dsh.so
EN
English中文
weshop-dsh-plugin avatar

weshop-dsh-plugin

Native WeShop Cordis plugin for DeepSeek Harness. Allow you to use infinite canvas with infinite creative skills.

Plugin
Verification
L2 · Structured
Security
High
Health
Active
Trust
Silver

What it does

Native WeShop Cordis plugin for DeepSeek Harness. Allow you to use infinite canvas with infinite creative skills.

Installation

dsh plugin --profile web add weshop-dsh-plugin

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN12 FILES
751f86
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

2 critical·13 warning·28 info·12 files scanned
code-exec ×2
Version binding
scanned commit751f8641d47c2026-08-16
latest commit751f8641d47c

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High2 critical · 13 warning · 28 info

• Static heuristic scan: done (12 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

  • criticalChild process module usage (Node.js)bin/setup.js:6
    import { spawnSync } from "node:child_process";
  • infoReads process.envbin/setup.js:22
    const dshHome = process.env.DSH_HOME || join(homedir(), ".dsh");
  • criticalDynamic code execution via the Function constructorlib/index.js:241
    schema.callback = new Function("return " + schema.callback)();
  • warningHTTP request to a raw IP addresslib/index.js:1534
    const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
  • warningHTTP request to a raw IP addresslib/index.js:1594
    const after = Number(new URL(request.url ?? "/", "http://127.0.0.1").searchParams.get("after") || 0);
  • warningFilesystem write operationslib/index.js:949
    fs.writeFileSync(progressFile$1, JSON.stringify(value, null, 2));
  • warningFilesystem write operationslib/index.js:1274
    fs.appendFileSync(completionFile, `${JSON.stringify(completion)}\n`);
  • warningFilesystem write operationslib/index.js:1305
    fs.appendFileSync(actionFile$1, `${JSON.stringify(action)}\n`);
  • infoReads process.envlib/index.js:807
    const stateFile$1 = process.env.WESHOP_STATE_FILE || path.join(os.tmpdir(), "weshop-2-0-canvas-state.json");
  • infoReads process.envlib/index.js:808
    const actionFile$1 = process.env.WESHOP_ACTIONS_FILE || path.join(os.tmpdir(), "weshop-2-0-canvas-actions.jsonl");
  • infoReads process.envlib/index.js:809
    const requestFile$1 = process.env.WESHOP_REQUESTS_FILE || path.join(os.tmpdir(), "weshop-2-0-canvas-requests.jsonl");
  • infoMakes network requests (fetch / axios)lib/index.js:836
    const response = await fetch(`${WESHOP_BASE_URL}${pathname}`, {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-14 · activity: Active

• Repo created: 2026-08-16

• Stars: ★ 6 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/weshopai/weshop-dsh-plugin

Was this page helpful?