Install verification: Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — the L1-L5 install ladder does not rate it; the security scan still runs.Install verification details →
What it doesAI
Windows desktop automation plugin for DeepSeek Harness (DSH) agents, allowing agents to see and control the screen.
- Windows desktop automation
- DeepSeek Harness agent integration
- Enables agent screen perception
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:jaychouu/see_the_screenInstall method: GitHub · runtime test inconclusive (L5 unknown)
Verification & Compatibility○ Ecosystem plugin
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 | dsh 0.2.0-rc.2 | dsh 0.2.0-rc.1 |
|---|---|---|---|---|---|
| c3d38c | · | · | · | · | · |
| 4df4eb | ○ | ○ | ○ | ○ | ○ |
c3d38clocal2026-09-05
Ecosystem plugin: installs via dsh plugin add but declares no dsh.bundle and mounts no plugin capability — its level reads L5 · Ecosystem plugin.
4df4ebgithub○ 14 ecosystem plugin2026-10-19
https://github.com/jaychouu/see_the_screen
○dsh 0.2.1-rc.2current2026-10-19Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.42026-10-17Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-17 · expires: 2026-10-24
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.1-alpha.22026-10-11Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-11 · expires: 2026-10-18
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.0-rc.22026-10-09Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.2.0-rc.2 · profile: l4-sandbox
Issued: 2026-10-09 · expires: 2026-10-16
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.2.0-rc.12026-09-30Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.2.0-rc.1
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.2.0-rc.1 · profile: l4-sandbox
Issued: 2026-09-30 · expires: 2026-10-07
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.22026-09-26Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.7-rc.2 · profile: l4-sandbox
Issued: 2026-09-26 · expires: 2026-10-03
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-rc.12026-09-24Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-rc.1
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.7-rc.1 · profile: l4-sandbox
Issued: 2026-09-24 · expires: 2026-10-01
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
This level was not executed in this scan.
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.7-alpha.22026-09-23Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.7-alpha.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.7-alpha.2 · profile: l4-sandbox
Issued: 2026-09-23 · expires: 2026-09-30
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.22026-09-19Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.6-alpha.2 · profile: l4-sandbox
Issued: 2026-09-19 · expires: 2026-09-26
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.6-alpha.12026-09-17Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.6-alpha.1
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.6-alpha.1 · profile: l4-sandbox
Issued: 2026-09-17 · expires: 2026-09-24
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.5-rc.22026-09-11Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.5-rc.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.5-rc.2 · profile: l4-sandbox
Issued: 2026-09-11 · expires: 2026-09-18
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.3-alpha.22026-09-08Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.3-alpha.2
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.3-alpha.2 · profile: l4-sandbox
Issued: 2026-09-08 · expires: 2026-09-15
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○dsh 0.1.3-alpha.12026-09-07Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: 0.1.3-alpha.1
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dsh0.1.3-alpha.1 · profile: l4-sandbox
Issued: 2026-09-07 · expires: 2026-09-14
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
○prehistory2026-10-05Ecosystem plugin
- • Node.js: v24.14.0
- • DSH: unknown
- • Plugin artifact: github · https://github.com/jaychouu/see_the_screen (version unstated)
ID: see-the-screen@4df4eb@dshunknown · profile: l4-sandbox
Issued: 2026-10-05 · expires: 2026-10-12
View checks & evidence
not in scope for web smoke; see prior standard-profile records
not in scope for web smoke; see prior standard-profile records
not present in web-profile loader inventory
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/see-the-screen/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v1.0.01.0.0git2026-10-211.0.0same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (10)
- criticalshellExec · shell
