Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it does
把任务派发给本机 ZCode CLI 无头进程的 DeepSeek Harness 插件：面板可监视/终止/续跑/换通道；单写者文件锁 + 用量台账 + 降级链。支持付费套餐与免费额度（Start Plan 活动赠送）两种额度，后者托管官方 agent 走 app-server。
Installation
dsh plugin --profile web add github:Shuffle-1992/dsh-dispatchsecurity scan passed · default branch source
Install method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current |
|---|---|
| fca2c1 | ✓ |
fca2c1github✓ 1 runtime-verified2026-10-19
https://github.com/Shuffle-1992/dsh-dispatch
✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/Shuffle-1992/dsh-dispatch (version unstated)
ID: dsh-dispatch-2@fca2c1@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-dispatch-2/)``[](https://www.dsh.so/artifact/dsh-dispatch-2/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v0.1.0dsh manifest0.1.0git2026-10-2198b87b597804version moved onclean · npmVet is an AST static scan (npm artifact or git source).
show 3 audit findings
- highDelivery filename interpolated unquoted into execSync -> command injection in relay-once.mjs
collab-kit/relay-once.mjs:56msg.name comes straight from readdirSync(collab/inbox-trae) and is concatenated raw into a shell command (JSON.stringify is applied only to the script path, not to the --tag value; the --suite argv is equally raw). Anyone/any agent able to drop a file whose name ends in .md into collab/inbox-trae — the directory this workflow advertises as the delivery inbox, normally populated by another AI agent's output — can execute arbitrary commands with the developer's privileges as soon as relay-once.mjs runs (manually or from a hook). On Windows the payload is constrained by filename-illegal character
- lowUnsolicited inbox file contents injected verbatim into the agent context by SessionStart hooks
collab-kit/inject-inbox.js:52By design, every .md found in collab/inbox-zcode (up to 10 messages x 1500 chars) plus collab/state.json is placed into the model's additionalContext with no sanitisation or provenance marking; trae-session-inject.mjs does the same with 500-char previews from collab/inbox-trae. A file dropped in those directories (by another agent, a compromised dependency, or a prompt-injected tool) can therefore steer the reviewing agent — e.g. to emit an 'approved' verdict or to run the relay script. This is the documented protocol channel rather than a bug, so impact is limited to the trust already placed
- lowProbe script reads the provider API key from disk and sends it to the configured baseURL
tools/probe-start-plan.mjs:14The script parses ~/.zcode/v2/config.json, extracts the plaintext apiKey for builtin:bigmodel-start-plan and sends it as an x-api-key header to whatever baseURL the same config entry holds. There is no evidence of third-party exfiltration (the destination is the user-configured provider endpoint, and the script deliberately prints only the credential's shape/length, never its value), but anyone able to edit that config already controls both key and destination, and the key is transmitted over the network by a dev-only tool.
Runtime entry points dispatch/*.js were not in the harvest; in the audited helper scripts one real command injection exists via the delivery filename passed to execSync in relay-once.mjs.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-21 · activity: Active
• Repo created: 2026-09-30
• Stars: ★ 2 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).