pakgrou-porg/yardmaster
C3Two-stage LLM router: Switchyard model selection + PAIR node placement, one local endpoint
★ 0 · pakgrou-porg/yardmaster source on GitHub · this plugin in the registry
pakgrou-porg/yardmaster is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, runs code at install time, executes system commands, decodes base64 payloads.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| runs code at install time | install_script | postinstall: tsx scripts/ensure-electron.ts |
| executes system commands | exec | ×32 in authored code, e.g. desktop/scripts/analyze-dead-code.ts:17, desktop/scripts/analyze-dead-code.ts:17 |
| decodes base64 payloads | base64_decode | ×3 in authored code, e.g. docker/auth-proxy.mjs:85, packages/yardmaster-console/src/server.mjs:150 |
| starts a network server | net_server | ×3 in authored code, e.g. docker/auth-proxy.mjs:121, packages/yardmaster-console/src/server.mjs:483 |
| reads credential-class env vars | token_env | AP_AUTH_FILE, AP_AUTH_PASS, AP_AUTH_USER, YM_AUTH_DISABLED, YM_AUTH_FILE, YM_AUTH_PASS |
Services it injects
agent commands llm session tools
Outbound domains
ollama.com lmstudio.ai go.dev webassets.nvidia.com openrouter.ai api.venice.ai api.kie.ai huggingface.co docs.ollama.com
Environment variables it reads
PAIR_MOCK_UPDATER XDG_CURRENT_DESKTOP YM_ROUTER_PORT YM_CONFIG_FALLBACK YM_METRICS_DB YM_AUTH_PASS_FILE YM_HARNESS_DEFAULT_MODEL ELECTRON_BUILDER_7Z_FILTER AP_LISTEN_PORT AP_LISTEN_HOST
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.