dsh.so
EN
English中文
dsh-vision avatar

dsh-vision

Vision for DeepSeek Harness: Doubao Web by default (zero-cost, no API key), Antigravity IDE quota (flash/pro), any IDE CLI, Gemini — auto detail escalation, evidence memory

PluginAI ModelsVisionDeveloperTerminalVision / OCRWeb searchTerminal / Shell
Verification
L2 · Structured
Security
High
Health
Active
Trust
Silver

What it does

Vision for DeepSeek Harness: Doubao Web by default (zero-cost, no API key), Antigravity IDE quota (flash/pro), any IDE CLI, Gemini — auto detail escalation, evidence memory

Installation

dsh plugin --profile web add dsh-vision-8

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN9 FILES
f8b261
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

6 critical·7 warning·18 info·9 files scanned
shell ×4code-exec ×2
Version binding
scanned commitf8b26198aff82026-08-16
latest commitf8b26198aff8

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High6 critical · 7 warning · 18 info

• Static heuristic scan: done (9 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

  • warningHTTP request to a raw IP addressbridge.mjs:5
    const CDP = process.env.CDP_URL || "http://127.0.0.1:9333";
  • warningFilesystem write operationsbridge.mjs:121
    fs.writeFileSync(p, Buffer.from(img.b64, "base64"));
  • infoReads process.envbridge.mjs:5
    const CDP = process.env.CDP_URL || "http://127.0.0.1:9333";
  • infoReads process.envbridge.mjs:6
    const QUEUE = process.env.QUEUE_URL || "http://localhost:9340";
  • infoMakes network requests (fetch / axios)bridge.mjs:133
    await fetch(`${QUEUE}/result`, {
  • infoMakes network requests (fetch / axios)bridge.mjs:140
    await fetch(`${QUEUE}/result`, {
  • infoMakes network requests (fetch / axios)bridge.mjs:154
    const res = await fetch(`${QUEUE}/pending`, { signal: AbortSignal.timeout(8000) });
  • infoHardcoded IP addressbridge.mjs:5
    const CDP = process.env.CDP_URL || "http://127.0.0.1:9333";
  • infoMakes network requests (fetch / axios)src/client/plugin.tsx:139
    const res = await fetch("/api/vision", {
  • criticalChild process module usage (Node.js)src/ide-channels.ts:16
    import { execFile } from "node:child_process";
  • criticalShell command execution (exec / execSync)src/ide-channels.ts:69
    execFile(options.exe, args, {
  • criticalChild process module usage (Node.js)src/index.ts:1
    import { execFile } from "node:child_process";

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-16

• Stars: ★ 4 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/54xkeee/dsh-vision

Was this page helpful?