的所有者
一个高频漏洞模式：接口按 id 取资源，取到之后忘了验证这个 id 属不属于当前用户。
沙箱与访问控制不是一回事
这条在 agent 系统里尤其重要。
语言层的访问控制（比如通过代理限制能访问哪些能力）可以约束遵守规则的代码。但如果不可信代码已经拿到了宿主运行时的权限，它可以直接触达底层对象，语言层的检查形同虚设。
真正隔离不可信代码需要外部机制：独立进程、受限运行时、容器、虚拟化。
所以不要说「声明了依赖所以是安全的」。DSH 官方文档在这点上写得很明确：Cordis 提供的是能力式访问控制，沙箱必须由外部提供。
依赖
- 有没有引入维护状态不明的包
- 有没有 postinstall 脚本
- 锁文件提交了吗
- 有没有从非官方源拉包
输出
按可利用性排序，不是按理论严重性：
【高】src/tools/bash.ts:88 — 命令注入
用户提供的 filename 直接拼进 shell 字符串。
filename 传入 `a.txt; rm -rf ~` 会执行任意命令。
修复：改用 execFile 传数组参数，不经过 shell。
每条要有具体的利用路径。说不出怎么利用的，标成「建议」而不是「漏洞」。
不要做的事
- 不要罗列 OWASP 条目而不看具体代码
- 不要把「理论上可能有问题」报成漏洞
- 不要在报告里写出可直接使用的完整攻击载荷
- 不要假设前端校验有效
- 不要认为「内网服务」就不需要鉴权
- 不要把模型输出当成可信数据
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 102 lines · 52 tokens per session scan B b2f68518a54f
security-review-cn is a skill published in the GitHub repository pingfanfan/hello-dsh (90 stars, last pushed 26d ago), licensed MIT. It adds 52 tokens to every session and 1,185 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…
dsh-web-sdk-compatibility
Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…
dsh-web-pet-developer
Create a pet for the dsh-pet plugin and integrate it into the dsh web GUI — author a v2 pet.json manifest plus an 8-column x 9-row atlas per the Codex/hatch-pet contract (live2d pets, voice packs and status decorations included), drop it into the pet-center user directory or contribute it as a built-in asset under…