Plugins

Visual design studio for websites, app prototypes, posters, cards, reports, and magazines, with templates, direct element editing, selection-aware AI draft handoff, and export.

Sidebar usage panel that attributes tokens to the relay site that served each request, read from your existing provider config: today/month/all-time totals, per-site and per-model breakdowns, a year activity heatmap, and New API / Sub2API / DeepSeek balances.

Red-team engagement mode: send one target organization name and a planner session runs a five-role execution team (recon, asset triage, vulnerability discovery, exploitation, internal pivot) under a user-configurable concurrency limit (three by default, changed from the console and taking effect immediately), preflight-checking skills and resources and asking once for any missing key or VPS first, guided by a built-in first-run onboarding skill; scoring follows the merged intrusion scoring rules (8 categories / 25 points) with server-side caps, highest-privilege-wins and per-service dedup, and self-registered accounts never score — a login that fits no more specific category is scored as controlling a web application system rather than dropped; findings land in a local SQLite fact base with discovery timestamps, shown in a persistent right-side console of 9 tabs (asset mapping with a discovery timeline and the live test view, the agent roster with its concurrency setting and editable role prompts, session/tunnel state, findings — vulnerabilities, credentials and access sessions plus the attack files archived against each vulnerability — five-stage attack chain, scoring targets, an evidence-screenshot capability (register a screenshot per score point, at most three representative shots per point so a bulk result such as dozens of endpoints does not flood the console or the report, viewed inline in the console and embedded in the report, with on-site screenshots kept strictly apart from record-generated evidence cards), and a report that spells out how each score was obtained (actions, exact commands, credential provenance, tunnel build commands, a reproduction entry that is either a paste-ready HTTP request or a runnable command, plus success criteria and an evidence index), a category-organised POC/EXP knowledge base, and a skill library that reports for every unusable skill why it is unusable and the concrete steps to repair it); ships 14 reconnaissance/assessment skills (the npm package deliberately carries no tool auto-installer and no attack-chain skills — those ship as a separate toolkit Release attachment that the operator fetches and runs themselves), 56 redteam_* tools and one-command self-update.

Official-grade GitHub CI integration: a composite action.yml, a polling PR review bot with idempotent inline comments and a status-check gate, plus PR/issues tools with every write gated by human approval.

Read any page as clean main content: charset auto-detect (GBK/GB2312/UTF-8/Big5), noise stripping, compact text/Markdown, offset continuation, optional SPA rendering, batch reads and site crawling.

Zhihu in-site search, global web search, and Zhida answers for the model, over the official Zhihu Open Platform API.

Three Zhihu tools for DSH — in-site search, Zhihu's global web index with domain and date filters, and Zhida answers — with a native settings card and source-cited results.

Twenty-one official HyperFrames by HeyGen skills synced from the official upstream (HTML video authoring, animation, keyframes, audio/music-to-video, CLI, registry, slideshow, talking-head recut, website/product/PR-to-video, Studio timeline conventions and more), plus a bundled-resource health check.

Skills for building websites on the Creght platform: CLI pull/push sync, page and component conventions, CMS, forms, auth, SEO, publishing and version rollback.

Authentication gate for the DeepSeek Harness Web UI: the login gate covers pages, /api, /plugins and WebSocket upgrades; PBKDF2 password hashing, HttpOnly SameSite session cookies and IP-based login lockout; invite-code registration; two-factor login with TOTP or passkeys (WebAuthn: several keys per account, phone enrolment by QR, username-less sign-in, and a password or second-factor step-up before any login factor is added or removed); a user-management settings panel (users edit their own profile and manage their own TOTP and passkeys, admins add or remove users, reset passwords, manage invites and clear the passkeys of a lost device); admin-only model and API-key configuration guards; per-user isolation on the REST/list APIs and on the WebSocket event streams; session persistence across restarts; a JSONL audit log; and a fail-closed gateway. Runs on both DSH transport lines (0.1.1-rc.2 legacy and 0.1.2+ modern) with no configuration; passkey login needs a localhost or HTTPS origin because browsers require a secure context.

Lifecycle management UI for the llm-pi-ai model provider: create, edit, delete, enable and disable providers with custom headers and AES-GCM-encrypted API keys; uninstall-safe restore of parked providers, remote model discovery with batch write, smart routing with five strategies, union/intersection composites, per-model connectivity tests, and request observability.

Visible Electron browser for DSH with one shared BrowserWindow, isolated task views, explicit human-Agent handoff, snapshot-reference and native navigation tools, operation trails, demand-driven page thumbnails, keyed session recovery for reliable tab switching and closing, and site-scoped cookie clearing for login maintenance.

Website cloning methodology skill: a real-source-first decision tree covering static sites, React/Vue/Next content sites and WebGL/Canvas-heavy fronts, mandatory verification of executable code quoted from second-hand AI analyses, and 13 zero-dependency Node scripts for CDP browser recon, asset/font harvesting, route crawling, sourcemap hunting and pixel-diff auditing.

Grok-compatible web search with retained source pagination, Context7 and Exa documentation lookup, bounded page extraction, site mapping, offline research planning, and read-only diagnostics.

A floating, semi-transparent market ticker for DeepSeek Harness showing real-time level and change percentage for the Shanghai Composite, ChiNext, STAR 50 and Hang Seng Tech indices.

Offline mirror of the official DeepSeek Harness documentation as a dsh skill: 168 site pages (EN/zh) plus 52 repository-only reference docs, with topic navigation and a full-text search index for plugin development.

Floating card showing your real position P&L (今日盈亏), Shanghai Composite Index, and intraday chart, auto-synced from the Tonghuashun investment-ledger — no manual watchlist setup.

Real-time token billing for DSH web: official DeepSeek CNY pricing with automatic peak/off-peak switching, hourly price sync from the official site, visual custom model prices, and multi-currency fallback.

Grok-compatible web search with retained source pagination, Context7 and Exa documentation lookup, bounded page extraction, site mapping, offline research planning, and read-only diagnostics.

Dual knowledge-graph RAG for Markdown notes with half-life memory decay: prerequisite + similarity graphs (P/S-Agent traversal), paragraph chunking, n-gram/embedding hybrid search, and an explicit weight-feedback loop — a native Cordis plugin, npm-installable as @eqman00003/knowlp-rag.

Whalesong Studio (鲸歌工坊): write a long novel with a crew of AI agents, then publish it as an illustrated website. A plugin for DeepSeek Harness.

DSH plugin: a PosterFlow launcher in the Web sidebar — click 开启生图模式, play a transition video, then open the site.

Embeds an Overleaf site (overleaf.com or a self-hosted instance) into a conversation tab through a same-origin reverse proxy, with cookie or popup login, selection quoting, caret insertion, compile-log driven fixes, outline navigation, and .bib / .tex synchronization.

Answers hard questions by staging a formal debate: two adversarial subagents argue opposite sides with research, then the main agent rules on the transcript through the debate_open, debate_round, and debate_verdict tools.