zenstory-ai/oh-story-dsh

C3

DeepSeek 写网文/小说的工作流插件:DeepSeek Harness 社区插件,内置小说、短剧、游戏、视频解说四个工作台 | Community DeepSeek Harness plugin with novel, short-drama, game and video-recap workbenches.

★ 100+ · zenstory-ai/oh-story-dsh source on GitHub · this plugin in the registry

zenstory-ai/oh-story-dsh is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, executes system commands, starts a network server, reads credential-class env vars.

Installable plugin — declares a dsh.bundle manifest

What it can do

CapabilityFlagEvidence
patches the dsh runtimeruntime_patch./cordis.patch.yml
executes system commandsexec×27 in authored code, e.g. scripts/check-drama-parity.ts:4, scripts/check-novel-to-game-parity.ts:3
starts a network servernet_server×4 in authored code, e.g. scripts/native-dsh-real.ts:21, scripts/native-dsh-real.ts:22
reads credential-class env varstoken_envDEEPSEEK_API_KEY, DEEPSEEK_API_KEY_FILE

Services it injects

conversation sessions skills slots subagents tools typert webServer

Outbound domains

fanqienovel.com www.ishugui.com www.ciweimao.com www.jjwxc.net www.qimao.com manage.zhangwenpindu.cn api.deepseek.com www.qidian.com m.qidian.com ms.zhangwenpindu.cn

Environment variables it reads

DEEPSEEK_API_KEY DRAMA_PYTHON DRAMA_SKILLS_UPSTREAM_DIR NOVEL_TO_GAME_UPSTREAM_DIR OH_STORY_UPSTREAM_DIR VIDEO_RECAP_UPSTREAM_DIR DEEPSEEK_API_KEY_FILE OH_STORY_DEMO_FRAMES_DIR OH_STORY_GAME_E2E_DIR OH_STORY_DEMO_USE_REAL_DEEPSEEK

How to read this

Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.

Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.