Claude Code, Skill
Deepseek Pa Dsh Desktop
Deepseek Pa Dsh Desktop, a skill listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
scripts/public-export-audit.js, line 16
'github-credentials.json', 'credentials.json', 'state.sqlite',
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
appearance-service.js, line 387
fs.rmSync(temporary, { force: true })
appearance-service.js, line 390
if (entry.isFile() && entry.name !== assetName && /^background\./i.test(entry.name)) fs.rmSync(path.join(backgroundsDir, entry.name), { force: true })
appearance-service.js, line 401
if (entry.isFile() && /^background\./i.test(entry.name)) fs.rmSync(path.join(backgroundsDir, entry.name), { force: true })
Show more
appearance-service.js, line 435
fs.rmSync(target, { force: true })
capability-registry.js, line 115
if (backup) fs.rmSync(backup, { recursive: true, force: true })
capability-registry.js, line 118
if (fs.existsSync(target)) fs.rmSync(target, { recursive: true, force: true })
cluster-store.js, line 111
fs.unlinkSync(temporary)
cluster-store.js, line 308
if (fs.existsSync(modern)) fs.rmSync(modern, { recursive: true, force: true })
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
cluster-runtime.js, line 503
const response = await fetch(selected.endpoint, {
extension-market.js, line 110
const request = https.get({
github-auth.js, line 9
const request = https.request({
Show more
main.js, line 735
const req = http.get(SERVER_URL, { timeout: timeoutMs }, (res) => {
scripts/make-icons.js, line 169
const response = await fetch(url, { signal: AbortSignal.timeout(30000) })
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
cluster-acp-client.js, line 16
const dotenv = path.join(directory, '.env')
main.js, line 79
const HOTKEY = process.env.DSH_DESKTOP_HOTKEY || 'CommandOrControl+Shift+Space'
scripts/public-export-audit.js, line 16
'github-credentials.json', 'credentials.json', 'state.sqlite',
Show more
scripts/acp-handshake-smoke.js, line 14
const oldKey = process.env.DEEPSEEK_API_KEY
scripts/acp-handshake-smoke.js, line 15
process.env.DEEPSEEK_API_KEY = '
scripts/acp-handshake-smoke.js, line 32
if (oldKey === undefined) delete process.env.DEEPSEEK_API_KEY
scripts/acp-handshake-smoke.js, line 33
else process.env.DEEPSEEK_API_KEY = oldKey
scripts/acp-model-smoke.js, line 9
const oldKey = process.env.DEEPSEEK_API_KEY
scripts/acp-model-smoke.js, line 12
process.env.DEEPSEEK_API_KEY = loadCredentialEnv(process.argv[3]).DEEPSEEK_API_KEY || oldKey || ''
scripts/acp-model-smoke.js, line 23
if (oldKey === undefined) delete process.env.DEEPSEEK_API_KEY
scripts/public-export-audit.js, line 31
if (PRIVATE_FILES.has(basename) || (/^\.env(?:\.|$)/i.test(basename) && !/^\.env\.(?:example|sample|template)$/i.test(basename))) {
.gitignore, line 13
*.tmp
.gitignore, line 14
.env
.gitignore, line 16
!.env.example
GITHUB_UPLOAD_GUIDE.md, line 31
没有命中不等于完成安全审计；还应检查文件列表，确认没有 `.credentials.yaml`、`.env`、token 文件、真实项目、日志、缓存、旧备份和本机截图。API 字段名与示例占位符属于正常源码，不能见到 `token` 一词就删除。
dpa.cordis.yml, line 3
# harness harvests its persisted log. The bin loads the gitignored root `.env`
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit f9407191f9a8. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: f9407191f9a8493a8b767370183811c460aa743b
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.