zx490336534/dsh-spec-collab
C3DeepSeek Harness 的独立双面插件，用于把产品的原始需求澄清为研发和开发 AI 可直接理解的 Ready Spec。产品、研发、产品 AI 与研发 AI 在同一份 Git 版本化 Markdown 上完成初审、逐项回复、二次审核、候选 patch、产研共审、Decision、分角色确认与 Ready 质量门。
★ 1+ · zx490336534/dsh-spec-collab source on GitHub · this plugin in the registry
zx490336534/dsh-spec-collab is a DeepSeek Harness plugin rated C3 — powerful capability combined with sensitive behavior. It patches the dsh runtime, can rewrite the system prompt, can intercept API traffic, executes system commands.
Installable plugin — declares a dsh.bundle manifest
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| patches the dsh runtime | runtime_patch | ./cordis.patch.yml |
| can rewrite the system prompt | prompt_surface | apiProxy, systemPrompt, webServer |
| can intercept API traffic | api_intercept | apiProxy, systemPrompt, webServer |
| executes system commands | exec | ×6 in authored code, e.g. src/git-store.ts:1, src/git-store.ts:1 |
Services it injects
apiProxy sessions systemPrompt tools webServer
Environment variables it reads
SPEC_COLLAB_E2E_URL
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.