zsyu9779/dsh-desktop
C2Unofficial cross-platform desktop app for DeepSeek Harness. Native Wails shell for the DSH Web UI on macOS, Windows, and Linux.
★ 5+ · zsyu9779/dsh-desktop source on GitHub · this plugin in the registry
zsyu9779/dsh-desktop is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It command execution in build output only, reads credential-class env vars.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| command execution in build output only | exec_bundled | ×4 in build output only, e.g. plugins/diff-review/dist/index.js:4, plugins/open-editor/dist/index.js:3 |
| reads credential-class env vars | token_env | DSH_ACCOUNT_BRIDGE_SECRET |
Services it injects
locale sessions slots webServer
Hooks it attaches
webserver/index-inject
Outbound domains
react-dnd.github.io redux.js.org reactjs.org relay.codegoround.com
Environment variables it reads
DSH_ACCOUNT_BRIDGE_SECRET LOG DSH_ACCOUNT_SERVER_URL DSH_ACCOUNT_BRIDGE_DIR USERPROFILE
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.