Overview
dsh-fleet-audit
DSH agent-fleet hygiene audit: credential-file permissions, embedded credentials in git remotes (masked), provider token-prefix literals. Read-only, zero-dependency, deterministic.
README / EN
Package documentation
Registry summary
DSH agent-fleet hygiene audit: credential-file permissions, embedded credentials in git remotes (masked), provider token-prefix literals. Read-only, zero-dependency, deterministic.
dsh.pub verifies the pinned bundle contract, runtime facts, and distribution semantics. The complete README remains in the source repository.
Read the full README on GitHubLIMITATIONS
Known limitations
- 仅扫描文本类配置文件（不会解析加密存储、系统钥匙串、二进制文件） - token 前缀识别为启发式规则：可能漏报（非常规前缀）或误报（需人工复核） - 默认只检查固定凭据列表；任意路径凭据请通过 `roots` / `files` 显式指定 - 不主动修改任何文件；发现泄漏后请自行 `chmod 600` 并轮换密钥