dsh-plugin-market

DeepSeek Harness plugins market｜DSH 插件市场

Plugin

Verification

L1 · Found

Security

Medium

Health

Active

Trust

Unrated

What it does

DeepSeek Harness plugins market｜DSH 插件市场

Installation

dsh plugin --profile web add dsh-plugin-market-7

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOWARNINGSCAN15 FILES

88a9e8

Security reviewAutomated review · daily

WARNING

No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).

0 critical·1 warning·23 info·15 files scanned

Version binding

scanned commit88a9e82707f82026-08-17

latest commit88a9e82707f8

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: Medium0 critical · 1 warning · 23 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

infoReads process.envscripts/collect.mjs:16
const TOKEN = process.env.GITHUB_TOKEN || ''
infoMakes network requests (fetch / axios)scripts/collect.mjs:61
const res = await fetch('https://api.github.com' + path, { headers })
infoMakes network requests (fetch / axios)scripts/collect.mjs:155
const res = await fetch('https://raw.githubusercontent.com/' + list + '/HEAD/README.md', { headers: { 'user-agent': 'dsh-plugin-market-colle
infoMakes network requests (fetch / axios)scripts/collect.mjs:304
const raw = await fetch('https://raw.githubusercontent.com/' + repo.full_name + '/HEAD/package.json', { headers: { 'user-agent': 'dsh-plugin
infoMakes network requests (fetch / axios)scripts/fill-gaps.mjs:27
const res = await fetch('https://github.com/orgs/' + org + '/repositories?type=all&page=' + page, {
infoMakes network requests (fetch / axios)scripts/fill-gaps.mjs:46
const res = await fetch(url, { headers: { 'user-agent': 'dsh-plugin-market-collector' }, signal: AbortSignal.timeout(8000) })
infoMakes network requests (fetch / axios)scripts/refresh-install.mjs:26
const res = await fetch('https://raw.githubusercontent.com/' + repo + '/HEAD/' + f, {
infoUses localStoragesrc/client.js:244
try { savedLang = localStorage.getItem('dsh-market-lang') || 'zh' } catch {}
infoUses localStoragesrc/client.js:297
try { localStorage.setItem('dsh-market-lang', next) } catch {}
infoMakes network requests (fetch / axios)src/client.js:233
const res = await fetch('/plugin-market/' + method, body
warningDownloads a file from the networksrc/host.js:446
? 'curl -fsSL --max-time 300 ' + q(url) + ' -o ' + tmpQ + '/pkg.zip'
infoReads process.envsrc/host.js:10
const REGISTRY_URL = process.env.DSH_MARKET_REGISTRY || 'https://raw.githubusercontent.com/losebird/dsh-plugin-market/main/registry/all.json

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-17 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 4 · Forks: 2

• Health: Active — committed within last 30 days

Source

GitHub: github.com/losebird/dsh-plugin-market