dsh-oomol

OOMOL Connector for DeepSeek Harness—discover connected apps and execute Actions through progressive MCP discovery without exposing provider credentials.

Plugin

Verification

L2 · Structured

Security

High

Health

Active

Trust

Silver

What it does

OOMOL Connector for DeepSeek Harness—discover connected apps and execute Actions through progressive MCP discovery without exposing provider credentials.

Installation

dsh plugin --profile web add dsh-oomol

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN15 FILES

fe2652

Security reviewAutomated review · daily

HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

1 critical·0 warning·8 info·15 files scanned

code-exec ×1

Version binding

plugin version0.1.4dsh manifest

scanned commitfe265261e4cf2026-08-17

latest commitfe265261e4cf

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High1 critical · 0 warning · 8 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 9

criticalChild process module usage (Node.js)scripts/doctor.mjs:1
import { spawnSync } from "node:child_process"
infoReads process.envscripts/doctor.mjs:9
detail: process.env.OOMOL_MCP_API_KEY ? "configured in the launching environment" : "not set",
infoReads process.envscripts/doctor.mjs:11
ok: Boolean(process.env.OOMOL_MCP_API_KEY),
infoReads process.envscripts/verify-connector.mjs:3
const key = process.env.OOMOL_MCP_API_KEY?.trim()
infoReads process.envscripts/verify-connector.mjs:10
readEnvironment: (name) => process.env[name],
infoMakes network requests (fetch / axios)scripts/verify-connector.mjs:15
const response = await fetch(url, { headers: connection.headers, signal: AbortSignal.timeout(15_000) })
infowindow.open() navigationsrc/client/connections.tsx:911
popup = window.open("", `oomol-connect-${provider.service}`, "popup=yes,width=560,height=720,resizable=yes,scrollbars=yes")
infoHardcoded IP addresssrc/client/connections.tsx:1173
<path d="M12 .7a11.5 11.5 0 0 0-3.64 22.4c.58.1.79-.25.79-.56v-2.23c-3.22.7-3.9-1.37-3.9-1.37-.52-1.34-1.29-1.7-1.29-1.7-1.05-.72.08-.7.08-.
infoMakes network requests (fetch / axios)src/connections.ts:152
response = await fetch(url, {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-17 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 10 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/oomol-lab/dsh-oomol