DeepSeek Harness Unlimited-OCR GUI Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned for installing an OCR plugin, but it asks users to execute mutable remote code through unpinned installer commands.

Review this before installing. Use it only if you trust the DSH package and the referenced GitHub repository, preferably after pinning the plugin to a reviewed commit and pinning @deepseek-ai/dsh to an exact version. Avoid entering production or high-value API credentials until you have verified the installed plugin source and permissions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:31

Finding

Installation of a Native Plugin from a Mutable Remote Branch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–36
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

npx @deepseek-ai/dsh plugin --profile web add "github:Aidenwu0209/dsh-Unlimited-OCR-Skill#main"
npx @deepseek-ai/dsh web

Technical Analysis

The Skill directs the agent to install a native DSH plugin from the main branch of a personal GitHub repository and then launch DSH. The main branch is mutable, so the content installed when a user invokes the Skill can differ from the content available during this audit.

The command does not pin the plugin to an immutable commit hash or verified release artifact. It also does not require checksum verification, signature validation, or source inspection before installation. Consequently, control of the referenced repository or its owner account provides control over the code subsequently installed by users following these instructions.

This is a remote payload execution risk rather than evidence that the currently documented repository content is itself malicious. The audited project does not contain the remote plugin implementation, so its behavior could not be verified locally.

Attack Path

1. An attacker compromises the referenced GitHub account or gains write access to the repository.
2. The attacker adds malicious code to the repository's main branch.
3. A user or agent follows the installation command in SKILL.md.
4. DSH retrieves and installs the attacker-controlled revision as a native plugin.
5. The user launches DSH with npx @deepseek-ai/dsh web.
6. The malicious plugin executes with the permissions available to the DSH process.

Impact Assessment

Successful exploitation could provide code execution under the account running DSH. Depending on the DSH plugin permission model, the payload could access OCR input documents, generated output, application configuration ...[truncated 480 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable #main reference with an immutable, reviewed commit hash or a cryptographically signed release.
• Publish an expected SHA-256 digest for the exact plugin artifact and verify it before installation.
• Require signature or provenance verification using a trusted release mechanism.
• Add an explicit review step for the downloaded plugin source and installation scripts before execution.
• Document the plugin's required permissions and restrict DSH to the minimum filesystem, credential, and network access needed for OCR.
• Prefer a trusted organizational repository with protected branches, mandatory review, signed commits, and restricted release permissions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Execution of an Unpinned npm Package Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–36
Vulnerability Type: Insecure dependency resolution
Risk Level: Medium

Vulnerable Code:

bash

npx @deepseek-ai/dsh plugin --profile web add "github:Aidenwu0209/dsh-Unlimited-OCR-Skill#main"
npx @deepseek-ai/dsh web

Technical Analysis

Both commands invoke @deepseek-ai/dsh through npx without specifying an exact package version. If the package is not already available in the local environment, npx can retrieve a registry-selected version and execute its package code. The effective CLI implementation can therefore change independently of this Skill.

No lockfile, exact semantic version, package-integrity value, signature, or provenance verification is provided. A compromised package release, unauthorized registry publication, or unexpected breaking release could execute code during plugin installation or application startup.

This finding concerns the lack of reproducible and verified dependency resolution. The audited files do not establish that the current npm package is malicious or compromised.

Attack Path

1. An attacker compromises the npm publisher account, release pipeline, or another mechanism capable of publishing a selected version of @deepseek-ai/dsh.
2. The attacker publishes a package version containing malicious installation or runtime code.
3. A user follows either unversioned npx command from SKILL.md.
4. npx resolves and downloads the attacker-controlled or otherwise unreviewed package version.
5. The package executes with the permissions of the invoking user.
6. The malicious package can then alter plugin installation, compromise the DSH web process, or access resources available to that user.

Impact Assessment

Exploitation could result in arbitrary code execution with the invoking user's privileges. Accessible scope may include user-readable files, DSH configuration, OCR documents, enviro ...[truncated 358 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @deepseek-ai/dsh to an exact reviewed version in every npx invocation, for example by using an explicit @version suffix.
• Prefer installation through a project manifest and lockfile that records exact package versions and integrity hashes.
• Verify npm package provenance, publisher identity, signatures where available, and registry integrity metadata before execution.
• Run the CLI in a restricted environment with only the filesystem and network access required for installation.
• Establish a controlled upgrade process in which new package versions are reviewed and tested before the documented version is changed.
• Avoid automatic acceptance of newly published package versions in security-sensitive setup instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to execute npx @deepseek-ai/dsh plugin ... without pinning an exact package version. This causes the latest package version to be fetched at runtime, creating a supply-chain risk: a compromised or breaking upstream release could execute unintended code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Launching DSH via npx @deepseek-ai/dsh web without a pinned version again relies on whatever package version is current at execution time. If the upstream package is malicious, hijacked, or unexpectedly changed, the command can run attacker-controlled code locally and expose the user to supply-chain compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.