What it does
DeepSeek Harness plugin: heuristic malware vetting for installed third-party plugins
Installation
dsh plugin --profile web add dsh-plugin-vettingInstall method: npm · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.
code-exec ×4aa92e5aa71572026-08-17aa92e5aa7157The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
• Static heuristic scan: done (6 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
Scan findings · 5
- criticalChild process module usage (Node.js)lib/index.js:117if (rs.childProcess > 0) parts.push(`child_process x${rs.childProcess}`);
- infoReads process.envlib/index.js:66return process.env.DSH_HOME ?? join(homedir(), ".dsh");
- criticalChild process module usage (Node.js)lib/scan.js:214const runtimeSurface = { childProcess: 0, fetch: 0, eval: 0, sockets: 0 };
- criticalChild process module usage (Node.js)lib/scan.js:230runtimeSurface.childProcess += (text.match(/child_process(?:\.\w+)?/g) ?? []).length;
- criticalChild process module usage (Node.js)lib/scan.js:231runtimeSurface.childProcess += (text.match(/(?:^|[^.]\b)\bexec(Sync|File)?\s*\(/g) ?? []).length;
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-17 · activity: Active
• Repo created: 2026-08-17
• Stars: ★ 4 · Forks: 2
• Health: Active — committed within last 30 days