dsh.so
EN
English中文
MakoCode avatar

MakoCode

MakoCode — 茉子版 Agent | Galgame 风格桌面 AI Agent，零门槛体验 Agent 的乐趣

PluginAI ModelsDesktop
Verification
L2 · Structured
Security
High
Health
Active
Trust
Silver

What it does

MakoCode — 茉子版 Agent | Galgame 风格桌面 AI Agent，零门槛体验 Agent 的乐趣

Installation

dsh plugin --profile web add makocode

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN15 FILES
6a1a1c
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

8 critical·17 warning·24 info·15 files scanned
code-exec ×6shell ×2
Version binding
scanned commit6a1a1cd69c922026-08-17
latest commit6a1a1cd69c92

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High8 critical · 17 warning · 24 info

• Static heuristic scan: done (15 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

Scan findings · 12

  • warningFilesystem write operationsassets/extract-xp3.js:146
    fs.writeFileSync(outPath, file.data);
  • criticalChild process module usage (Node.js)electron-main.js:14
    const { spawn, spawnSync } = require('child_process');
  • warningHTTP request to a raw IP addresselectron-main.js:57
    const MAIN_URL = `http://127.0.0.1:${SERVER_PORT}`;
  • warningFilesystem write operationselectron-main.js:671
    fs.writeFileSync(personaFile, persona, 'utf8');
  • warningFilesystem write operationselectron-main.js:676
    fs.writeFileSync(skillFile, lore, 'utf8');
  • warningFilesystem write operationselectron-main.js:711
    fs.writeFileSync(statusFile, JSON.stringify(updateStatus), 'utf8');
  • infoReads process.envelectron-main.js:32
    if (process.env.MAKO_SERVER_MODE === '1') {
  • infoReads process.envelectron-main.js:119
    path.join(process.env.APPDATA || '', 'npm'),
  • infoReads process.envelectron-main.js:120
    path.join(process.env.LOCALAPPDATA || '', 'npm-cache'),
  • infoHardcoded IP addresselectron-main.js:57
    const MAIN_URL = `http://127.0.0.1:${SERVER_PORT}`;
  • infoHardcoded IP addresslib/constants.js:8
    const SERVER_HOST = "127.0.0.1";
  • warningFilesystem write operationslib/galgame-features.js:63
    try { fs.writeFileSync(path.join(appDir, TASKS_FILE), JSON.stringify(tasks, null, 2), 'utf8'); } catch {}

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-14 · activity: Active

• Repo created: 2026-08-17

• Stars: ★ 139 · Forks: 6

• Health: Active — committed within last 30 days

Source

GitHub: github.com/liebaojun/MakoCode

Was this page helpful?