taxueseek/dsh-plugin-guard

README excerpt

dsh-plugin-guard One plugin, two surfaces. Static analysis only — never executes the target plugin. Surface Tool Job Gate plugin audit Static audit before install Gate plugin verify Hash + capability lock after install Clinic plugin peers Local fingerprint peers; query searches GitHub topic:dsh-plugin Clinic plugin detox Mechanical amputation, not an equivalent rewrite plugin peers : path stays local (profile bundles). query hits GitHub topic:dsh-plugin + the curated list; argo only if those are thin. Override with remote . Remote hits are verdict=unknown — audit before install. Install Scoring Start at 100; P0 −40, P1 −12, P2 −3. Any P0 or score < 40 → block . Any P1 or score < 75 → warn . P0 is only auto-run + dangerous combo ( curl bash , secrets leaving the machine, eval of network content, install-script poison). exec inside a tool the model must click is P1. Not - Not output redaction - Not general SAST - Does not prove a plugin is safe - Detox does not keep the original behavior License MIT

Category