dsh.so
EN
English中文
dsh-plugin-tts avatar

dsh-plugin-tts

Edge TTS voice plugin for DeepSeek Harness: read assistant replies aloud, auto-read toggle, voice settings panel (free, no API key)

PluginMediaNetwork
Verification
L2 · Structured
Security
High
Health
Active
Trust
Silver

What it does

Edge TTS voice plugin for DeepSeek Harness: read assistant replies aloud, auto-read toggle, voice settings panel (free, no API key)

Installation

dsh plugin --profile web add dsh-plugin-tts

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN8 FILES
6af92d
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

2 critical·5 warning·17 info·8 files scanned
code-exec ×2
Version binding
scanned commit6af92dd64c432026-08-16
latest commit6af92dd64c43

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High2 critical · 5 warning · 17 info

• Static heuristic scan: done (8 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

  • warningHTTP request to a raw IP addresslib/client.js:2298
    textIn("baseUrl", "http://127.0.0.1:4892"),
  • infoUses localStoragelib/client.js:1412
    localStorage.setItem(
  • infoUses localStoragelib/client.js:1430
    const s = JSON.parse(localStorage.getItem(PKG_SETTINGS_KEY) || "null");
  • infoUses localStoragelib/client.js:1437
    const a = JSON.parse(localStorage.getItem(PKG_ACTIVE_KEY) || "null");
  • infoMakes network requests (fetch / axios)lib/client.js:619
    const response = await fetch("/dsh-tts-api/speak", {
  • infoMakes network requests (fetch / axios)lib/client.js:631
    const r = await fetch(
  • infoMakes network requests (fetch / axios)lib/client.js:704
    const r = await fetch(url);
  • infoHardcoded IP addresslib/client.js:2298
    textIn("baseUrl", "http://127.0.0.1:4892"),
  • criticalChild process module usage (Node.js)lib/index.mjs:13
    import { spawn } from 'node:child_process';
  • warningHTTP request to a raw IP addresslib/index.mjs:234
    baseUrl: 'http://127.0.0.1:4892',
  • warningFilesystem write operationslib/index.mjs:85
    fs.writeFileSync(outPath, buf);
  • infoReads process.envlib/index.mjs:573
    return process.env.DSH_TTS_PACKS_DIR || path.join(os.homedir(), '.dsh', 'tts-rvc', 'packs');

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-16

• Stars: ★ 4 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/1624318455/dsh-plugin-tts

Was this page helpful?