dsh.so
EN
English中文
deepseek-harness-desktop avatar

deepseek-harness-desktop

DeepSeek Harness 的非官方桌面封装：本地优先、沙箱隔离，内置 dsh 版本管理与插件管理，支持自动更新与任务完成桌面通知（macOS）。

PluginDesktopAutomationSecurityNotifications
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

非官方桌面封装，本地优先、沙箱隔离，内置版本与插件管理，支持自动更新和桌面通知。

  • 本地优先与沙箱隔离
  • 内置 dsh 版本管理与插件管理
  • 支持自动更新与 macOS 桌面通知

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:krystal-cao/deepseek-harness-desktop

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITMEDIUM6959be
Security reviewAutomated review · daily
MEDIUM

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

4 critical·3 warning·0 info·15 files scanned
code-exec ×2shell ×2
Version binding
plugin version0.3.2
scanned commit6959be76b7f12026-08-20
latest commit6959be76b7f1

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: suspicious

vet verdict: vet: suspicious · score 49

  • R10 · high [likely] — install 钩子：package.json scripts.postinstall（安装期任意代码执行面）
  • R10 · info [heuristic] — 依赖清单：24 项（@deepseek-ai/cordis-plugin-group, @deepseek-ai/dsh, @deepseek-ai/dsh-anonymous-user-id, @deepseek-ai/dsh-atomic-write, @deepseek-ai/dsh-bash-local, @deepseek-ai/dsh-code-runtime, @deepseek-ai/dsh-compaction, @deepseek-ai/dsh-fs, @deepseek-ai/dsh-invariants, @deepseek-ai/dsh-output-retention, @deepseek-ai/dsh-sandbox, @deepseek-ai/dsh-scope, @deepseek-ai/dsh-session-telemetry, @deepseek-ai/dsh-session-title-llm, @deepseek-ai/dsh-shell, @deepseek-ai/dsh-spill, @deepseek-ai/dsh-subagent-in-process-driver, @deepseek-ai/dsh-subprocess, @deepseek-ai/dsh-timeout, @deepseek-ai/dsh-workflow, electron-updater, electron, electron-builder, pnpm，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
  • R12 · info [certain] (downgraded) — 入口文件缺失：src/main.js
  • R2 · high [likely] — require('node:child_process') 危险内置模块（执行/网络能力触达）
  • R2 · medium [likely] — require('node:path') 标准内置模块

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium4 critical · 3 warning · 0 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 7 / 7

  • criticalChild process module usage (Node.js)scripts/after-pack.cjs:1
    const { execFileSync } = require('node:child_process')
  • criticalChild process module usage (Node.js)scripts/bump-dsh.mjs:7
    import { execFileSync } from 'node:child_process'
  • criticalShell command execution (exec / execSync)scripts/bump-dsh.mjs:40
    execFileSync('npm', installArgs, { cwd: root, stdio: 'inherit' })
  • criticalShell command execution (exec / execSync)scripts/bump-dsh.mjs:46
    execFileSync('npm', installArgs, { cwd: root, stdio: 'inherit' })
  • warningShell command execution (exec / execSync)scripts/after-pack.cjs:8
    execFileSync('codesign', ['--force', '--deep', '--sign', '-', '--timestamp=none', appPath], {
  • warningShell command execution (exec / execSync)scripts/after-pack.cjs:11
    execFileSync('codesign', ['--verify', '--deep', '--strict', '--verbose=2', appPath], {
  • warningShell command execution (exec / execSync)scripts/bump-dsh.mjs:37
    const npmMajor = Number(execFileSync('npm', ['-v'], { encoding: 'utf8' }).trim().split('.')[0])

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 1 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/krystal-cao/deepseek-harness-desktop

Was this page helpful?