DSH plugin security checklist

Use a three-stage threat model

Security review should cover what happens before DSH starts, what the plugin can do while mounted, and what data leaves the machine.

Before installation

Review the exact source and version you intend to run. Do not rely on a registry grade or a repository star count.

• Confirm the repository owner, license, release history, and open security issues.
• Inspect package scripts, lockfiles, dependencies, downloaded binaries, and shell commands.
• Read the bundle patch to see every plugin row it inserts or overrides.
• Pin a package version, tarball checksum, or Git commit.
• Test in a disposable profile and non-sensitive workspace.

Treat Git build permission as code execution

Git-hosted TypeScript plugins may use a prepare script because Git installs fetch source rather than built output. pnpm 10 blocks this until the package is added to allowBuilds.

Understand the default DSH permission boundary

The official CLI reference says new sessions default to the workspace-write preset with approval set to ask. Bash and filesystem mutations are limited to the session workspace and temporary roots, but reads, network access, and process visibility are not confined.

• Do not assume workspace-write prevents secrets from being read or sent over the network.
• Keep credentials scoped, short-lived, and separate from untrusted test workspaces.
• Avoid danger-full-access unless the task genuinely requires it.
• Review whether a plugin changes sandbox or approval policy.

Review MCP servers as trusted executables

No MCP server is enabled by default. When a DSH configuration starts a stdio MCP command, that command is trusted executable code outside the agent sandbox. For HTTP servers, review the endpoint, TLS, authentication headers, data retention, and exposed tools.

• Pin the MCP package or image version.
• Use a dedicated token with the minimum service permissions.
• Disable tools that are not required.
• Check reconnect behavior and where logs or tool results are retained.

Verify after installation

Dump the effective profile, inspect new rows, boot with a low-risk task, review logs, and confirm removal. Watch for unexpected network destinations, new processes, credential prompts, broad file reads, or configuration changes.

dsh --profile plugin-test --dump-config

Respond to suspicious behavior

Stop the profile, remove the package, preserve relevant logs, and inspect the installed files before deleting evidence. Rotate any credential the plugin could access, revoke external tokens, and rebuild the test profile from a known-good state.