GCWing/BitFun
C2BitFun combines a high-performance agent runtime written in Rust with a polished desktop application. It pairs the depth of a Code Agent with open, general-purpose capabilities for work beyond softwar
★ 1.8k · GCWing/BitFun source on GitHub · this plugin in the registry
GCWing/BitFun is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It runs code at install time, gates tool execution, executes system commands, decodes base64 payloads.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| runs code at install time | install_script | postinstall: pnpm run copy-assets |
| gates tool execution | tool_gate | hook: tools/pre-execute |
| executes system commands | exec | ×80 src, e.g. scripts/build-web-parallel.mjs:16, scripts/build-web-parallel.mjs:24 |
| decodes base64 payloads | base64_decode | ×15 src, e.g. scripts/write-minisign-public-key.mjs:31, src/mobile-web/src/pages/ChatPage.tsx:2367 |
| starts a network server | net_server | ×3 src, e.g. scripts/debug-log-server.mjs:34, scripts/generate-startup-appearance-bootstrap.mjs:25 |
| reads credential-class env vars | token_env | BITFUN_SIGNING_PUBKEY, TAURI_SIGNING_PRIVATE_KEY, TAURI_UPDATER_PUBKEY |
| ships no manifest | no_manifest | uses 2 services, 3 tool regs, no manifest |
Services it injects
agents tools
Hooks it attaches
agent/error agent/inbox/claimed approval/request session/event tools/pre-execute
Outbound domains
openbitfun.com open.bigmodel.cn dashboard.ngrok.com open.feishu.cn models.dev api.github.com reactjs.org relay.example.com
Environment variables it reads
CARGO_TARGET_DIR BITFUN_RELEASE_CHANNEL BITFUN_GITHUB_CONFIG_TEST_ROOT FLASHGREP_DAEMON_BIN ComSpec CARGO_PROFILE_DEV_CODEGEN_UNITS BITFUN_MOBILE_WEB_FORCE_BUILD TAURI_DEV_HOST BITFUN_TARGET_GC_DRY_RUN BITFUN_TARGET_GC
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.