2026-W33
Published 2026-08-16
1650
scanned
21
critical
105
need review
876
low risk
This week
▲ New critical risk
▲ New needing review
▼ Cleared needing review
Critical-risk plugins
21 plugins rated critical — vet-critical or blocking patterns (secrets / exfiltration / destructive / mining)
| Plugin | What it is | Risk |
|---|---|---|
| dsh-cyber-sec ★ 2 | Authorized security-assessment profile for DeepSeek Harness: scoped network tools, container-backed shell, authorization guard, durable evidence, 21 security skills, 7 specialist subagents | Critical |
| dsh-auto-approve ★ 15 | 为 DeepSeek Harness 增加介于 Workspace Write 与 Full access 之间的自动批准权限档，危险或不确定操作仍转人工审批。An auto-approval permission preset between workspace-write and full access for DeepSeek Harness. | Critical |
| dsh-clawrouter ★ 21 | A safety gate for DeepSeek Harness: a stronger model reviews dangerous tool calls before they run. Plus vision and BlockRun's full model catalog from one wallet, paid per request over x402. | Critical |
| dsh-remote-ide ★ 3 | Cloud workspaces for DeepSeek Harness — pick Cloud (SSH) in the workspace picker and the agent's bash/read/write/edit/glob/grep tools transparently run on your Linux server over SSH. Zero remote install. | Critical |
| dsh-remote ★ 100 | Remote-work assistant for DeepSeek Harness (DSH): connect SSH (key or password), pick a remote workspace, operate with rw_* tools, and SFTP-mirror it into a real local DSH workspace. | Critical |
| dsh-terminal-panel ★ 2 | A manual Terminal tab for the DeepSeek Harness (dsh) web UI — run commands on the host machine, persistent cwd, sudo password prompt, command history.现在可以在web界面内直接执行命令行了 | Critical |
| dsh-security-scan ★ 0 | No description provided. | Critical |
| openguardrails ★ 48 | The vendor-neutral protocol for AI agent safety & security — and the neutral benchmark that ranks the vendors. | Critical |
| dsh-file-upload ★ 9 | DSH 拖拽文件转路径插件：Codex 式拖拽，路径自动插入输入框（Drop File to Path for DeepSeek Harness） | Critical |
| dsh-desktop ★ 2 | Desktop shell for DeepSeek Harness Web GUI — auto-installs dsh, native macOS tray, packaged for macOS & Windows. | Critical |
| DeepSeek-harness-wecom ★ 4 | WeCom AI Bot text and image bridge for DeepSeek Harness | Critical |
| dsh-drop-file-to-path ★ 9 | DSH 拖拽文件转路径插件：Codex 式拖拽，路径自动插入输入框（Drop File to Path for DeepSeek Harness） | Critical |
| DeepSeek-harness-lark ★ 3 | Feishu and Lark text and image channel plugin for DeepSeek Harness | Critical |
| hesi-dsh-plugins ★ 3 | DeepSeek Harness (DSH) 插件 —— 圆桌讨论（Roundtable）与 一键执行流（Plan） Hesi 出品 · 同源实现 | Critical |
| dsh-openclaw-acp ★ 1 | DeepSeek Harness bundle for OpenClaw and WeChat over ACP | Critical |
| dsh-image-to-path ★ 2 | DSH 插件:让纯文本模型对话也能拖图/贴图——图片自动保存到会话工作区,以文件路径交给模型(多模态模型不受影响) | Critical |
| zeromd ★ 34 | Obsidian 零成本同步：iPhone ↔ Mac，GitHub 自动备份。本地优先 + 长期积累。｜Local First. Zero-cost Obsidian sync across iPhone, Mac & GitHub. Let knowledge grow over time. | Critical |
| dsh-design-skills ★ 22 | Design aesthetics skill pack for DeepSeek Harness (DSH) - keeps vibe-coded websites away from the AI look. 6 styles: dark-saas, apple-minimal, neo-neumorphism, brutalism, glassmorphism, japanese-minimal. | Critical |
| DeepSeek-harness-qqbot ★ 6 | QQ Bot text and image channel plugin for DeepSeek Harness | Critical |
| DeepSeek-Harness-linux- ★ 3 | 一个基于官方WebUI二改的Linux桌面端，内置了一个外挂视觉插件(需手动接入API Key)，已经迭代了四个版本，可能还是有些小毛病，不过目前用下来暂时没有什么大问题。 | Critical |
| dsh-plugin-hub ★ 3 | Plugin Store for DeepSeek Harness (DSH): a graphical app-store inside the Harness Web UI — browse, search and one-click install GitHub dsh-plugins (topic:dsh-plugin / #dsh-plugin repos), with local ratings, dependency impact graphs, audit logging and a plugin scaffold guide. | Critical |
Needs review (medium)
648 plugins rated medium — vet suspicious, or retired "high" hits like code execution / shell
| Plugin | What it is | Risk |
|---|---|---|
