eogee/a4phone
C2DSH（DeepSeek Harness）/ Claude Code / Codex 远程手机交互包。通过 ntfy.sh 在手机上接收任务完成通知（含 AI 最后输出），对 AI 提问与权限请求进行远程点选或文字作答，并可从手机直接继续对话。
★ 5+ · eogee/a4phone source on GitHub · this plugin in the registry
eogee/a4phone is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It executes system commands, ships no manifest.
Not a plugin — depends on dsh packages but declares no plugin manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| executes system commands | exec | ×10 in authored code, e.g. src/daemon.mjs:5, src/daemon.mjs:39 |
| ships no manifest | no_manifest | uses 5 services, 0 tool regs, no manifest |
Services it injects
agents approval sessionPersistence tools workspaceRegistry
Hooks it attaches
approval/request session/event tools/execute
Outbound domains
ntfy.sh registry.npmmirror.com
Environment variables it reads
ComSpec WINDIR A4P_RESUME ZCODE_WINDOWS_APP_INSTALL_DIR LOCALAPPDATA
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.