dsh.so
EN
English中文
dsh-generative-ui avatar

dsh-generative-ui

Streaming generative UI for DeepSeek Harness — the agent writes TSX, the web client renders it live, inline in chat and as a canvas panel

PluginUI & SkinsWeb search
Verification
L2 · Structured
Security
Medium
Health
Active
Trust
Silver

What it doesAI

Streaming generative UI plugin that lets the agent write TSX and the web client render it live in chat and canvas.

  • Generative UI: agent produces TSX code
  • Live streaming render in web client
  • Inline chat and canvas panel display

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:CNSeniorious000/dsh-generative-ui

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITMEDIUM0a348f
Security reviewAutomated review · daily
MEDIUM

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

2 critical·0 warning·1 info·15 files scanned
code-exec ×1shell ×1
Version binding
plugin version0.0.0dsh manifest
scanned commit0a348f07cf982026-08-20
latest commit90747cebc336

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: clean

vet verdict: vet: clean · score 94

  • R10 · info [heuristic] — 依赖清单：29 项（@esm.sh/tsx, partial-react, partial-tsx, @deepseek-ai/cordis, @deepseek-ai/dsh-client-locale, @deepseek-ai/dsh-client-runtime, @deepseek-ai/dsh-client-ui-conversation, @deepseek-ai/dsh-client-ui-layout, @deepseek-ai/dsh-client-ui-slots, @deepseek-ai/dsh-host-webserver, @deepseek-ai/dsh-skill, @deepseek-ai/dsh-system-prompt, @types/node, @types/react, @types/react-dom, oxfmt, oxlint, pkg-pr-new, react, react-dom, typescript, @deepseek-ai/cordis, @deepseek-ai/dsh-client-locale, @deepseek-ai/dsh-client-runtime, @deepseek-ai/dsh-client-ui-conversation, @deepseek-ai/dsh-client-ui-slots, @deepseek-ai/dsh-host-webserver, @deepseek-ai/dsh-skill, react，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
  • R12 · info [certain] (downgraded) — 入口文件缺失：./lib/index.js
  • R3 · info [certain] (downgraded) — 直接访问 process.exit（Node 能力逃逸通道）
  • R6 · info [heuristic] — 字符串特征：child_process 引用
  • R2 · medium [likely] — require() 动态模块加载（npm 包内能力触达）

vet is advisory and does not change dsh’s four-tier level.

Risk: Medium2 critical · 0 warning · 1 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 2 / 2

  • criticalChild process module usage (Node.js)scripts/typecheck.mjs:7
    import { spawnSync } from "node:child_process";
  • criticalspawn() with shell: truescripts/typecheck.mjs:9
    const { stdout } = spawnSync("tsc", ["--noEmit", "--pretty", "false"], { encoding: "utf8", shell: true });

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 1 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/CNSeniorious000/dsh-generative-ui

Was this page helpful?