This week, a community project called DeepSeek Harness (abbreviated dsh) (note: this is a developer community work, not an official DeepSeek company product) quietly got its "app store" feature running: 595 plugins, installable with a single command—but every plugin by default receives full permissions to the user's machine.
The signal is clear: the AI Agent world is replaying the 2008 smartphone playbook—first an "operating system," then an "app store" starts growing.
What This Is
An Agent framework is the middle layer that lets AI not just "answer questions" but actually "do work." What makes this dsh community project special is its "everything is a plugin" approach: even AI memory, tool invocation, and interface appearance are all split into independent plugins.
dsh-market is a visual "plugin app store": three tabs (Discover/Topics/Installed), filtering by category, sorting by popularity. dsh-find-plugin is a conversational "plugin concierge": you tell the AI "I want a plugin that can remember across sessions," and it returns a matching list and install command. As of now, the marketplace has 595 community plugins.
Industry View
Supporters see this as a sign of ecosystem maturity. Like Android's app store and iPhone's App Store in their early days, an operating system is just an empty shell without a "store" distribution mechanism; now that Agent frameworks are growing "marketplaces," third-party developers have a path to reach users, and value really starts to scale.
But we'd rather flag an overlooked risk: all these third-party plugins run on your machine as the user. Installing an unfamiliar plugin is like letting a stranger walk into your home with your keys—it can read your files, invoke your accounts, and access the network. The dsh author himself warns in the article: tool approval does not sandbox plugin code (i.e., run it inside a "locked box").
dsh's marketplace runs a "curated list" filter, only allowing installation of whitelisted plugins. But that's a different thing from "security review." When Android first allowed sideloading (installing apps outside the official store), the result was mass malware infiltration. Agent plugins carry even greater permissions—because Agent frameworks inherently need to marshal system resources.
Another sober take: 595 plugins sounds lively, but compared to ChatGPT's GPTs and ByteDance's Coze, this is a fairly small pool. Whether the Agent ecosystem truly takes off depends on whether major players are willing to build the "app store" layer—not on community side projects.
Impact on Regular People
For enterprise IT: if your company is considering using an Agent framework to build an internal AI assistant, every third-party plugin is a potential compliance and security risk point requiring individual audit—not "install and use."
For working professionals: more Agent tools actually raise the bar for use—not the more you install the better, but you need to verify plugin sources and, where possible, scan the source code, or your work data could be read by unknown plugins.
For the consumer market: no direct impact in the short term. But as the Agent ecosystem matures, an "App Store moment" could arrive within the next two years—when major companies define distribution rules and decide who gets discovered and who gets buried.