dsh.so
EN
English中文
@ZhaoGC4/dsh-cua-preview avatar

@ZhaoGC4/dsh-cua-preview

Codex-like floating glass preview window for DeepSeek Harness background computer-use (macOS)

Ecosystem appDesktop
Verification
L5 · Ecosystem app
Risk
LowRisk
Health
Active
Trust
Silver

Install verification: Ecosystem app: not installed via dsh plugin add, so the L1-L5 plugin install-verification ladder does not apply; the security scan still runs.

L1–L5 verification rules

What it does

Codex-like floating glass preview window for DeepSeek Harness background computer-use (macOS)

Installation

GitHub repository

Ecosystem apps are not installable via dsh plugin add: desktop / web shells install or deploy through their own release channel (GitHub Releases or the project site).

The level reads L5 · Ecosystem plugin / L5 · Ecosystem app per the three-way classification (the L1-L5 ladder does not rate them); the security scan still runs.

Verification & Compatibility

No verification record yet for this plugin.

  • • Node.js: not stated
  • • DSH: not stated
  • • External credentials: none detected

Author badges

Embed the official badges in your README to showcase security & install-test status:

dsh.so risk
`[![dsh.so risk](https://www.dsh.so/badge/dsh-cua-preview-2.svg)](https://www.dsh.so/artifact/dsh-cua-preview-2/)`

Security Report

Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.

dsh-cua-preview-2Automated review · daily

Static low, dynamic no conclusion — stricter wins → overall low.

static low→dynamic no conclusion→overall low
0 critical·0 high
lowoverall · low
1static scan · vet primaryvet AST static analysis (npm artifact or git source)
Version binding
plugin versionv1.0.0dsh manifest
scanned version1.0.0git2026-10-21
current version1.0.0same version
vet verdictclean · git

Vet is an AST static scan (npm artifact or git source).

show static findings (5)
  • warningshellExec · shellapp/main.js:274

    execFile('/usr/sbin/screencapture', args, { timeout: 3000 }, (error) => {

  • warningfsWrite · filesapp/main.js:76

    if (fs.statSync(LOG_FILE).size > 256 * 1024) fs.writeFileSync(LOG_FILE, '')

  • warningfsWrite · filesapp/main.js:79

    try { fs.appendFileSync(LOG_FILE, `${new Date().toISOString()} ${line}\n`) } catch {}

  • warningfsWrite · filesapp/main.js:104

    fs.writeFileSync(STATE_FILE, JSON.stringify({ x: bounds.x, y: bounds.y }))

  • warningchildProcess · code-execplugin/index.js:216

    const child = spawn(electronPath, ['--no-sandbox', options.appDir], {

2dynamic auditmodel reads redacted source context · never executes plugin code

not in the dynamic queue (queue only covers plugins static-flagged at warn or above) — this does not mean the dynamic audit found it safe.

Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.

Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.

Activity

Last commit 2026-10-21 · activity: Active

• Repo created: 2026-10-21

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/ZhaoGC4/dsh-cua-preview

Was this page helpful?