Security scan report
Every plugin gets an automated security review in two layers: (1) a deterministic static scan of source shape, manifests and permission requests, covering the whole registry; (2) a model-driven dynamic audit that reads redacted source context without executing plugin code, covering only the subset whose static tier is medium or above. There is exactly one merge rule: a dynamic conclusion is authoritative where one exists (it may raise or lower the tier); otherwise the static scan tier applies. Tiers are unified into four levels — low / medium / high / critical.
Every tier number on this page comes from the same accessor (src/data/effective-risk.ts), fully shared with plugin pages, badges and the market index. Exemptions are manual only — the audit script never writes the suppression list; human review can record `withdrawn` to revert a conclusion to the static tier, effective immediately (no pipeline recomputation). Current dynamic audit: 2,925 records, 2,341 with a model conclusion, 2,340 in force (321 raised / 794 lowered), 1 withdrawn by human review. Entries outside the scanning scope (below L3, topic removed, flagged) are excluded from these registry-wide numbers and their badge reads pending.
The ecosystem is largely healthy: 28,747 entries (99%) sit in the low or medium tier. 16 have an effective tier of critical — either the dynamic audit found a blocking-severity issue, or the static scan hit blocking patterns such as secrets, exfiltration, destructive commands or mining; 261 are high (non-blocking severe findings); 1101 are medium — inspect before installing.
345 entries have no verdict yet (pending scan).
How a tier is decided: two inputs, one output
The left column is where the same plugins land under the static scan alone; the right side is where in-force dynamic conclusions moved them — the first row is this page's conclusion.
| Caliber | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| ① Effective (this report) | 16 | 261 | 1,101 | 27,646 | 29,024 |
| ② Static scan (reference) | 0 | 196 | 0 | 28,826 | 29,369 |
| ③ Dynamic (in force) | 16 | 254 | 1,101 | 760 | 2,131 |
Row ② puts entries without a dsh scan record into "pending" (347) rather than the four tiers; row ③ counts only conclusions in force (2,131, including low-tier ones not listed below). The dynamic layer covers 2,527 entries: 395 failed without a conclusion and 26,842 never entered the queue (static tier applies).
Static tier: vet (@jieai/dsh-plugin-vet) is the primary judge — critical → critical, suspicious → high, clean → low; the dsh scan only fills languages vet does not cover and escalates on blocking patterns. Dynamic tier: derived from the finding counts of that audit — any critical finding → critical, only high → high, only medium → medium, otherwise low.
What the scan looks for
The most common findings across all plugins, explained in plain language.
The plugin runs shell commands or spawns subprocesses. Common in CLI/terminal plugins, but worth knowing.
Usually legitimate for terminal tools — mapped to "needs review" rather than high risk.
The plugin evaluates code at runtime (eval, new Function). Powerful, but harder to audit.
Usually legitimate; mapped to "needs review" unless combined with other risk.
The plugin contains commands that can delete files or modify critical system areas (e.g. rm -rf, chmod 777).
High risk — understand exactly what it touches before running.
The plugin contains what looks like an API key, token, or private key written directly in its source code.
Anyone with access to the repo could use this credential. Treat with caution.
Parts of the code are deliberately hard to read (encoded blobs, fromCharCode tricks), making review difficult.
Obfuscation is a red flag — what is it hiding?
The plugin may send data to external endpoints (webhooks, tunnels, third-party servers).
Review what data could leave your machine before installing.
Note: shell/subprocess use and dynamic code execution are common in CLI and terminal plugins, so they are grouped under medium rather than critical — they are signals to review, not proof of malice.
Critical-risk plugins
16 plugins with an effective critical tier — the dynamic conclusion is authoritative where one exists, otherwise the static scan tier applies.
