What it doesAI
Integrates WPS/KDocs cloud documents into DeepSeek Harness, enabling natural language file operations like listing, reading, creating, uploading, and searching.
- One-click browser authorization
- List, read, create, upload, and search docs
- Works via chat or API calls
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add github:handsomeboyck/dsh-wps-plugingsInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.
code-exec ×1shell ×10.2.1dsh manifest1ba184342ba42026-08-201ba184342ba4The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
vet verdict: vet: clean · score 87
- R3 · info [certain] — 裸 process 引用（可能为 typeof 探测）
- R6 · info [heuristic] — 字符串特征：child_process 引用
- R2 · medium [likely] — require() 动态模块加载（npm 包内能力触达）
- R3 · info [certain] — 只读 process 成员（能力触达面）：process.cwd
- R11 · medium [likely] — 删除文件操作：fs.unlink（清理操作常见，交由 LLM 审计复核上下文）
vet is advisory and does not change dsh’s four-tier level.
• Static heuristic scan: done (14 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
High-risk findings · 4 / 4
- criticalChild process module usage (Node.js)src/auth/browser-auth.ts:203const { execSync } = await import('child_process');
- criticalShell command execution (exec / execSync)src/auth/browser-auth.ts:204execSync(`${command} ${args.join(' ')}`, { stdio: 'ignore' });
- warningHTTP request to a raw IP addresssrc/auth/browser-auth.ts:152console.log(`[WPS Auth] 本地服务器已启动: http://127.0.0.1:${addr.port}`);
- warningFilesystem write operationssrc/auth/token-store.ts:66await fs.writeFile(TOKEN_FILE, JSON.stringify(tokenInfo, null, 2), 'utf-8');
Heuristic static scan — may produce false positives. Review the source yourself before trusting.
Activity
Last commit 2026-08-20 · activity: Active
• Repo created: 2026-08-20
• Stars: ★ 3 · Forks: 0
• Health: Active — committed within last 30 days