GCWing/OpenBitFun
C3OpenBitFun combines a high-performance agent runtime written in Rust with a polished desktop application. It pairs the depth of a Code Agent with open, general-purpose capabilities for work beyond sof
★ 2.4k · GCWing/OpenBitFun source on GitHub · this plugin in the registry
GCWing/OpenBitFun is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, runs code at install time, can rewrite the system prompt, executes system commands.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| runs code at install time | install_script | postinstall: pnpm run copy-assets |
| can rewrite the system prompt | prompt_surface | systemPrompt |
| executes system commands | exec | ×22 in authored code, e.g. scripts/audit-frontend-colors.mjs:3, scripts/audit-frontend-colors.mjs:3 |
| powerful capability in test/example code only | dev_surface | in code that does not ship: tools/pre-execute |
Services it injects
agents systemPrompt tools
Hooks it attaches
agent/error agent/inbox/claimed approval/request dispose session/event
Outbound domains
openbitfun.com open.bigmodel.cn api.openbitfun.com api.example.com
Environment variables it reads
CARGO_TARGET_DIR OPENBITFUN_SDK_HOST TAURI_DEV_HOST GITHUB_ACTIONS OPENBITFUN_TARGET_GC_DRY_RUN OPENBITFUN_TARGET_GC OPENBITFUN_TARGET_GC_MIN_AGE_HOURS OPENBITFUN_BUILD_PREREQS_TEST_ROOT SHERPA_ONNX_LIB_DIR ComSpec
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.