| Plugin | What it is | Static → effective | Static hits |
|---|---|---|---|
| dsh-cloud-connector★ 0 | — | low → criticalraised | 7 critical · 2 warning(Destructive commands, Shell / subprocess) |
| @wonaren/dsh-upgrade★ 1 | DSH 版本检测、多通道一键平滑升级与服务守护插件 | low → criticalraised | 3 critical · 5 warning(Shell / subprocess) |
| dsh-agnes-studio★ 26 | 🎬 泡泡猫的影视工具 — AI 影视创作工作站：文生图、图生图、文生视频、图生视频、短剧剧本拆解与提示词专家。支持 Agnes / DeepSeek / Qwen / 豆包 / MiniMax / Ollama 六大厂商，全局浮层不堵对话框。 | low → criticalraised | 3 critical · 1 warning(Shell / subprocess) |
| dsh-tmwebdriver★ 0 | One tool, infinite reach: arbitrary JS in your real logged-in browser. Unlike fixed-action plugins, browser_execute_js does anything DevTools can — read, click, type, fill, navigate, screenshot, CDP. Plus list_tabs/snapshot/type. Zero-setup, self-healing. | high → criticalraised | 2 critical · 8 warning(Dynamic code execution) |
| dsh-lark-all★ 0 | Feishu/Lark all-in-one channel plugin for DSH (Cordis): WebSocket bridge, parallel task sessions with streaming cards, media in/out, cloud docs, restart recovery notification. | low → criticalraised | 1 critical · 3 warning(Obfuscated code) |
| @LQH-A-A-O/cad-ppt-skills★ 0 | DSH 整合包：AutoCAD 出图（autocad-draw）+ PPT 制作（pptx-editor）两个 Windows 原生技能 | low → criticalraised | 1 critical(Shell / subprocess) |
| phone-tunnel-pool★ 7 | Refreshable Cloudflare quick-tunnel pool for the dsh web GUI — phone access with QR + embedded login | low → criticalraised | 0 critical · 16 warning |
| DSH-Desktop-Huacai★ 1 | DSH一键启动+无需node+内置丰富插件+编辑器模式 | low → criticalraised | 0 critical · 12 warning |
| dsh-plugin-manager★ 2 | DSH 插件管理器：桌面 GUI + CLI，管理 dsh 的 profile、插件与一键启动 dsh web (Tauri 2 + Node CLI) | low → criticalraised | 0 critical · 9 warning |
| dsh-lan-access★ 2 | DSH web plugin that adds a LAN access | low → criticalraised | 0 critical · 6 warning |
| @likhonmain/voice-input★ 1 | 🎙️ Voice Input plugin for DSH — record, pause, playback review, and transcribe speech directly into message drafts with custom OpenAI-compatible models. | low → criticalraised | 0 critical · 6 warning |
| DSHRemoteGateway★ 27 | 一个轻量级 DSH 远程网关，让你通过 Web 或移动设备远程访问和控制本地 AI Agent | low → criticalraised | 0 critical · 5 warning |
| dsh-tts-player★ 0 | — | low → criticalraised | 0 critical · 5 warning |
| @mvalentsev/dsh-wsl-projects★ 0 | One DSH web server per project, inside WSL2 — started, stopped and opened from a panel in the Windows app. | low → criticalraised | 0 critical · 5 warning |
| @Guuu16/dsh-remote★ 0 | 把本机的 DSH 接到任何地方：在 dsh 设置里配置中继服务器，手机就能访问同一份工作区和聊天记录。A dsh plugin for remote access — same runtime, not a second view of it. | low → criticalraised | 0 critical · 5 warning |
| @AlannerFranklin/dsh-relay-isolation★ 0 | Provision a separate DSH_HOME for a model relay, so relay traffic never shares your main Harness sessions or credentials. | low → criticalraised | 0 critical · 2 warning |
Showing the first 20 (ordered by static findings).
High-risk plugins
261 plugins with an effective high tier — the dynamic conclusion is authoritative where one exists, otherwise the static scan tier applies.
| Plugin | What it is | Static → effective | Static hits |
|---|---|---|---|
| @Dingpenghui-good/dsh-obsidian-sync★ 1 | — | low → highraised | 8 critical(Shell / subprocess) |
| dsh-4-role-workflow★ 1 | 4-agent workflow (PM + Browser + Programmer + DataEng) for complex DSH tasks. Real run in docs/run-example.md. | low → highraised | 7 critical · 2 warning(Shell / subprocess, Dynamic code execution) |
| see_the_screen★ 0 | Windows desktop automation plugin for DSH agents. Part of DSH Plugin Ecosystem. | low → highraised | 5 critical · 5 warning(Shell / subprocess) |
