dsh-endfield-ui

Endfield-inspired industrial UI shell for DeepSeek Harness (dsh) — non-official fan theme. Install: dsh plugin --profile web add @rison/dsh-endfield-ui

PluginUI & SkinsTerminalWeb searchTerminal / Shell

Verification

L1 · Found

Security

High

Health

Active

Trust

Unrated

What it does

Endfield-inspired industrial UI shell for DeepSeek Harness (dsh) — non-official fan theme. Install: dsh plugin --profile web add @rison/dsh-endfield-ui

Installation

dsh plugin --profile web add github:rison114514/dsh-endfield-ui

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN7 FILES

7df4e7

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

4 critical·2 warning·14 info·7 files scanned

code-exec ×4

Version binding

plugin version—

scanned commit7df4e728a8b22026-08-17

latest commit7df4e728a8b2

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High4 critical · 2 warning · 14 info

• Static heuristic scan: done (7 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

criticalChild process module usage (Node.js)desktop-app/main.cjs:3
const { spawn, spawnSync } = require('node:child_process')
infoReads process.envdesktop-app/main.cjs:52
const home = process.env.HOME || ''
infoReads process.envdesktop-app/main.cjs:62
const fromPath = (process.env.PATH || '')
infoReads process.envdesktop-app/main.cjs:72
process.env.DSH_BIN,
criticalChild process module usage (Node.js)desktop-app/scripts/install-plugin.mjs:1
import { spawnSync } from 'node:child_process'
infoReads process.envdesktop-app/scripts/install-plugin.mjs:14
process.env.DSH_BIN,
infoReads process.envdesktop-app/scripts/install-plugin.mjs:25
...process.env,
infoReads process.envdesktop-app/scripts/install-plugin.mjs:26
PATH: [localBin, '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin', process.env.PATH]
criticalChild process module usage (Node.js)scripts/smoke-install.mjs:19
import { spawn, spawnSync } from 'node:child_process'
warningHTTP request to a raw IP addressscripts/smoke-install.mjs:65
if (m) finish(`http://127.0.0.1:${m[1]}`, buf, '')
infoReads process.envscripts/smoke-install.mjs:28
const DSH_BIN = process.env.DSH_BIN || 'dsh'
infoReads process.envscripts/smoke-install.mjs:85
const env = { ...process.env, DSH_HOME }

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-17 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 5 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/rison114514/dsh-endfield-ui