DeepSeek超級代理評測：開源主動改程式碼，未審查有風險 | DeepSeek Super-Agent Review: Proactive Coding, Unaudited

11月 02, 2026

By Kit 小克 | AI Tool Observer | 2026-11-03

🇹🇼 DeepSeek超級代理評測：開源主動改程式碼，未審查有風險

DeepSeek超級代理（dsh-superagent-prototype）是這週開發者社群討論度最高的開源專案：一款會主動盯著GitHub repo、有人提需求就自己動手開PR的程式碼代理。DeepSeek團隊在10月31日以MIT授權把原始碼公開，不到24小時GitHub星數就衝上4,137顆，但官方README寫得很老實——這只是「研究原型，僅供參考」，而且從未做過安全稽核。

DeepSeek超級代理是什麼？主動式寫程式的代理

跟Claude Code、Cursor這類「你問它才做」的助理不同，DeepSeek超級代理的設計理念是「盡量少打擾人」。它建立在DeepSeek Harness（DSH）框架之上，需要DSH v0.2.1-alpha.2以上版本、Node.js 22.19+、一個專屬GitHub帳號，以及已設定好的模型供應商才能跑起來，目前只支援一般github.com repo，不支援GitHub Enterprise Server。

運作方式：事件觸發、Ticket、獨立Worker

它監聽GitHub（也可選接Feishu訊息）上的事件，當被授權的人提出需求，系統會生成一張「Ticket」工作單，交給獨立的執行階段（executor session）在隔離目錄裡處理，完成後回到原本的對話串回報結果，例如直接開一個PR。DeepSeek超級代理內建三種運作模式：

off：完全關閉
observe（預設）：只記錄「如果要做會怎麼做」，不實際執行
auto：真正自動執行動作

安全風險評測：沙箱「不是安全邊界」

這才是評測重點。官方文件自己承認幾個關鍵風險：

Worker執行指令不需要人工核准，而且是以操作者的OS使用者身分跑
封鎖清單（blocked-command list）只是預設值，不是安全邊界——換個絕對路徑照樣能跑被封鎖的程式
作者直接點名prompt injection（提示詞注入）攻擊雲端迴圈是「尚未解決」的問題
專案從未經過安全稽核，維護者明講沙箱與核准機制不保證真正隔離

換句話說，4,137顆星的衝刺速度比認真讀完程式碼還快——這正是開源圈常見的「先嚐鮮再補票」現象。

誰適合試DeepSeek超級代理？

如果你只是想在自己的玩具repo試試「代理主動幫我開PR」是什麼感覺，DeepSeek超級代理很適合當週末玩具；但官方自己都說「大量程式碼是由coding agent寫的，請自行審閱後再採用」，拿去碰公司正式repo或有敏感權限的機器，時機還沒到。

好不好用，試了才知道。

🇺🇸 DeepSeek Super-Agent Review: Proactive Coding, Unaudited

DeepSeek Super-Agent (dsh-superagent-prototype) is the open-source project developers are talking about this week: a coding agent that watches a GitHub repo and opens pull requests on its own once someone asks it to. DeepSeek released the code under the MIT license on October 31, and it crossed 4,137 GitHub stars within 24 hours. The catch: DeepSeek's own README calls it a "research prototype for reference only" that has never been security-audited.

What Is DeepSeek Super-Agent? A Proactive Coding Agent

Unlike chat-first assistants such as Claude Code or Cursor that wait for you to type a prompt, DeepSeek Super-Agent is built to "take as little human attention as possible." It runs on top of DeepSeek Harness (DSH) and requires DSH v0.2.1-alpha.2 or newer, Node.js 22.19+, a dedicated GitHub account, and a configured model provider. GitHub Enterprise Server isn't supported yet — only plain github.com repos.

How It Works: Events, Tickets, Isolated Workers

The agent listens for GitHub events (optionally Feishu messages too). When an authorized user requests work, it spins up a "Ticket," hands it to a dedicated executor session running in an isolated directory, and reports back in the original thread — typically by opening a PR. DeepSeek Super-Agent ships with three modes:

off — fully disabled
observe (default) — logs what it would do without executing anything
auto — actually executes actions

Security Review: the Sandbox Is "Not a Security Boundary"

This is where the honest review starts. DeepSeek's own docs flag several risks:

Workers run shell commands without approval, as the operator's OS user
The blocked-command list is explicitly described as defaults, not a security boundary — a worker can still run a blocked binary via its absolute path
The authors name prompt injection of the cloud loop as an unsolved problem
The project has not been security-audited, and maintainers say sandboxing and approval controls don't guarantee real isolation

In plain terms: the stars piled up faster than anyone could read the code — a familiar open-source pattern of "star first, review later."

Should You Try DeepSeek Super-Agent?

For a weekend toy repo, sure — watching an agent open its own PR is genuinely fun. But DeepSeek's maintainers admit "much of the code was written by a coding agent" and tell users to review and adapt it themselves before relying on it. Pointing it at a production repo, or any machine with sensitive credentials, is premature right now.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士