dsh-qq-bridge

deepseek harness插件，连接QQ / DSH plugin for connecting QQ

Plugin

Verification

L2 · Structured

Security

Medium

Health

Active

Trust

Silver

What it does

deepseek harness插件，连接QQ / DSH plugin for connecting QQ

dsh plugin --profile web add dsh-qq-bridge

Install method: npm · not yet tested in container (L3+)

DSH Version	Status
not stated	Declared — not tested

Automated static scan, not manual review.

DSH.SOWARNINGSCAN15 FILES

95e853

Security reviewAutomated review · daily

WARNING

No critical findings, but warning-level issues were detected (file writes, remote imports, base64 decoding, downloads).

0 critical·2 warning·9 info·15 files scanned

Version binding

scanned commit95e85316f58e2026-08-17

latest commit95e85316f58e

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: Medium0 critical · 2 warning · 9 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

infoMakes network requests (fetch / axios)scripts/keep-napcat-alive.sh:38
const ws = new WebSocket('${WS_URL}', headers ? { headers } : undefined)
infoHardcoded IP addressscripts/keep-napcat-alive.sh:16
WS_URL="${DSH_QQ_WS:-ws://127.0.0.1:3001}"
infoHardcoded IP addressscripts/start-local-echo.sh:11
WS_URL="${DSH_QQ_WS_URL:-ws://127.0.0.1:3001}"
infoHardcoded IP addressscripts/start-local-echo.sh:19
DSH_QQ_ADMIN=<your-main-qq> [DSH_QQ_WS_URL=ws://127.0.0.1:3001] [DSH_QQ_TOKEN=...] bash scripts/start-local-echo.sh
warningFilesystem write operationssrc/handlers/dsh-executor.ts:142
fs.writeFileSync(`${dir}/.debug-surface.json`, JSON.stringify(events, null, 2))
warningFilesystem write operationssrc/handlers/dsh-executor.ts:145
fs.writeFileSync(`${dir}/.debug-persisted.json`, JSON.stringify(persisted, null, 2))
infoReads process.envsrc/main.ts:28
const raw = process.env[name]
infoReads process.envsrc/main.ts:37
wsUrl: process.env.DSH_QQ_WS_URL ?? 'ws://127.0.0.1:3001',
infoReads process.envsrc/main.ts:38
token: process.env.DSH_QQ_TOKEN ?? undefined,
infoHardcoded IP addresssrc/main.ts:37
wsUrl: process.env.DSH_QQ_WS_URL ?? 'ws://127.0.0.1:3001',
infoMakes network requests (fetch / axios)src/onebot/client.ts:61
ws = new WebSocket(this.url, {

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Last commit 2026-08-17 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 6 · Forks: 0

• Health: Active — committed within last 30 days