dsh-design-qa

Design-fidelity QA for DeepSeek Harness: lend any text-only model an eye, then judge whether the implementation matches the mock. Ships the benchmark behind that judgement — four fixtures, 23 injected defects, and every raw model transcript. Retires itself when DeepSeek ships vision.

PluginAI ModelsVisionVision / OCR

Verification

L2 · Structured

Security

High

Health

Active

Trust

Silver

What it does

Installation

dsh plugin --profile web add github:sunxin-ai/dsh-design-qa

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN12 FILES

44cf81

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

3 critical·4 warning·5 info·12 files scanned

code-exec ×2shell ×1

Version binding

plugin version0.1.3dsh manifest

scanned commit44cf819328dd2026-08-19

latest commit44cf819328dd

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High3 critical · 4 warning · 5 info

• Static heuristic scan: done (12 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 7 / 7

criticalChild process module usage (Node.js)eval/evalset/assert.mjs:19
import { execFileSync } from 'node:child_process'
criticalChild process module usage (Node.js)install.mjs:29
import { execFile, spawn } from 'node:child_process'
criticalspawn() with shell: trueinstall.mjs:403
if (argvJson === undefined) spawn(command, { cwd, detached: true, stdio, shell: true }).unref()
warningShell command execution (exec / execSync)eval/evalset/assert.mjs:103
try { raw = execFileSync('diff', [join(dir, 'v1.html'), join(dir, 'v2.html')], { encoding: 'utf-8' }) }
warningFilesystem write operationseval/runs/probe-mobile/tile.mjs:144
fs.writeFileSync(path.join(outDir, `${label}__regions.json`), JSON.stringify(written, null, 2))
warningDownloads a file from the networklib/index.js:250
fail(/* @__PURE__ */ new Error(`dsh-design-qa: 连不上 ${target.origin}（${code}）` + (proxy === void 0 ? "。" : `，用的代理是 ${proxy.origin}（经代理时域名拼错也会
warningDownloads a file from the networksrc/index.ts:360
+ '例如 `curl -L -o /tmp/x.png <地址>`。'

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-18 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 1 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/sunxin-ai/dsh-design-qa