dsh.so
EN
English中文
dsh-upgrade-kit avatar

dsh-upgrade-kit

DSH 装备升级套件：看钱（dsh-cost 费用面板）、看文件（file-preview 预览）、搜外网（research-mcp）、看图片（vision-bridge）。一条命令全装。

PluginDeveloperVisionFileWeb searchVision / OCR
Verification
L2 · Structured
Security
Critical
Health
Active
Trust
Silver

What it doesAI

One-command bundle adding cost panel, file preview, web research, and image vision to DSH.

  • Installs all components with a single command
  • Cost panel for monitoring expenses
  • File preview, web search, and vision bridging

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:piggy00544/dsh-upgrade-kit

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITCRITICALc24312
Security reviewAutomated review · daily
CRITICAL

Critical issues in blocking categories (hardcoded secrets, exfiltration endpoints, destructive operations, cryptomining). Treat this plugin as high risk.

5 critical·11 warning·33 info·14 files scanned
code-exec ×4destructive ×1
Version binding
plugin version—
scanned commitc243120f884c2026-08-20
latest commitc243120f884c

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: suspicious

vet verdict: vet: suspicious · score 71

  • R3 · info [certain] — 只读 process 成员（能力触达面）：process.env
  • R3 · info [certain] (downgraded) — 直接访问 process.exit（Node 能力逃逸通道）
  • R3 · info [certain] (downgraded) — 直接访问 process.exit（Node 能力逃逸通道）
  • R6 · info [heuristic] — 字符串特征：process 敏感成员引用
  • R6 · info [heuristic] — 字符串特征：process 敏感成员引用

vet is advisory and does not change dsh’s four-tier level.

Risk: Critical5 critical · 11 warning · 33 info

• Static heuristic scan: done (14 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 12 / 16

  • criticalDestructive rm -rf on root or homemacos/notarize.sh:46
    rm -rf /tmp/dsh-build/staging && mkdir -p /tmp/dsh-build/staging
  • criticalChild process module usage (Node.js)plugins/dsh-cost/lib/index.js:6
    import { execFileSync } from "node:child_process";
  • criticalChild process module usage (Node.js)plugins/dsh-plugin-file-preview/lib/index.js:19
    import { execFileSync } from "node:child_process";
  • criticalChild process module usage (Node.js)plugins/wechat-bridge/dsh-wechat-daemon.mjs:21
    import { spawn, execFileSync } from 'node:child_process';
  • criticalChild process module usage (Node.js)skills/vision-bridge/scripts/vision.mjs:17
    import { execFileSync } from "node:child_process";
  • warningShell command execution (exec / execSync)plugins/dsh-cost/lib/index.js:128
    text = execFileSync("zstd", ["-dc", f], { maxBuffer: 512 * 1024 * 1024 }).toString("utf8");
  • warningShell command execution (exec / execSync)plugins/dsh-plugin-file-preview/lib/index.js:92
    execFileSync("/usr/bin/qlmanage", ["-t", "-s", String(size), "-o", tmp, filePath], {
  • warningShell command execution (exec / execSync)plugins/wechat-bridge/dsh-wechat-daemon.mjs:32
    try { return execFileSync('which', ['dsh'], { encoding: 'utf8' }).trim(); }
  • warningHTTP request to a raw IP addressplugins/wechat-bridge/dsh-wechat-daemon.mjs:37
    const DSH_WEB_URL = process.env.DSH_WEB_URL || 'http://127.0.0.1:3080';
  • warningFilesystem write operationsplugins/wechat-bridge/dsh-wechat-daemon.mjs:55
    fs.appendFileSync(LOG_FILE, line + '\n');
  • warningFilesystem write operationsplugins/wechat-bridge/dsh-wechat-daemon.mjs:75
    fs.writeFileSync(STATE_FILE, JSON.stringify(s), { mode: 0o600 });
  • warningFilesystem write operationsplugins/wechat-bridge/dsh-wechat.mjs:30
    fs.appendFileSync(LOG_FILE, line + '\n');

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 1 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/piggy00544/dsh-upgrade-kit

Was this page helpful?