⚠️ This repository has been renamed: neltharion11/dsh-luxar-embedded — click to visit the new location. Everything below is preserved as originally indexed.
Install verification: Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — the L1-L5 install ladder does not rate it; the security scan still runs.Install verification details →
Data as of (UTC)
What it doesAI
DeepSeek Harness plugin adding ESP-IDF/ESP32 embedded firmware development tools, with STM32 support planned as a separate package.
- In-process tools layer plus Python FastAPI gateway (/health, /rpc)
- ESP-IDF adaptor package: npm package, cordis patch, manifest
- Isolated repo with shared core lifecycle, data seeds and tests
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:neltharion11/dsh-luxar-embeddingInstall method: GitHub · runtime test inconclusive (L5 unknown) · verified on dsh 0.2.0-rc.2
Verification & Compatibility○ Ecosystem plugin
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
package manifest not collected — the declared range is unknown.
| plugin ＼ dsh | dsh 0.2.0-rc.2 | dsh 0.2.0-rc.1 | dsh 0.1.7-rc.2 | dsh 0.1.7-rc.1 | dsh 0.1.6-alpha.2 |
|---|---|---|---|---|---|
| a032e3 | ○ | ○ | ○ | ○ | ○ |
| 49aff6 | · | · | · | · | · |
a032e3github○ 7 ecosystem plugin2026-10-09
https://github.com/neltharion11/dsh-luxar-embedding
○dsh 0.2.0-rc.22026-10-09Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-09 · expires: 2026-10-16
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.0-rc.12026-09-30Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.1
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.2.0-rc.1 · profile: l4-sandbox
Issued: 2026-09-30 · expires: 2026-10-07
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.22026-09-26Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.1.7-rc.2 · profile: l4-sandbox
Issued: 2026-09-26 · expires: 2026-10-03
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.12026-09-23Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.1
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.1.7-rc.1 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
This level was not executed in this scan.
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.22026-09-20Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.1.6-alpha.2 · profile: l4-sandbox
Issued: 2026-09-20 · expires: 2026-09-27
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.12026-09-18Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dsh0.1.6-alpha.1 · profile: l3-fullscan
Issued: 2026-09-18 · expires: 2026-09-25
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○prehistory2026-10-04Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: github · https://github.com/neltharion11/dsh-luxar-embedding (version unstated)
ID: dsh-luxar-embedding@a032e3@dshunknown · profile: l4-sandbox
Issued: 2026-10-04 · expires: 2026-10-11
View checks & evidence
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
49aff6local2026-09-16
Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — its level reads L5 · Ecosystem plugin.
Author badges
Embed the dsh.so badges in your README to show this plugin's automated security-scan and install-test status:
`[](https://www.dsh.so/artifact/dsh-luxar-embedding/?ref=badge)`dsh.so is an independent community project, not affiliated with or endorsed by DeepSeek AI. Badges are maintained by dsh.so; embed links carry a ?ref= attribution parameter.
Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low; dynamic medium (authoritative when present) → overall medium.
—e2fdcd162951git2026-10-08e2fdcd162951same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (6)
- warningchildProcess · code-exec
packages/dsh-luxar-embedded-core/lib/gateway.js:71const killer = spawn("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { - warningchildProcess · code-exec
packages/dsh-luxar-embedded-core/lib/gateway.js:150const child = spawn(python, [options.entry || embeddedGatewayEntry()], { - warningchildProcess · code-exec
packages/dsh-luxar-embedded-core/lib/gateway.js:243spawnSync("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }); - warningnetIp · network
packages/dsh-luxar-embedded-core/lib/gateway.js:119const url = String(options.url || "http://127.0.0.1:8766").replace(/\/+$/, ""); - warningchildProcess · code-exec
packages/dsh-luxar-embedded-core/lib/process.js:79child = spawn(command, args, { cwd, env, windowsHide: true, signal }); - warningchildProcess · code-exec
packages/dsh-luxar-embedded-core/lib/process.js:125killer = spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
show 4 audit findings
- mediumSTM32 web RPC 'inspect' lets a browser client enumerate arbitrary local directories
packages/dsh-luxar-stm32/lib/web.js:11When the luxar-stm32-web row is enabled, any client that can reach the connection RPC can pass an arbitrary absolute path; Stm32ProjectService.inspect walks up to 768 entries / depth 4 and returns all file names plus the parsed .ioc contents. That discloses local directory structure and project metadata outside any configured workspace.
