STARDUSTLC666/dsh-hyperframes
C3DSH 视频创作技能插件：注册 HyperFrames by HeyGen 官方 21 个技能（HTML 即视频：动画/音频/关键帧/字幕/幻灯片/口播重剪/多路转视频/CLI/Studio），安装即用。
★ 5+ · STARDUSTLC666/dsh-hyperframes source on GitHub · this plugin in the registry
STARDUSTLC666/dsh-hyperframes is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, executes system commands, eval in build output only, decodes base64 payloads.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| executes system commands | exec | ×124 in authored code, e.g. skills/embedded-captions/scripts/audio-envelope.cjs:15, skills/embedded-captions/scripts/audio-envelope.cjs:54 |
| eval in build output only | eval_bundled | ×1 in build output only, e.g. skills/media-use/audio/scripts/lib/bgm.mjs:228 |
| decodes base64 payloads | base64_decode | ×1 in authored code, e.g. skills/hyperframes-creative/scripts/contrast-report.mjs:329 |
| reads credential-class env vars | token_env | ELEVENLABS_API_KEY, GCS_CREDS, GEMINI_API_KEY, GOOGLE_API_KEY, GOOGLE_APPLICATION_CREDENTIALS, HEYGEN_API_KEY |
Services it injects
skills tools
Outbound domains
cdn.jsdelivr.net generativelanguage.googleapis.com a.basemaps.cartocdn.com gsap.com us.i.posthog.com server.arcgisonline.com api.heygen.com api.example.com
Environment variables it reads
HYPERFRAMES_ROOT GEMINI_API_KEY HF_MEDIA_ENGINE CHROME GOOGLE_API_KEY HEYGEN_CONFIG_DIR ELEVENLABS_API_KEY npm_execpath WHISPER_MODEL WHISPER_LANG
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.