| dsh-pentester★ 100 | 基于 DSH 的多 Agent PTES 渗透测试编排插件，支持自动化侦察、漏洞分析、验证与报告，使用 Docker/Kali 隔离工具箱 | Multi-agent PTES penetration testing plugin for DSH with automated recon, vulnerability analysis, validation, reporting, and Docker/Kali toolbox | low → highraised | 5 critical(Shell / subprocess) |
| vpshub★ 1 | VPS Hub for DSH: SSH ledger plugin — agents discover, test, execute on, and transfer files to your cloud servers. Keys stay local as path references. | low → highraised | 4 critical · 4 warning(Destructive commands) |
| dsh-memory-eternal★ 20 | 记忆核心（Memory Eternal）：自研的 DSH 记忆插件——对话结束自动沉淀知识卡到本地 Markdown Vault（自研去重 / 自研 CJK 检索 / 知识图谱 + 审核中心 / 回收中心），Agent 通过 memory_recall 按需召回历史上下文，零人工干预。 | low → highraised | 3 critical · 11 warning(Shell / subprocess) |
| @zp2921060653/dsh-plugins★ 2 | DSH plugins: agent bridge (Claude Code/Codex/Marvis) + Ghidra reverse engineering bridge | low → highraised | 3 critical · 9 warning(Shell / subprocess) |
| chromex-browser★ 1 | A complete, hardware-accelerated Web Browser inside VS Code with Widevine DRM video playback, native audio, and zero iframe restrictions. | low → highraised | 3 critical · 3 warning(Shell / subprocess) |
| @Fourteenth-Night/dsh-aoci★ 0 | AOCI-CODE cognition layer for DSH: one-shot /aoci <path> gives agents governed, Git-versioned repository/database cognition via a dynamic MCP bridge (aoci_rules/overview/maintain), with auto-maintenance and compaction-contract recovery. MIT; AOCI-CODE binary not bundled. | low → highraised | 3 critical · 3 warning(Shell / subprocess) |
| dsh-plugin-offline-packager★ 7 | DSH 离线打包插件 — 在联网环境下将 DSH 插件打包为离线安装包（.tgz），传输到离线 DSH 环境中加载安装。 | low → highraised | 3 critical · 2 warning(Shell / subprocess) |
| dsh-ide-panels★ 1 | DSH 客户端布局插件：仿 VS Code 的 IDE 外壳——中间标签工具区/右侧栏/底部面板，真实 PowerShell 终端 + 本地代码变更对比 + Git 源码管理 + SSH/WSL 远程 | low → highraised | 3 critical · 2 warning(Shell / subprocess) |
| dsh-profile-port★ 0 | — | low → highraised | 3 critical · 2 warning(Shell / subprocess) |
| dsh-sandbox-permissions-not-strictly-wider-justification-empty-fix★ 0 | 修复 sandbox_permissions 和 justification 字段在 pwsh/bash/fs/dsh-sandbox 中的 no-op 升级报错。当会话已是 danger-full-access 模式时，模型携带空 justification 或重申同一模式被拒的问题。 | low → highraised | 3 critical · 1 warning(Shell / subprocess) |
| dsh-change-review★ 14 | DSH 会话修改审查插件：追踪会话内 write/edit，diff 对比展示，会话隔离/子代理聚合/SSE 实时推送/颜色自定义 | low → highraised | 3 critical(Shell / subprocess) |
| @pn1024/dsh-skill-market★ 12 | dsh plugin - skill marketplace (SkillHub + ClawHub) with sidebar entry, overlay panel, and chat input quick-pick | low → highraised | 3 critical(Shell / subprocess) |
| dsh-minecraft-theme★ 5 | Minecraft theme plugin for DSH: block-texture background, pixel fonts, MC-style buttons with click sounds, texture import/management, music player with local music folder support. | low → highraised | 3 critical(Obfuscated code) |
| dsh-smart-reminder★ 0 | Smart calendar reminder & schedule assistant for DSH Web GUI: lunar calendar, holidays, system notifications on macOS/Windows, and WeCom/platform push integration. | high → high | 3 critical(Shell / subprocess) |
| odsh-bridge★ 3 | A bridge that connects Openclaw and DSH | low → highraised | 2 critical · 9 warning(Destructive commands) |
| dsh-k8s★ 2 | — | low → highraised | 2 critical · 6 warning(Shell / subprocess) |
| @joansgwjbsu/dsh-plugin-cdp★ 1 | DSH plugin: Chrome DevTools Protocol automation | low → highraised | 2 critical · 5 warning(Dynamic code execution) |
Showing the first 20 (ordered by static findings). The other 241 are filterable in the plugin list.
Medium-risk plugins
1101 plugins with an effective medium tier — the dynamic conclusion is authoritative where one exists, otherwise the static scan tier applies.