- lowESP-IDF web RPC forwards arbitrary endpoint names and args to the shared tool dispatcher without an allowlist
packages/dsh-luxar-espidf/lib/web.js:50The handler only special-cases settingsGet/settingsSet and then dispatches every other client-supplied endpoint straight into luxarDispatch. The dispatcher implementation is not part of the harvested files, so the reachable impact cannot be proven here, but the file header states it also serves luxar_pdf_read / luxar_knowledge_search, so a browser client may reach file-reading tool logic without an explicit boundary allowlist.
- lowGateway interpreter is taken from the LUXAR_PYTHON environment variable with a hard-coded developer path fallback
packages/dsh-luxar-embedded-core/lib/gateway.js:134The launcher executes whatever binary LUXAR_PYTHON points at, and LUXAR_SRC (default F:\LUXAR\src) determines the Python module root. Spawn is argv-only so there is no shell injection, but anything able to set the host environment (or write to the hard-coded F: path on Windows) controls which interpreter/code the auto-started gateway runs.
- lowbuildSafeChildEnv propagates every PYTHON* variable into child interpreters
packages/dsh-luxar-embedded-core/lib/process.js:63The whitelist intentionally allows any PYTHON* key, which includes PYTHONPATH and PYTHONSTARTUP; a child Python tool run through this helper will load modules/startup code from paths taken from the parent environment. This only matters if the parent environment is already attacker-influenced, so it is a hardening gap rather than a demonstrated exploit.
No critical/high issue found: shell spawns are argv-only, but web RPC faces expose bounded filesystem enumeration and unvalidated tool dispatch, and the gateway interpreter comes from an env var.
Rule (2026-10-28): when a dynamic conclusion exists it is authoritative (it may raise or lower the level); the static scan tier (vet primary, dsh backstop) applies only when there is none (not queued / audit failed / withdrawn). The audit never writes the exemption list (exemptions are manual only); a wrong conclusion is withdrawn by human review and the tier falls back to the static scan tier.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-16 · activity: Stable
• Repo created: 2026-09-16
• Stars: ★ 0 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).
Frequently asked questions
What is dsh-luxar-embedding?
dsh-luxar-embedding is an ecosystem plugin listed on dsh.so: it installs with dsh plugin add but declares no dsh.bundle and mounts no plugin capability, so installing it adds no plugin functionality — use its source repository directly.
Is dsh.so or this plugin page official?
dsh.so is an independent community registry and is not affiliated with, endorsed by, or sponsored by DeepSeek AI.
How do I install dsh-luxar-embedding?
Run dsh plugin --profile web add github:neltharion11/dsh-luxar-embedding in a DeepSeek Harness (dsh) environment. Note this is an ecosystem plugin: it declares no dsh.bundle and mounts no plugin capability, so installing it adds no plugin functionality — use the source repository directly. The security scan still runs.
How does the security scan relate to a manual audit?
Both layers are automated, not a manual audit. The static scan is heuristic analysis of the repository source, so it can produce false positives and miss context. The model-driven dynamic security audit only covers plugins static-flagged at warn or above, never executes plugin code, and its conclusion is authoritative when there is one (it may raise or lower the static tier); exemptions stay manual. Neither layer is an endorsement: review the repository and the permissions it asks for before installing, together with the verification level and health signals.
How fresh is the data on this page?
The data on this page is as of 2026-10-19 (UTC) — the most recent valid timestamp among the registry refresh, install verification, security scan and dynamic audit. Build time is never used as a data date.