alybg/dsh-angelina-pet
C2DeepSeek Harness 部署级桌宠：右下角随 Agent 工作状态切换 GIF 动画，气泡实时显示 DeepSeek 余额与语音台词，可拖动、可点击互动，任务完成随机播放语音。
★ 1+ · alybg/dsh-angelina-pet source on GitHub · this plugin in the registry
alybg/dsh-angelina-pet is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It executes system commands, reads credential-class env vars in development tooling the package does not ship.
Not installable — declares only dsh.client, which dsh plugin add cannot install
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| executes system commands | exec | ×1 in authored code, e.g. src/index.js:591 |
| reads credential-class env vars in development tooling the package does not ship | token_env_tooling | in development tooling the package does not ship: GITHUB_TOKEN |
Services it injects
slots timer webServer
Hooks it attaches
agent/inbox/inserted agent/pre-step agent/request-error approval/request llm/stream tools/execute
Outbound domains
api.deepseek.com
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.