Install verification: Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — the L1-L5 install ladder does not rate it; the security scan still runs.Install verification details →
What it doesAI
DSH plugin for literature-to-evidence knowledge management, with a dedicated server, Web UI, and agent tools.
- Independent literatum server for literature management
- Web UI for interactive knowledge base access
- Agent tools for evidence and knowledge workflows
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:UnKnownFish125/dsh-literature#v0.5.0Install method: GitHub · runtime test inconclusive (L5 unknown)
Verification & Compatibility○ Ecosystem plugin
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
package manifest not collected — the declared range is unknown.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 | dsh 0.2.0-rc.2 | dsh 0.1.7-rc.2 |
|---|---|---|---|---|---|
| v0.5.0 | ○ | ○ | ○ | ○ | ○ |
v0.5.0github○ 9 ecosystem plugin2026-10-20
https://github.com/UnKnownFish125/dsh-literature
○dsh 0.2.1-rc.2current2026-10-20Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-20 · expires: 2026-10-27
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.42026-10-18Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-18 · expires: 2026-10-25
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.22026-10-12Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-12 · expires: 2026-10-19
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.0-rc.22026-10-09Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-09 · expires: 2026-10-16
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.22026-09-27Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.1.7-rc.2 · profile: l4-sandbox
Issued: 2026-09-27 · expires: 2026-10-04
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-alpha.22026-09-23Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-alpha.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.1.7-alpha.2 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.22026-09-20Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.1.6-alpha.2 · profile: l3-fullscan
Issued: 2026-09-20 · expires: 2026-09-27
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.12026-09-17Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dsh0.1.6-alpha.1 · profile: l4-sandbox
Issued: 2026-09-17 · expires: 2026-09-24
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○prehistory2026-09-30Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: github · https://github.com/UnKnownFish125/dsh-literature#v0.5.0
ID: dsh-literature-3@v0.5.0@dshunknown · profile: l3-fullscan
Issued: 2026-09-30 · expires: 2026-10-07
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Only the latest 3 published versions are shown; source-snapshot (commit hash) groups, unstated groups and older versions are omitted — the full archive stays in the data layer (snapshot/unstated groups appear only when a plugin has no published version).
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-literature-3/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic low — stricter wins → overall low.
—v0.5.0git2026-10-21v0.5.0same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (5)
- warningnetIp · network
kb-server/kb_server.py:30MEMORY_URL = os.environ.get("LITERATURE_MEMORY_URL", "http://127.0.0.1:6230") - warningnetIp · network
literature-server/literature_ingest.py:22DEEP_MEMORY = os.environ.get("LITERATURE_MEMORY_URL", "http://127.0.0.1:6230") - warningnetIp · network
literature-server/literature_ingest.py:25LIT_URL = os.environ.get("LITERATURE_LIT_URL", "http://127.0.0.1:6260") - warningnetIp · network
literature-server/literature_server.py:52"default": f"http://127.0.0.1:{PORT}", - warningnetIp · network
literature-server/literature_upstream.py:18MEMORY_URL = os.environ.get("LITERATURE_MEMORY_URL", "http://127.0.0.1:6230")
show 4 audit findings
- lowAPI token and attachment signing key written with default file permissions
literature-server/literature_server.py:110Files are created with the process umask (typically 0644), so any other local account can read the service Bearer token and the HMAC attachment key, bypassing the loopback-only access model on a shared host.
- lowBearer check silently skipped when token file is empty or unreadable
kb-server/kb_server.py:116The authentication predicate is fail-open: if the token file is missing, empty or unreadable at request time, any local process (or anything that can reach loopback through a proxy) gets full unauthenticated access to the kb endpoints and, through them, to the deepmemory data.
- lowHTML/SVG attachments served inline with extension-derived MIME type
literature-server/literature_server.py:142A signed attachment URL that points at an uploaded .html/.svg renders as active content on the service origin (127.0.0.1:6260), enabling script execution in that origin if a user opens the link; impact is limited because API calls still require the Bearer token.
- lowClient renders document URL directly into href without scheme validation
web-plugin/client.jsA stored document.url of `javascript:...` (settable via the authenticated API or via the unharvested BibTeX/DOI import paths) becomes a clickable link in the DSH client; React does not strip javascript: URLs, so a click executes script in the host UI context.
Loopback-only services with Bearer auth and HMAC-signed attachment URLs; only low-severity hardening gaps found.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-09 · activity: Stable
• Repo created: 2026-09-01
• Stars: ★ 0 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).