PerryLink/dsh-auto-review
C3Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the
★ 10+ · PerryLink/dsh-auto-review source on GitHub · this plugin in the registry
PerryLink/dsh-auto-review is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, executes system commands, uses eval / new Function.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| executes system commands | exec | ×7 src, e.g. scripts/prepare.mjs:7, scripts/prepare.mjs:7 |
| uses eval / new Function | eval | ×1 src, e.g. src/eval/report.ts:106 |
Services it injects
approval commands invariants locale remote sessions slots subagents tools
Hooks it attaches
approval/request internal/dispatch tools/post-execute
Environment variables it reads
PINNED_REF DSH_EVAL_SESSIONS_ROOT DSH_EVAL_WORKSPACE_ROOT
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.