dsh.so
EN
English中文
dsh-plugin-subhub avatar

dsh-plugin-subhub

Bring third-party subscription accounts into DeepSeek Harness - 为 DeepSeek Harness 接入第三方订阅账户(当前支持 OpenAI / ChatGPT 订阅,更多订阅服务规划中)

PluginAI Models
Verification
L2 · Structured
Security
High
Health
Active
Trust
Silver

What it does

Bring third-party subscription accounts into DeepSeek Harness - 为 DeepSeek Harness 接入第三方订阅账户(当前支持 OpenAI / ChatGPT 订阅,更多订阅服务规划中)

Installation

dsh plugin --profile web add dsh-plugin-subhub

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN7 FILES
e2aa53
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

1 critical·1 warning·14 info·7 files scanned
code-exec ×1
Version binding
scanned commite2aa53ed93d22026-08-16
latest commite2aa53ed93d2

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High1 critical · 1 warning · 14 info

• Static heuristic scan: done (7 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

  • criticalChild process module usage (Node.js)scripts/demo-gif.mjs:35
    import { spawn, spawnSync } from 'node:child_process'
  • warningHTTP request to a raw IP addressscripts/demo-gif.mjs:125
    const base = `http://127.0.0.1:${PORT}`
  • infoReads process.envscripts/demo-gif.mjs:133
    env: { ...process.env, DSH_HOME: TEMP_HOME },
  • infoReads process.envscripts/demo-gif.mjs:139
    env: { ...process.env, DSH_HOME: TEMP_HOME },
  • infoMakes network requests (fetch / axios)scripts/demo-gif.mjs:90
    const res = await fetch(url)
  • infoHardcoded IP addressscripts/demo-gif.mjs:125
    const base = `http://127.0.0.1:${PORT}`
  • infoMakes network requests (fetch / axios)src/client.js:200
    const response = await fetch(`${API}${path}${sep}locale=${encodeURIComponent(uiLocale)}`, {
  • infowindow.open() navigationsrc/client.js:653
    onClick: () => window.open(login.verificationUrl, "_blank", "noopener,noreferrer")
  • infoHardcoded IP addresssrc/client.js:46
    localOnly: "该功能仅支持在本机打开时使用(地址为 127.0.0.1 或 localhost)。请改用本机地址打开此页面。",
  • infoHardcoded IP addresssrc/client.js:94
    localOnly: "This feature only accepts requests from this machine (127.0.0.1 / localhost). Open the page via a local address.",
  • infoMakes network requests (fetch / axios)src/device-flow.js:21
    return fetch(url, {
  • infoMakes network requests (fetch / axios)src/device-flow.js:104
    const exchangeResponse = await fetch(`${ISSUER}/oauth/token`, {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-16

• Stars: ★ 4 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/kinoward/dsh-plugin-subhub

Was this page helpful?