Install verification: sandbox install ok, web smoke failed (L5) · tested on dsh 0.2.1-rc.3 · last checked Install verification details →
What it doesAI
Controls a remote Windows desktop over plain SSH, offering screenshots, UI Automation reads, click/type/scroll/key input, and app listing or launch.
- Drives a remote Windows box over plain SSH with no pre-installed agent
- Same tool surface as local dsh click: screenshots, UI Automation, click/type/scroll/key
- Harness can run on Linux, macOS or Windows; only the target must be Windows
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:pureexe/dsh-windows-remote-sshInstall method: GitHub · sandbox install ok, web smoke failed (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
Based on 1 requirement(s) across 6 @deepseek-ai/dsh-* packages. raw ranges
>=0.1.2-rc.1 ×6
✓ Running dsh 0.2.1-rc.3 is within the declared range — install is not blocked by version.
Whether it actually runs is a separate question → see the measured matrix below (L1–L5).
| plugin ＼ dsh | dsh 0.2.1-rc.3 current | dsh 0.2.1-rc.2 | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 | dsh 0.2.0-rc.2 |
|---|---|---|---|---|---|
| f3cf9e | ✗ | ✗ | ✗ | ✗ | ✗ |
f3cf9egithub12 failed2026-10-26
https://github.com/pureexe/dsh-windows-remote-ssh
✗dsh 0.2.1-rc.3current2026-10-26L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.3
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.1-rc.3 · profile: l4-sandbox
Issued: 2026-10-26 · expires: 2026-11-02
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-rc.22026-10-19L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-alpha.42026-10-16L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-16 · expires: 2026-10-23
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-alpha.22026-10-11L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-11 · expires: 2026-10-18
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.0-rc.22026-10-09L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-09 · expires: 2026-10-16
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.0-rc.12026-09-30L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.1
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.2.0-rc.1 · profile: l4-sandbox
Issued: 2026-09-30 · expires: 2026-10-07
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.7-rc.22026-09-26L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.7-rc.2 · profile: l4-sandbox
Issued: 2026-09-26 · expires: 2026-10-03
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.12026-09-23not tested
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.1
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.7-rc.1 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
This level was not executed in this scan.
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.7-alpha.22026-09-23L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.7-alpha.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.7-alpha.2 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.6-alpha.22026-09-20L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.6-alpha.2 · profile: l4-sandbox
Issued: 2026-09-20 · expires: 2026-09-27
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.6-alpha.12026-09-17L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.6-alpha.1 · profile: l4-sandbox
Issued: 2026-09-17 · expires: 2026-09-24
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.1.5-rc.22026-09-13L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.1.5-rc.2
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dsh0.1.5-rc.2 · profile: l4-sandbox
Issued: 2026-09-13 · expires: 2026-09-20
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗prehistory2026-10-05L5 · failed
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: github · https://github.com/pureexe/dsh-windows-remote-ssh (version unstated)
ID: dsh-windows-remote-ssh@f3cf9e@dshunknown · profile: l4-sandbox
Issued: 2026-10-05 · expires: 2026-10-12
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-windows-remote-ssh/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low; dynamic high (authoritative when present) → overall high.
v0.1.1dsh manifest0.1.1git2026-10-280.1.1same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (1)
- criticalshellExec · shell
src/ssh/client.ts:87async exec(command: string, signal?: AbortSignal): Promise<ExecResult> {
show 3 audit findings
- highBundle patch enables the arbitrary-PowerShell escape hatch by default
cordis.patch.yml:139The patch the registry applies at profile load sets enablePowerShellTool: true, while the plugin's own comment right above says the tool 'runs an arbitrary script on the remote host with the connected user's full privileges ... so it is off by default; turn it on only for a deployment where the model is fully trusted'. Every install therefore exposes an unscoped, full-privilege remote code execution tool to the agent by default, contradicting the package description ('every mutating action gated by approval').
- highBundle patch disables the approval gate for every mutating action
cordis.patch.yml:45ActionExecutor.gate() returns 'none' immediately when requireApproval is false (src/actions.ts: `if (!this.config.requireApproval) return 'none'`), so click/type/key, filesystem_push/pull, clipboard set, process kill, notify and the PowerShell tool all execute with no human confirmation, even though the patch's own comment above this line says 'Gate every mutating action (click/type/scroll/key/app_launch) behind approval.'
- lowEnv vars can redirect which local helper script is uploaded and executed remotely
src/ssh/bootstrap.ts:33findLocalAsset honours DSH_WINDOWS_REMOTE_SSH_HELPER / DSH_WINDOWS_REMOTE_SSH_VBS and returns them unchanged; their bytes are then staged to the remote host via SFTP (stage()) and launched there, so any process able to set the harness environment can choose the code that runs on the target. Impact is limited because the same environment also carries SSH_HOST/SSH_USER/SSH_PASSWORD, i.e. whoever controls it can already reach the target directly.
Shipped cordis.patch.yml turns on the arbitrary-PowerShell tool and sets requireApproval:false, so the plugin's own approval-gated safety model is off for every install.
Rule (2026-10-28): when a dynamic conclusion exists it is authoritative (it may raise or lower the level); the static scan tier (vet primary, dsh backstop) applies only when there is none (not queued / audit failed / withdrawn). The audit never writes the exemption list (exemptions are manual only); a wrong conclusion is withdrawn by human review and the tier falls back to the static scan tier.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-09 · activity: Active
• Repo created: 2026-09-12
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).