src/plugins/desktop-control/index.ts:816execSync(`start "" "${appPath}"`, { windowsHide: true, shell: 'cmd.exe', timeout: 15000 }); - criticalshellExec · shell
src/plugins/desktop-control/index.ts:1043const result = execSync( - criticalshellExec · shell
src/plugins/desktop-vision/index.ts:858const result = execSync( - criticalshellExec · shell
src/plugins/safety-guard/index.ts:229execSync(`powershell -Command "${psScript.replace(/"/g, '\\"')}"`, { windowsHide: true, timeout: 2000 }); - criticalshellExec · shell
src/server.ts:55execSync(`start "" "${url}"`, { windowsHide: true, shell: 'cmd.exe' }); - warningchildProcess · code-exec
src/plugins/desktop-control/index.ts:819const child = spawn(appPath, args, { - warningchildProcess · code-exec
src/plugins/desktop-control/index.ts:1018const child = spawn('powershell', [ - warningfsWrite · files
src/plugins/desktop-control/index.ts:1012fs.writeFileSync(tmpFile, '\ufeff' + dpiPreamble + '\n' + script, { encoding: 'utf8' }); - warningfsWrite · files
src/plugins/desktop-control/index.ts:1041fs.writeFileSync(tmpFile, '\ufeff' + dpiPreamble + '\n' + script, { encoding: 'utf8' }); - warningfsWrite · files
src/plugins/desktop-vision/index.ts:856fs.writeFileSync(tmpFile, '\ufeff' + dpiPreamble + '\n' + script, { encoding: 'utf8' });
show 6 audit findings
- highrun_command tool executes arbitrary OS commands from LLM-supplied input
src/plugins/desktop-control/index.ts:329The tool passes the raw 'command' string to child_process exec with no allow-list, sandbox or argument validation, giving the tool-calling model (and therefore anyone who can influence its context, e.g. via on-screen text or the Web UI task API) unrestricted command execution with the user's privileges on the Windows host.
- highUnauthenticated local Web/WebSocket API can drive the agent and execute commands
src/server.ts:108Neither the HTTP routes (/api/task, /api/command) nor the WebSocket at path '/ws' (line 34) require authentication or verify the Origin header. WebSockets are not protected by the same-origin policy, so any web page the user visits while the Web UI is running can open ws://127.0.0.1:3000/ws and submit tasks/commands; combined with run_command and the desktop-control tools this yields remote-triggered command execution and full desktop control.
- highlaunch_app builds a shell command from unvalidated appPath (command injection)
src/plugins/desktop-control/index.ts:813appPath comes straight from the model's tool arguments; URL-like values are interpolated into a cmd.exe command line, and the non-URL branch calls spawn(appPath, args, { shell: true }) (line 816-821). A value containing cmd metacharacters (e.g. a quote plus '& calc') executes arbitrary additional commands, so launch_app is a second, less obvious RCE path.
- mediumUntrusted on-screen text is returned verbatim into the agent context that decides tool calls
src/plugins/desktop-vision/index.tsOCR output and window titles (attacker-influenced: web pages, chat messages, file names) are copied verbatim into the tool result fed to the LLM, with no data/instruction separation or provenance marking. Any page or window whose text contains instructions can steer the model into calling run_command, launch_app or type_text — an indirect prompt-injection path to local code execution.
- mediumTool arguments are interpolated into PowerShell double-quoted strings without neutralizing $() subexpressions
src/plugins/desktop-control/index.ts:905escapePS only doubles single quotes and escapes double quotes; inside a PowerShell double-quoted string a value such as $(Start-Process calc) is still evaluated, so a window-title keyword (a value the model copies out of attacker-controlled window titles) can execute arbitrary PowerShell. desktop-vision has the same pattern with the region object (`"${regionStr}"` inside the capture script), and no numeric validation is performed there either.
- lowFull-screen screenshots are persisted on disk and never cleaned up automatically
src/plugins/desktop-vision/index.tsEvery screenshot call writes a PNG of the entire screen (potentially passwords, private chats, tokens) into <cwd>/temp/screenshots. cleanupTempFiles() exists but is never invoked in the harvested code, and the default saveScreenshot=true keeps the file, so plaintext screen captures accumulate indefinitely.
Desktop-automation agent exposing unrestricted shell execution (run_command/launch_app), an unauthenticated loopback Web/WS control API, and untrusted screen text flowing into LLM tool calls.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-09-04 · activity: Stable
• Repo created: 2026-09-04
• Stars: ★ 0 · Forks: 0
• Health: Stable — committed within 90 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).