unStone/dsh-xray
X-ray for DeepSeek Harness plugins: declared capabilities vs actual behavior. Registry + static scanner + badges.
安装Install
dsh plugin add https://github.com/unStone/dsh-xray-plugin/releases/download/v0.1.0/dsh-xray-plugin-0.1.0.tgz把 unStone/dsh-xray 加入你的 DSH 配置（web profile）即可启用。
READMEREADME
dsh-xray — capability cards for DeepSeek Harness plugins
What a dsh plugin declares vs. what its code actually does — with file:line evidence.
English · 简体中文
🔍 Registry · 📊 Report · 📈 Levels explained · 📖 How dsh plugins work
Site available in English / 简体中文 / 日本語
90% of scanned plugins carry a powerful capability surface · 80% patch the dsh runtime itself · 9,476 plugins scanned, refreshed daily
Why
The dsh-plugin ecosystem went from ~200 to 9,700+ repos in little over a month. Plugins run arbitrary code inside your agent runtime: they can rewrite your system prompt (system-prompt/assemble), intercept every API call (api/gate), spawn subprocesses, read GITHUB_TOKEN from your env, and even patch the runtime itself (manifest.bundle.patch). Today nothing surfaces any of that before you install.
dsh-xray statically scans every plugin in the ecosystem and publishes a capability card:
| Dimension | Examples |
|---|---|
| Declared surface | manifest, injected services, registered tools, hooks |
| Powerful capabilities | systemPrompt / apiProxy / subprocess injection, tools/pre-execute gate, runtime patches |
| Sensitive behavior | exec / eval / base64 decode in shipped code, install-time scripts, outbound domains, credential-like env reads |
| Transparency gaps | capability used in code but absent from the manifest |
Every flag carries file:line evidence. Levels C0–C3 measure capability surface and transparency — not maliciousness. A C3 plugin can be perfectly legitimate; you just deserve to know before it touches your agent.
Features
- Whole-ecosystem coverage — every repository under the
dsh-plugintopic (9,700+), rescanned daily. - Capability cards — injected services, attached hooks, runtime patches, outbound domains, credential-class env reads and install-time scripts, each with
file:lineevidence. - C0–C3 levels — a compact read on how much surface a plugin has, and whether it combines powerful capability with sensitive behavior.
- Shipped vs. test code — risk flags fire only on shipped code, so a fixture in
tests/never inflates a rating. - Deterministic manifests — in a monorepo the plugin's own root manifest wins, so two scans of one repo agree.
- Static only — nothing is executed, downloaded code is streamed and read, never run.
- Embeddable badges — plugin authors can publish their own capability card.
- Trilingual site — English, 简体中文, 日本語, plus a crawlable page per plugin.
Capability levels
C0 no notable surface · C1 ordinary (tools, services, outbound domains) · C2 powerful: prompt surface, API interception, subprocess, exec, credential reads or install scripts · C3 powerful capability combined with sensitive behavior.
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. See the levels explained visually.
Use it inside dsh
dsh-xray-plugin puts the lookup where the question comes up — in the agent, while you are deciding whether to install something.
dsh plugin add https://github.com/unStone/dsh-xray-plugin/releases/download/v0.1.0/dsh-xray-plugin-0.1.0.tgz
Is
tt-a1i/archifysafe to install?
Audit the plugins I have installed.
Badge
Plugin authors: show users your capability card.
[](https://unstone.github.io/dsh-xray/registry.html#<owner>__<repo>)
Run it yourself
python scanner/discover.py all # enumerate topic:dsh-plugin (needs gh auth)
cd scanner && python pipeline.py all 24 # download + scan, no git clone
python render_report.py # inject current figures into the report
python render_pages.py # plugin pages, collections, sitemap, feed
Outputs: data/scans/*.json (full cards), docs/data.json (site data), docs/badge/*.json (shields endpoints), docs/p/*.html (a page per plugin). A daily GitHub Action refreshes all of it.
Methodology & fair play
- Static analysis only; nothing is executed.
- Shipped code and test/dev code are classified separately; risk flags fire on shipped code only.
- False positive? Open an issue — cards link evidence so disputes are checkable, and rules get fixed in public.
Roadmap
- Full-ecosystem coverage — 9,736 repositories, rescanned daily
- Daily diff feed: what changed in the capability surface of plugins you use
-
cordis.patch.ymlruntime-patch audit view - Companion plugin: look plugins up from inside dsh
- Multi-harness: Abu-Cowork & Claude Code plugin formats
- Private registry / org policy engine (enterprise)
License
Apache-2.0 — see LICENSE. The scan data under data/ and docs/ is published under the same terms.
Changelog
What changed and why — method and product changes; scan results refresh daily on their own.
相关推荐Related
- deepseek-ai/deepseek-harness DeepSeek Harness: Everything is a Plugin.
- deepseek-ai/deepseek-harness DeepSeek Harness (dsh) — 由 DeepSeek AI 开发的开源 agent harness（智能体框架）。一切皆插件：核心 + 插件 + 技能 = 可热插拔的 AI 编程工作台。DeepSeek Harness: …
-
nexu-io/open-design
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your…
-
ruvnet/ruflo
🌊 The original agent meta-harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build c…
-
amruthpillai/reactive-resume
A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source a…
-
volcengine/OpenViking
Self-evolving Context Database for AI Agents. Unify Agent Memory, Knowledge RAG and Skills.
-
Molunerfinn/PicGo
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosti…
-
titanwings/colleague-skill
将冰冷的离别化为温暖的 Skill，欢迎加入数字生命1.0！Transforming cold farewells into warm skills? It's giving rebirth era. Welcome to Digital …