Verification
L1 · Found
Security
Medium
Health
Active
Trust
Unrated
What it doesAI
Adds an Instruction Files panel to DeepSeek Harness Web UI showing and managing the active instruction chain for the current session.
- Right-side panel shows live instruction chain
- Mirrors official dsh discovery algorithm
- Manage global to cwd instruction files
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add dsh-inspectorInstall method: npm · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
DSH.SO VETMEDIUMdeef35
Security reviewAutomated review · daily
MEDIUM
Vet verdict is suspicious: findings need human review (exfiltration endpoints, file deletion, etc.).
0 critical·1 high·3 medium·61 score
plugin version
0.1.1dsh manifestscanned commit
deef35863b9b2026-08-21latest commit
deef35863b9bvet verdict
suspicious · npmscore 61Vet is an AST static scan (npm artifact or git source).
`[](https://www.dsh.so/artifact/dsh-inspector/)`Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
Risk details
| Risk | Rule | Location | Description |
|---|---|---|---|
| high | R2 | client.js:148 | new Function / new AsyncFunction 动态执行 |
| medium | R9 | client.js:582 | 正则嵌套量词（ReDoS 风险：(a+)+ 类指数回溯） |
| medium | R9 | client.js:585 | 正则嵌套量词（ReDoS 风险：(a+)+ 类指数回溯） |
| medium | R9 | client.js:591 | 正则嵌套量词（ReDoS 风险：(a+)+ 类指数回溯） |
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-14 · activity: Active
• Repo created: 2026-08-21
• Stars: ★ 7 · Forks: 2
• Health: Active — committed within last 30 days
Source
GitHub: github.com/CocoSgt/dsh-inspector