dsh-web-file-uploader

A file-upload plugin for the DeepSeek Harness web UI.

PluginBrowserUI & SkinsWeb searchFileStorage

Verification

L2 · Structured

Security

Medium

Health

Active

Trust

Silver

What it does

A file-upload plugin for the DeepSeek Harness web UI.

dsh plugin --profile web add dsh-web-file-uploader

Install method: npm · not yet tested in container (L3+)

DSH Version	Status
not stated	Declared — not tested

Automated static scan, not manual review.

DSH.SOWARNINGSCAN12 FILES

dedce3

Security reviewAutomated review · daily

WARNING

No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).

0 critical·4 warning·7 info·12 files scanned

Version binding

scanned commitdedce39b02822026-08-16

latest commitdedce39b0282

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: Medium0 critical · 4 warning · 7 info

• Static heuristic scan: done (12 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

infoMakes network requests (fetch / axios)client/src/client.js:452
const res = await fetch(url, { method: 'POST', body: bytes })
infoMakes network requests (fetch / axios)client/src/client.js:457
await fetch(url, { method: 'POST' })
infoMakes network requests (fetch / axios)lib/client.js:460
const res = await fetch(url, { method: 'POST', body: bytes })
infoMakes network requests (fetch / axios)lib/client.js:465
await fetch(url, { method: 'POST' })
infoReads process.envlib/index.js:24
const dshHome = () => process.env.DSH_HOME || join(homedir(), '.dsh')
warningBase64 decode-and-run patternsrc/host.js:318
command: 'base64 -d | sha256sum',
warningBase64 decode-and-run patternsrc/host.js:337
command: 'mkdir -p ' + shellQuote(dir) + ' && base64 -d > ' + shellQuote(absPath),
infoMakes network requests (fetch / axios)src/seams/client-static.template.js:46
const res = await fetch(url, { method: 'POST', body: bytes })
infoMakes network requests (fetch / axios)src/seams/client-static.template.js:51
await fetch(url, { method: 'POST' })
warningBase64 decode-and-run patternsrc/seams/host-dynamic.template.js:37
command: 'base64 -d | sha256sum',
warningBase64 decode-and-run patternsrc/seams/host-dynamic.template.js:56
command: 'mkdir -p ' + shellQuote(dir) + ' && base64 -d > ' + shellQuote(absPath),

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-16

• Stars: ★ 5 · Forks: 0

• Health: Active — committed within last 30 days