This article is derived from the plugin's already-indexed fields (wiki / faq / compatibility_json / readme), not freshly generated by AI. Source field is noted at the end of each section.

Quick start

dsh-security-audit

— source: plugin_wiki.wiki_content

Install & verify

dsh plugin --profile web add github:omdsh-dev/dsh-security-audit

Run the command above in your DSH Web Profile. Then enable the plugin in the plugin list.

— source: plugins.install

Key points

• 只读：绝不修改/删除任何文件，绝不执行被审计插件的代码，绝不主动连接远程目标
• 秘密脱敏：疑似秘密只返回类型 / 长度 / 进程内随机 HMAC fingerprint / 路径 / 行号，完整值永不出现在 canonical 输出（设计级保证，非截断）
• 路径围栏：所有路径经 lstat → realpath → containment 检查；root 固定为进程启动时解析的 $DSH_HOME（或管理员声明的 allowedRoot），模型参数不能扩大读取范围
• 诚实判定：finding / pass / skipped / error 四态；skipped 与 error 不计为 pass（coverage 降为 incomplete）；capability finding 只提示人工确认、不裁定恶意
• • 文件 ≤ 200、插件 ≤ 200、会话 ≤ 1,000、findings ≤ 1,000

— source: plugin_wiki.readme_en (fallback readme_raw)

FAQ

Will plaintext keys appear in the report?

No. After the plugin reads suspected tokens/keys/private keys/passwords, it immediately calculates a fingerprint using an in-process random HMAC key and writes it to the canonical output. The original value is only used for fingerprint calculation and never leaves the read path (src/redact.ts:83-115 / src/index.ts:53-57).

Will the report modify any files on this machine?

No. The design ensures read-only at the layer level: all paths first use lstat to reject symlinks → realpath → containment validation, root is fixed to the $DSH_HOME resolved at process startup, model parameters cannot expand the read scope; no chmod, no file deletion, no execution of audited plugins, no主动连接远程目标 (src/paths.ts:80-95 / src/index.ts:7-14).

Why doesn't scan_network do actual port probing?

This is an intentional design boundary. scan_network only parses listen/URL/proxy fields from local configuration and classifies them according to specifications. When it cannot determine, it returns unknown-listener-state as an info finding, never actively probes or connects to remote targets, so it will not trigger real network traffic due to auditing (src/network/checks.ts:1-5 / src/rules.ts:61).

Can it run on Windows? What are the differences?

It can run. The plugin itself is a cross-platform Node script; but permission rules on Windows have no zero-side-effect ACL API, so three critical rules (credential-file-permissions, session-root-permissions, session-file-permissions) will return skipped (not pass) on Win32. The report's coverageVerdict will be judged as incomplete (src/platform/windows.ts:7-16 / src/runner.ts:138-150).

What does includeSourceScan do? Should I enable it?

When enabled, it additionally statically scans the .ts/.js/.mjs/.cjs/.tsx/.jsx source code of each installed plugin to match high-risk capability strings like eval, new Function, vm, child_process, spawn, net/http/fetch, WebSocket, etc. Capability hits only generate findings, explicitly do not determine malicious intent, and require manual confirmation of usage; therefore it is slower and may have more false positives. README marks it as optional, defaults to off (src/plugins/source-capabilities.ts:20-24 / src/plugins/source-capabilities.ts:120-155).

Is it bad that coverageVerdict shows incomplete in the report?

It doesn't necessarily mean missed detections. It means critical rules were skipped (platform unsupported or insufficient permissions) or scanner reported an error — Windows permission rules are a typical trigger scenario. Need to look at the report's checks list to see which specific rules were skipped, and decide based on root cause whether to accept current coverage or modify elevation and run again (src/runner.ts:138-150 / src/rules.ts:19-62).

Is strict mode recommended?

For personal self-check, it is recommended to keep it off (default false), to avoid medium findings individually triggering fail and making the report all red; enable strict for formal go-live / CI gate scenarios, treating medium as equivalent to high. High-priority issues found should be directly logged for repair rather than repeatedly re-running (src/runner.ts:129-134 / src/index.ts:73-76).

How to uninstall and downgrade?

Same as other DSH plugins: use the corresponding profile's dsh plugin remove security-audit. This plugin writes no global state, leaves no daemon, and has no side effects outside $DSH_HOME. After removal, audit history only remains in the JSON reports you actively saved.

— source: plugin_wiki.faq_json

Compatibility

• DSH: 0.1.0-rc.8+ (已验证)
• Node: >=22.19.0 或 >=24.0.0
• Platforms: macOS, Linux, Windows

— source: plugin_wiki.compatibility_json

Pitfalls

Review the upstream repo before installing. This guide is auto-derived from indexed fields and may lag the latest release. If anything contradicts the official docs, treat the upstream source as authoritative.

— source: general rule