h4dex/opc-nexus
C2开源的企业版的数字员工工作台, OPC-Nexus（One Person Company Nexus）是一款本地优先的桌面 AI Agent 管理器。它为单人公司 / 独立开发者提供统一的 AI 数字员工管理平台 —— 从 Agent 创建、任务编排、多引擎接入，到消息渠道集成、工作流自动化和专家团协作，一站式覆盖。 （原内部项目AiBoxDash）
★ 10+ · h4dex/opc-nexus source on GitHub · this plugin in the registry
h4dex/opc-nexus is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It executes system commands, decodes base64 payloads, starts a network server, reads credential-class env vars.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| executes system commands | exec | ×51 src, e.g. scripts/mobile-apk.cjs:4, scripts/mobile-apk.cjs:4 |
| decodes base64 payloads | base64_decode | ×20 src, e.g. src/main/services/apiBridge.ts:83, src/main/services/collabManager.ts:321 |
| starts a network server | net_server | ×2 src, e.g. src/main/services/apiBridge.ts:196, src/main/services/mobileGatewayService.ts:434 |
| reads credential-class env vars | token_env | DEEPSEEK_API_KEY, OPENAI_API_KEY |
Outbound domains
registry.npmmirror.com api.deepseek.com opencode.ai docs.anthropic.com npmmirror.com deb.nodesource.com pypi.tuna.tsinghua.edu.cn api.openai.com nls-meta.cn-shanghai.aliyuncs.com ilinkai.weixin.qq.com
Environment variables it reads
LOCALAPPDATA ANDROID_SDK_ROOT ANDROID_HOME AIBOX_DSH_MANAGED_SKILLS_DIR DSH_AGENTS_HOME DSH_BUNDLED_SKILL_DIR ELECTRON_RENDERER_URL OPCNEXUS_E2E_HOST OPCNEXUS_E2E_PORT OPCNEXUS_E2E_SERIAL
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.