| dsh-hdc-bridge ★ 18 | DSH 原生鸿蒙开发助手：hdc 设备闭环调试 + 设备面板（官方 client 插件形态）+ 离线官方知识层（Tier-1 随包）+ DevEco CLI 构建/签名/模拟器控制 / DSH-native HarmonyOS dev assistant: hdc device loop, live device panel, offline official knowledge, DevEco CLI build/sign/emulator | Medium |
| DeepSeek-Harness-Desktop ★ 2 | dsh-desktop: DeepSeek Harness 桌面插件 - click-to-launch Codex-like native window over the live dsh web UI. Everything is a plugin - this one is the window. | Medium |
| DSH-Desktop ★ 21 | DSH-Desktop | Medium |
| dsh-wsl-workspace ★ 52 | WSL workspace support for DeepSeek Harness——无缝的 WSL 工作区使用体验，无需在 WSL 之中再安装一个dsh，安装该插件后在 GUI 里直接添加 WSL 工作区即可。WSL workspace support for DeepSeek Harness — Enjoy a seamless WSL workspace experience without needing to install dsh inside WSL. Once this plugin is installed, you can directly add a WSL workspace right from the GUI. | Medium |
| DSH-Plugin-Market ★ 3 | DeepSeek Harness 插件市场：精选目录 + GitHub 实时浏览、中英翻译搜索、安装前静态安全审计闸门。Plugin market for DeepSeek Harness with a pre-install security audit gate. | Medium |
| whale-notify ★ 6 | 鲸鱼通知——基于DeepSeek Harness的通知和鲸鱼娘人设插件 | Medium |
| deepseek-harness-desktop ★ 99 | DeepSeek Harness Codex Desktop — 无需预装环境、开箱即用的跨平台桌面客户端 · A ready-to-use cross-platform DeepSeek Harness desktop client with no environment setup | Medium |
| dsh-search-boost ★ 16 | The plunge for dsh to boost model's search ability. | Medium |
| DSH-Plugins-Marketplace ★ 168 | DSH插件市场 / DSH Plugin Marketplace: 在 DeepSeek Harness Web GUI 中一键浏览、安装与更新 GitHub topic:dsh-plugin 的全部插件 | browse, install & update all GitHub dsh-plugin plugins in the DSH Web GUI | Medium |
| dsh-remote-tunnel ★ 5 | Remote Host Tunnel Manager for dsh: remote port allocation + registry + resilient SSH tunnel | Medium |
| dsh-prompt-enhancer ★ 76 | DeepSeek Harness (DSH) 插件：✨ 提示词一键增强 + 💬 语音识别（说完自动停·云端/本地双引擎）· 附 🔁 服务异常一键重启 | Medium |
| dsh-toy ★ 66 | Toy Control Protocol for DSH | Medium |
| dsh-side-panel ★ 15 | DSH 侧边栏，集成文件浏览器、终端和 Git 审查，方便预览文件。 | Medium |
| DSH_plugins_4U ★ 1 | DSH 自建插件集合：微信桥接器 + GUI 微信入口补丁，一键安装 | Medium |
| dsh-desktop ★ 92 | 一款主打安全且更尊重开发者的开源 DeepSeek Harness 桌面客户端。官方 Web UI ，长任务常驻托盘，支持通知推送；内置安全市场，600+精选插件支持先审查、再安装。 | Medium |
| dsh-sentinel ★ 16 | Condition-driven wakeup for DeepSeek Harness: durable file/command/http/process/webhook watches that wake the agent, with dock, sidebar branch, and a global dashboard. | Medium |
| dsh-ankh-guard ★ 6 | dsh 自托管运维守护：agent 改完代码先验证构建测试再重启，起不来自动回滚。镜像仓，与 Khorsheed/dsh-plugins 的 packages/ankh-guard 自动同步。 | Medium |
| dsh-plugin-workshop ★ 24 | Steam Workshop-style plugin browser for the DeepSeek Harness (DSH) Web UI - zero-server: GitHub-powered search, trending windows, Chinese search & bilingual translation, plugin-signature filtering, and smart one-click install/update/uninstall with an installed-plugins manager. | Medium |
| dsh-desktop-tools ★ 1 | DeepSeek Harness 工具集导航:Web 插件集(dsh-web-plugins)/ Windows 桌面端(dsh-desktop-app)/ AI 知识库模板(ai-knowledge-base) | Medium |
| dsh-plugin-verify ★ 1 | 验证 DSH 插件的 CLI：一条命令跑 mock-llm 完整 agent 循环，检查 waterfall 链与零副作用，产出验证报告 | Medium |
Showing the 20 most severe.
Automated heuristic scan (static analysis) — a scalable first line of defense; may produce false positives. Not a manual review.
Weekly report archive
8 reportsWhat does this weekly report measure?
This report measures the automated static scan state of the dsh.so plugin registry during 2026-W33: the number of scanned plugins, the distribution across three tiers (low, medium, critical), and the plugins whose risk tier changed since the previous archive.
Why isn't this report an endorsement?
A report row reflects public repository metadata and heuristic rule matches, not a manual audit or runtime verification. False positives and false negatives are possible, so risk flags are a reason to inspect a plugin before install rather than a substitute for that inspection.
Source: dsh.so security standards · Maintained by dsh.so · Published