elysia395/dsh-wallpaper-engine
C3把本机 Wallpaper Engine 的壁纸搬进 DSH 网页界面：场景壁纸由内置 MIT 开源引擎 WebWallGL 实时 WebGL 渲染（粒子 / puppet 骨骼 / SceneScript / 音频反应 / 鼠标交互），失败自动降级内嵌 MP4 与场景静态帧；Web 壁纸严格沙箱 + WE API；iOS 风格液态玻璃 UI 高度自定义，遮挡暂停省电、ffmpeg 帧率上限转码、
★ 100+ · elysia395/dsh-wallpaper-engine source on GitHub · this plugin in the registry
elysia395/dsh-wallpaper-engine is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, executes system commands, eval in build output only, base64 decoding in build output only.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| executes system commands | exec | ×6 in authored code, e.g. scripts/harness-compat-baseline.mjs:34, scripts/harness-compat-baseline.mjs:34 |
| eval in build output only | eval_bundled | ×1 in build output only, e.g. lib/webwallgl/assets/renderer-DTLW1Gf0.js:261 |
| base64 decoding in build output only | base64_decode_bundled | ×2 in build output only, e.g. lib/media/legacy.js:392, lib/webwallgl/assets/renderer-DTLW1Gf0.js:7 |
| network server in build output only | net_server_bundled | ×2 in build output only, e.g. lib/index.js:3417, lib/index.js:3443 |
Services it injects
slots webServer
Hooks it attaches
theme/change
Outbound domains
registry.npmmirror.com api.github.com
Environment variables it reads
DSH_WE_CACHE_DIR DSH_WE_FFMPEG DSH_WE_ASSETS_DIR SystemRoot DSH_WE_STEAM_ROOT DSH_WE_FFMPEG_URL DSH_WE_UPLOAD_DIR GITHUB_OUTPUT DSH_WE_MEDIA_BRIDGE_URL DSH_WE_MEDIA_BRIDGE_TAG
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.