2026-W34
Published 2026-08-17
16
critical
549
high risk
152
need review
1245
low risk
1962
scanned
This week
Critical-risk plugins
| Plugin | What it is | Risk |
|---|---|---|
| dsh-cyber-sec ★ 3 | Authorized security-assessment profile for DeepSeek Harness: scoped network tools, container-backed shell, authorization guard, durable evidence, 21 security skills, 7 specialist subagents | Critical |
| dsh-desktop ★ 4 | Desktop shell for DeepSeek Harness Web GUI — auto-installs dsh, native macOS tray, packaged for macOS & Windows. | Critical |
| dsh-auto-approve ★ 4 | Conservative auto-approval preset for DeepSeek Harness sandbox escalations | Critical |
| dsh-skill-pack-security ★ 1 | Security-audit skill pack for DeepSeek Harness (dsh): 5 agent skills - secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration. Zero runtime code. Apache-2.0. | Critical |
| dsh-file-upload ★ 6 | DSH 拖拽文件转路径插件：Codex 式拖拽，路径自动插入输入框（Drop File to Path for DeepSeek Harness） | Critical |
| dsh-terminal-panel ★ 3 | A manual Terminal tab for the DeepSeek Harness (dsh) web UI — run commands on the host machine, persistent cwd, sudo password prompt, command history.现在可以在web界面内直接执行命令行了 | Critical |
| dsh-remote-ide ★ 3 | SSH Remote IDE for DeepSeek Harness: connect via SSH and the IDE goes remote — explorer browses the server, editor reads/writes over SFTP, terminal is a live SSH PTY. Dual-face DSH plugin. | Critical |
| dsh-openclaw-acp ★ 1 | DeepSeek Harness bundle for OpenClaw and WeChat over ACP | Critical |
| zeromd ★ 33 | Obsidian 零成本同步：iPhone ↔ Mac，GitHub 自动备份。本地优先 + 长期积累。｜Local First. Zero-cost Obsidian sync across iPhone, Mac & GitHub. Let knowledge grow over time. | Critical |
| openguardrails ★ 27 | The vendor-neutral protocol for AI agent safety & security — and the neutral benchmark that ranks the vendors. | Critical |
| dsh-design-skills ★ 12 | Design aesthetics skill pack for DeepSeek Harness (DSH) - keeps vibe-coded websites away from the AI look. 6 styles: dark-saas, apple-minimal, neo-neumorphism, brutalism, glassmorphism, japanese-minimal. | Critical |
| dsh-clawrouter ★ 9 | A second brain for your DeepSeek Harness agent — strong-model review before risky tool calls, plus 70 models from one wallet. | Critical |
| DeepSeek-harness-qqbot ★ 7 | QQ Bot text and image channel plugin for DeepSeek Harness | Critical |
| DeepSeek-harness-wecom ★ 5 | WeCom AI Bot text and image bridge for DeepSeek Harness | Critical |
| DeepSeek-Harness-linux- ★ 3 | 一个基于官方WebUI二改的Linux桌面端，内置了一个外挂视觉插件(需手动接入API Key)，已经迭代了四个版本，可能还是有些小毛病，不过目前用下来暂时没有什么大问题。 | Critical |
| DeepSeek-harness-lark ★ 3 | Feishu and Lark text and image channel plugin for DeepSeek Harness | Critical |
High-risk plugins
| Plugin | What it is | Risk |
|---|---|---|
| whale-notify ★ 4 | 鲸鱼通知——基于DeepSeek Harness的通知和鲸鱼娘人设插件 | High |
| dsh-search-boost ★ 10 | The plunge for dsh to boost model's search ability. | High |
| DeepSeek-Harness-Desktop ★ 6 | 一个 Electron 桌面壳，内嵌官方 DeepSeek Harness Web UI。启动时让用户选择安装模式，自动完成环境检测、安装、服务拉起，以百分比进度条展示各阶段，服务就绪后打开主界面。 | High |
| DeepSeek-Harness-Desktop ★ 3 | dsh-desktop: DeepSeek Harness 桌面插件 - click-to-launch Codex-like native window over the live dsh web UI. Everything is a plugin - this one is the window. | High |
| dsh-remote-tunnel ★ 3 | Remote Host Tunnel Manager for dsh: remote port allocation + registry + resilient SSH tunnel | High |
| dsh-ankh-guard ★ 4 | 防止 Agent 自我修改把服务改崩的守护插件（dsh 插件）：绿色构建凭证绑定 git HEAD，改坏不许重启；watchdog 无感重启 + canary 自动回滚 | High |
| dsh-desktop-tools ★ 3 | DeepSeek Harness 桌面端 + 插件社区 + Agent 社区(270 个开源中文角色预设) | High |
| DSH-Desktop ★ 21 | DSH-Desktop | High |
| deepseek-harness-desktop ★ 2 | Desktop for DeepSeek Harness 跨平台桌面版，无需提前安装任何环境 | High |
| dsh-passwords ★ 11 | dsh-passwords: DeepSeek Harness login gateway - first-run setup, at-rest encryption, brute-force lockout, audit log, HTTPS | High |
| dsh-toy ★ 54 | Toy Control Protocol for DSH | High |
| dsh-desktop-electron ★ 4 | Cross-platform Electron desktop shell for the DSH Web GUI: tray-resident standalone window over your own dsh web, no bundled Node runtime | High |
| MakoCode ★ 139 | MakoCode — 茉子版 Agent | Galgame 风格桌面 AI Agent，零门槛体验 Agent 的乐趣 | High |
| dsh-np-ppt ★ 3 | 原生 DSH (DeepSeek Harness) 插件：PPT 演示文稿专家，内置 PPTD DSL 引擎、55173 所见即所得可视化编辑器、Python-PPTX 高保真离线编译内核与一键导出 PPTX。 | Native DSH plugin: PPT presentation expert with PPTD DSL engine, 55173 WYSIWYG editor, Python-PPTX offline compiler & 1-click PPTX export. | High |
| dsh-island ★ 4 | 把 DeepSeek Harness(DSH) agent 实时状态桥接到 CodeIsland 刘海面板 — sessions/tools/approvals on the Dynamic Island | High |
| DSH-Plugin-Market ★ 4 | DeepSeek Harness 插件市场：精选目录 + GitHub 实时浏览、中英翻译搜索、安装前静态安全审计闸门。Plugin market for DeepSeek Harness with a pre-install security audit gate. | High |
| dsh-vscode ★ 4 | DeepSeek Harness for VS Code: right-side chat agent that reads, edits, and runs your project — like Claude Code / Codex / Copilot. | High |
| dsh-desktop-hub ★ 11 | DSH Desktop Hub — DeepSeek Harness 桌面管理控制台（Electron + TypeScript）。多 Tab 管理 Harness / Plugin / MCP / Skills，双击即用。 | High |
| dsh-plugin-verify ★ 1 | 验证 DSH 插件的 CLI：一条命令跑 mock-llm 完整 agent 循环，检查 waterfall 链与零副作用，产出验证报告 | High |
| dsh-report-html ★ 3 | Generate self-contained interactive HTML reports from Markdown, tables, charts, China province maps, flowcharts, math, and drill-down tables — a DeepSeek Harness (dsh) plugin | High |
Showing the 20 most severe.
Automated heuristic scan — may produce false positives. Not a manual review, never an endorsement.