| Plugin | What it is | Static → effective | Static hits |
|---|---|---|---|
| dsh-flowglass★ 25 | 流镜 Flowglass — DSH session flowgraph，实时可视化消息、工具组、子代理分支与步骤详情。 | low → mediumraised | 10 critical · 1 warning(Dynamic code execution) |
| @zirscard/dsh-macos-signfix★ 0 | macOS code-signing repair for DSH: one doc_ocr_sign_fix tool that diagnoses and fixes the condition where the bundled Python cannot load native extensions because of hardened runtime and library validation. | low → mediumraised | 8 critical · 1 warning(Shell / subprocess) |
| @lzqzm/dsh-project-panel★ 0 | DSH 插件 | low → mediumraised | 7 critical · 21 warning(Dynamic code execution, Shell / subprocess) |
| dsh-deepseek-web-adapter★ 21 | 免费的 DeepSeek 网页版（chat.deepseek.com）LLM 服务提供方，用于 DSH——无需 API 密钥。自动启动网关，支持工具调用和连续对话。Free DeepSeek Web (chat.deepseek.com) LLM provider for DSH — no API key. Auto-launches gateway, tool calling, continuous chat. | low → mediumraised | 7 critical · 19 warning(Shell / subprocess) |
| dsh-cyber-sec★ 5 | Authorized security-assessment profile for DSH: scoped network tools, container-backed shell, authorization guard, durable evidence, 21 security skills, 7 specialist subagents | low → mediumraised | 7 critical · 4 warning(Destructive commands) |
| dsh-testsuite★ 2 | testsuite of dsh plugins | low → mediumraised | 7 critical · 1 warning(Shell / subprocess) |
| dsh-shadow-auditor★ 1 | DSH plugin for background security audits, secret leakage detection, and command safety | low → mediumraised | 7 critical(Shell / subprocess, Hardcoded secrets, Destructive commands) |
| dsh-dolphin-security★ 0 | DSH plugin — active-defense security patrol powered by SSH + Semgrep. 集扫描、远程执行、结构化报告于一体的 DSH 主动安全巡逻插件。 | low → mediumraised | 6 critical · 2 warning(Shell / subprocess, Destructive commands, Hardcoded secrets) |
| dsh-peekfile-everything★ 0 | DSH local file search, clickable path detection, and floating preview plugin with optional EverythingCLI integration. | low → mediumraised | 6 critical · 1 warning(Shell / subprocess) |
| @qftuftfutg/apk-devkit★ 0 | This is a Dsh plugin toolkit that supports unpacking, repacking, signing, DEX processing, file handling, archive management, image processing and hash calculation, which can reduce token consumption under certain circumstances. | low → mediumraised | 6 critical(Shell / subprocess) |
| @AIcivilization/dsh-vps★ 12 | One-command DSH on your VPS: a zero-dependency login gateway puts the stock DSH web UI - settings, API keys, plugin market - behind HTTPS and a password, reachable from anywhere. · 一条命令把 DSH 装进 VPS：零依赖登录网关 + 自动 HTTPS，公网可达，设置、API Key、插件市场全都能用。 | low → mediumraised | 5 critical · 13 warning(Shell / subprocess, Hardcoded secrets, Destructive commands) |
| dsh-sim-restart★ 0 | Simulated-restart testing for DSH plugins: verifies plugins survive restart (module eval → apply → smoke → dispose) in isolated subprocesses, with a resident auto-watcher and agent feedback loop | low → mediumraised | 5 critical(Dynamic code execution, Shell / subprocess) |
| Personal_MCP★ 2 | 这是一个用来存放个人搭建的MCP服务的仓库 | low → mediumraised | 4 critical · 6 warning(Shell / subprocess) |
| dsh-remote-vps★ 0 | Outils fichiers distants pour DSH : read/write/edit/glob/grep/bash sur vos VPS via SSH (Tailscale), avec gestion des connexions dans Settings | low → mediumraised | 4 critical · 5 warning(Destructive commands, Shell / subprocess) |
| dsh-opencode-go-usage★ 12 | DSH 插件:OpenCode Go 用量与花费悬浮仪表盘(配额、逐请求成本、模型/来源分布) | low → mediumraised | 4 critical · 4 warning(Shell / subprocess) |
| dsh-almazom-approve-escalate★ 0 | DSH web plugin: one-click Approve & escalate on the approval card — approves the pending request and switches the live session to a permission preset | low → mediumraised | 4 critical · 4 warning(Shell / subprocess) |
| @Han-1413141/dsh-autocompose★ 1 | Task-aware plugin composition for DSH, with native Web UI and isolated task execution | low → mediumraised | 4 critical · 3 warning(Shell / subprocess) |
| dsh-plugin-photoshop★ 10 | 让 DSH 的 AI 直接驱动你本机的 Photoshop：批量抠图、批量处理、任意 PS 脚本。7 个工具、93 个操作、零依赖。 | low → mediumraised | 4 critical · 2 warning(Dynamic code execution) |
| @Dalld/dsh-ssh-plugin★ 3 | SSH for DSH agents: run commands and move files over SSH while private keys stay inside the Host process. | low → mediumraised | 4 critical · 1 warning(Hardcoded secrets, Shell / subprocess) |
| dsh-sql★ 9 | DSH 数据库工具：SQLite / MySQL / PostgreSQL 查询、结构与统计、只读保护和写操作确认。欢迎提交 issues 和 PR。 | low → mediumraised | 4 critical(Shell / subprocess) |
Showing the first 20 (ordered by static findings). The other 1081 are filterable in the plugin list.
What we scan, the two layers, and the limits of the dynamic audit.
Every plugin page shows its own two layers and effective tier.
Weekly archived tiers and tier-change lists (dynamic audit merged in).
Scans are automated — not a manual review, and never an endorsement. Install third-party plugins at your own risk.