dsh.so
EN
English中文
dsh-plugin-image-tools avatar

dsh-plugin-image-tools

DSH 图片插件：ask_user_choice 图片/图文混合选择卡（可放大查看）+ show_images 回复内嵌图片。Image choice cards + inline images for DeepSeek Harness (dsh).

PluginVisionVision / OCR
Verification
L1 · Found
Security
High
Health
Active
Trust
Unrated

What it does

DSH 图片插件：ask_user_choice 图片/图文混合选择卡（可放大查看）+ show_images 回复内嵌图片。Image choice cards + inline images for DeepSeek Harness (dsh).

Installation

dsh plugin --profile web add dsh-plugin-image-tools

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN7 FILES
41479c
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

1 critical·5 warning·8 info·7 files scanned
code-exec ×1
Version binding
plugin version0.4.0dsh manifest
scanned commit41479c573f1c2026-08-19
latest commit41479c573f1c

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High1 critical · 5 warning · 8 info

• Static heuristic scan: done (7 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 6 / 6

  • criticalDynamic code execution via the Function constructorscripts/smoke-client.mjs:37
    new Function(code)()
  • warningHTTP request to a raw IP addressscripts/selfcheck.mjs:84
    assert.equal(originOf({ webServer: { host: '127.0.0.1', port: 3080 } }), 'http://127.0.0.1:3080')
  • warningHTTP request to a raw IP addressscripts/selfcheck.mjs:87
    assert.equal(originOf({ webServer: { host: '0.0.0.0', port: 5173 } }), 'http://127.0.0.1:5173')
  • warningHTTP request to a raw IP addressscripts/selfcheck.mjs:90
    assert.equal(originOf(undefined), 'http://127.0.0.1')
  • warningHTTP request to a raw IP addressscripts/smoke-client.mjs:58
    assert.ok(mod.isShowImageSrc('http://127.0.0.1:3080/dsh-plugin-image-tools/show/abc/1'), '绝对 URL 也应被识别')
  • warningHTTP request to a raw IP addressscripts/smoke-server.mjs:184
    assert.ok(url0 && url0.startsWith('http://127.0.0.1:3080'), `URL 应为绝对 origin：${url0}`)

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-19 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/Pasumao/dsh-plugin-image-tools

Was this page helpful?