dsh.so
EN
English中文
@hermes-ai-2026/dsh-browser-agent avatar

@hermes-ai-2026/dsh-browser-agent

Give DeepSeek Harness agents a real browser: 19 browser_* tools driving the built-in sidebar browser. Zero runtime deps.

PluginDesktopBrowserWeb search
Verification
L3 · Install spec
Failed
Risk
Critical
Health
Active
Trust
Silver

Install verification: sandbox install failed (L4) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →

What it does

Give DeepSeek Harness agents a real browser: 19 browser_* tools driving the built-in sidebar browser. Zero runtime deps.

Installation

dsh plugin --profile web add github:hermes-ai-2026/dsh-browser-agent
verified

Install method: GitHub · sandbox install failed (L4)

Verification & Compatibility

Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.

External credentials (plugin-level): none detected

Declared DSH compatibilityfrom package.json · peerDependencies
author declared no dsh version requirement

○ The author declares no dsh version requirement — install is not blocked by version.

Install compatibility matrix (rows = plugin versions〔latest 5〕, columns = dsh versions〔latest 5〕)
At-a-glance → evidence in the cards below
plugin ＼ dshdsh 0.2.1-rc.2
v1.0.1·
Install compatibility (by plugin version, dsh versions within)
Legend:✓ L5 runtime verified○ ecosystem plugin◼ ecosystem app✗ failed
v1.0.1github2026-10-18

https://github.com/hermes-ai-2026/dsh-browser-agent

No runtime install test for this version (static scan only) — compatibility unknown, never assumed.

Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-browser-agent-4.svg)](https://www.dsh.so/artifact/dsh-browser-agent-4/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-browser-agent-4Automated review · daily

Static low, dynamic high — stricter wins → overall high.

static low→dynamic high→overall high
0 critical·0 high
highoverall · high
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin versionv1.0.1dsh manifest
scanned versionv1.0.1git2026-10-21
current versionv1.0.1same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (10)
  • criticaleval · code-execclient/client.js:951

    async eval(ctx, args) {

  • warningnetIp · networkcli/browser.mjs:32

    const BRIDGE = process.env.DSH_BROWSER_BRIDGE ?? 'http://127.0.0.1:8791';

  • warningfsWrite · filescli/browser.mjs:277

    fs.writeFileSync(out, Buffer.from(r.data, 'base64'));

  • warningfsWrite · filescli/browser.mjs:315

    fs.writeFileSync(file, JSON.stringify({ savedAt: new Date().toISOString(), source: target.url, cookies: got.cookies }, null, 2));

  • warningnetIp · networkclient/client.js:26

    const BASE = `http://127.0.0.1:${BRIDGE_PORT}`;

  • warningnetIp · networklib/cdp.js:20

    const res = await fetch(`http://127.0.0.1:${port}/json/version`, {

  • warningnetIp · networklib/cdp.js:38

    const res = await fetch(`http://127.0.0.1:${port}/json/list`, { signal: AbortSignal.timeout(timeoutMs) });

  • warningnetIp · networklib/index.js:452

    const url = new URL(req.url ?? '/', `http://127.0.0.1:${BRIDGE_PORT}`);

  • warningfsWrite · fileslib/index.js:325

    fs.writeFileSync(file, Buffer.from(String(base64), 'base64'));

  • warningfsWrite · fileslib/index.js:1152

    fs.writeFileSync(file, JSON.stringify({ savedAt: new Date().toISOString(), source: target.url, cookies }, null, 2));

2dynamic auditmodel reads redacted source context · never executes plugin code
highest gradehigh
merged intooverall high
audited at2026-10-19
findings0 critical·1 high1 medium / 1 low hidden
show 3 audit findings
  • highrendererEval op executes arbitrary JS inside the DSH renderer and is reachable via the /debug/exec bridge endpointclient/client.js

    The host half lib/index.js exposes POST /debug/exec which calls bridge.send(String(body.op), body.args, ...) with an arbitrary op string. The renderer's OPS table contains rendererEval, which compiles the supplied string with the AsyncFunction constructor and runs it in the DSH renderer context (access to globalThis.dshDesktop.browser lease API, full UI DOM, and every other OPS method). Any party able to POST to the loopback bridge (any local process, and see the static-token finding) obtains arbitrary code execution in the DSH application renderer, not just the guest page.

  • mediumLoopback bridge protected only by a hardcoded shared token and wildcard CORSlib/index.js

    The same BRIDGE_TOKEN literal appears in lib/index.js, client/client.js (const BRIDGE_TOKEN) and cli/browser.mjs (const TOKEN), so it must be a static string shipped inside the package rather than a per-install/per-run secret; any local process can read node_modules source and obtain it. With 'access-control-allow-origin: *' plus an OPTIONS handler that advertises x-dsh-browser-agent, a cross-origin web page that knows the token can send the required header; together with the /debug/exec arbitrary-op endpoint this widens who can drive the browser and reach rendererEval (mainly mitigated in mod

  • lowCookie vault writes httpOnly session cookies to disk in plaintext with default permissionslib/index.js

    browser_cookies export (and the CLI vault) persists cookies including httpOnly session tokens as a plaintext JSON file under ~/.dsh/dsh-browser-agent/vault with default umask permissions. If the home directory or file is group/world readable, another local account can lift authenticated sessions. The feature is user-initiated, limiting exposure.

Powerful browser-automation plugin with reasonable guards, but its token-protected localhost debug bridge can post a rendererEval op that runs arbitrary JS inside the DSH renderer.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-10-15 · activity: Active

• Repo created: 2026-10-15

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/hermes-ai-2026/dsh-browser-agent

Was this page helpful?