dsh.so
EN
English中文
dsh-file-viewer avatar

dsh-file-viewer

A universal file preview layer for DeepSeek Harness: open and inspect files right inside the web UI — no external application needed.

PluginUI & SkinsBrowserFileWeb search
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

Universal file preview layer to open and inspect files in the web UI, no external application needed.

  • Renders file previews directly in the harness UI
  • Supports opening and inspecting files without external apps
  • Provides a universal preview layer for multiple file types

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:liguobao/dsh-file-viewer

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITWARNING878118
Security reviewAutomated review · daily
WARNING

No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).

0 critical·4 warning·5 info·15 files scanned
Version binding
plugin version0.1.2dsh manifest
scanned commit8781188f77222026-08-20
latest commit8781188f7722

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: clean

vet verdict: vet: clean · score 94

  • R10 · info [heuristic] — 依赖清单：23 项（@deepseek-ai/schemastery, @types/js-yaml, dompurify, highlight.js, js-yaml, markdown-it, pdfjs-dist, @types/dompurify, @types/markdown-it, @types/node, @types/react, @types/react-dom, esbuild, typescript, vitest, @deepseek-ai/cordis, @deepseek-ai/dsh-client-connection, @deepseek-ai/dsh-client-locale, @deepseek-ai/dsh-client-runtime, @deepseek-ai/dsh-client-ui-slots, @deepseek-ai/dsh-host-apiproxy, @deepseek-ai/dsh-settings, react，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
  • R12 · info [certain] (downgraded) — 入口文件缺失：./dist/index.js
  • R14 · medium [likely] — 脚本下载即执行：curl 下载落盘（脚本随包分发，安装/运行期任意代码执行面）
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.env
  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.env

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium0 critical · 4 warning · 5 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 4 / 4

  • warningHTTP request to a raw IP addressscripts/restart-dsh-web.sh:28
    CODE=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 2 http://127.0.0.1:43124/ 2>/dev/null || echo 000)
  • warningHTTP request to a raw IP addressscripts/restart-dsh-web.sh:68
    CODE=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 2 http://127.0.0.1:43123/ 2>/dev/null || echo 000)
  • warningDownloads a file from the networkscripts/restart-dsh-web.sh:28
    CODE=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 2 http://127.0.0.1:43124/ 2>/dev/null || echo 000)
  • warningDownloads a file from the networkscripts/restart-dsh-web.sh:68
    CODE=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 2 http://127.0.0.1:43123/ 2>/dev/null || echo 000)

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 1 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/liguobao/dsh-file-viewer

Was this page helpful?