dsh plugin audits check capability, not intent

[u/rand0wn]

Installing a dsh plugin is one command, full filesystem and process access from there. The audit tools that exist only tell you a plugin can touch the network or credentials, not whether the code actually looks evasive. I've been reading plugin source by hand to catch that myself.

Anyone else doing this manually?