dsh.so
EN
English中文
deepseek-harness-plugins avatar

deepseek-harness-plugins

deepseek harness plugins view

PluginDeveloperGitHub integrationCode review
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

Aggregates, displays, and security-reviews DeepSeek Harness community plugins with a searchable web page.

  • Daily automatic discovery of GitHub repos with dsh-plugin topic
  • Searchable web directory with filters by category and official mark
  • Multi-language plugin descriptions with Chinese preference

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:writeCasually/deepseek-harness-plugins

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITCRITICALfeb038
Security reviewAutomated review · daily
CRITICAL

Critical issues in blocking categories (hardcoded secrets, exfiltration endpoints, destructive operations, cryptomining). Treat this plugin as high risk.

5 critical·1 warning·14 info·8 files scanned
code-exec ×3shell ×2
Version binding
plugin version—
scanned commitfeb03883eff12026-08-20
latest commita8623c2af9cf

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: clean

vet verdict: vet: clean · score 94

  • R9 · medium [likely] — 正则嵌套量词（ReDoS 风险：(a+)+ 类指数回溯）
  • R3 · info [certain] (downgraded) — 直接访问 process.exit（Node 能力逃逸通道）
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.argv
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.argv
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.env

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium5 critical · 1 warning · 14 info

• Static heuristic scan: done (8 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 6 / 6

  • criticalChild process module usage (Node.js)scripts/security-review.mjs:79
    re: /\bchild_process\.(?:exec|execSync|spawnSync)\s*\(|require\(\s*['"]node:child_process['"]\s*\)[^;\n]{0,60}\.(?:exec|execSync)\s*\(|(?:^|
  • criticalChild process module usage (Node.js)scripts/security-review.mjs:80
    explanation: '通过子进程 shell 执行命令（child_process.exec/execSync）',
  • criticalChild process module usage (Node.js)scripts/security-review.mjs:545
    } else if (/eval\s*\(|new\s+Function\s*\(/i.test(cmd) || /child_process\.exec(Sync)?\s*\(/i.test(cmd)) {
  • criticalspawn() with shell: truescripts/security-review.mjs:86
    explanation: '子进程以 shell 模式启动（spawn(...,{shell:true})）',
  • criticalCommand piped to a shell (curl/wget | sh)scripts/security-review.mjs:56
    explanation: '下载远程脚本并直接执行（curl/wget | sh）',
  • warningCryptocurrency mining indicatorsscripts/security-review.mjs:139
    re: /\b(?:xmrig|moneroocean|cryptonight|stratum\+tcp|kryptex|nanominer)\b/i,

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 2 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/writeCasually/deepseek-harness-plugins

Was this page helpful?