2026-W38
Published 2026-09-14
This week
Critical-risk plugins
0 plugins rated critical — vet-critical or blocking patterns (secrets / exfiltration / destructive / mining)
| Plugin | What it is | Risk |
|---|---|---|
| None |
Needs review (medium)
103 plugins rated medium — vet suspicious, or retired "high" hits like code execution / shell
| Plugin | What it is | Risk |
|---|---|---|
| dsh-web-profile ★ 1 | — | Medium |
| dsh-smart-reminder ★ 0 | Smart calendar reminder & schedule assistant for DSH Web GUI: lunar calendar, holidays, system notifications on macOS/Windows, and WeCom/platform push integration. | Medium |
| dsh-tmwebdriver ★ 0 | One tool, infinite reach: arbitrary JS in your real logged-in browser. Unlike fixed-action plugins, browser_execute_js does anything DevTools can — read, click, type, fill, navigate, screenshot, CDP. Plus list_tabs/snapshot/type. Zero-setup, self-healing. | Medium |
| dsh-v-explorer ★ 1 | right slider for deepseek-harness-plugin. | Medium |
| dsh-remote ★ 0 | Remote access suite for DeepSeek Harness: QR pairing, HMAC sessions, cloudflared tunnel and PWA. Zero installs on any device. | Medium |
| claude-in-dsh ★ 3 | 在 dsh web 里用本机 Claude Code 驱动会话：原生渲染、权限档、模型/effort、命令面板、broker 托管进程 | Medium |
| dsh-upgrade-kit ★ 1 | DSH 装备升级套件：看钱（dsh-cost 费用面板）、看文件（file-preview 预览）、搜外网（research-mcp）、看图片（vision-bridge）。一条命令全装。 | Medium |
| cli ★ 3 | AtlasCloud CLI installers and release artifacts | Medium |
| dsh-remote ★ 0 | Operate DeepSeek Harness from your phone: self-hosted relay + desktop plugin tunnel with a mobile-adapted web UI. MIT | Medium |
| dsh-cordis-mcp ★ 2 | DeepSeek Harness 插件：把 DSH 的动态 Cordis 工具集（inspect/define/run/stop/undefine）以 MCP 暴露给 Claude Code。端点强制身份认证，token 可在 DSH 设置页配置。 | Medium |
| vision-toolkit-for-dsh-v0.1-maybe- ★ 1 | Zero-dependency vision OCR/Q&A toolkit (CLI + local web GUI) for OpenAI-compatible VLMs: Zhipu GLM, Qwen, OpenAI, OpenRouter, SiliconFlow | Medium |
| dsh-auto-classifier ★ 1 | — | Medium |
| dsh-launcher ★ 1 | macOS 程序坞一键启动 DeepSeek Harness (DSH) 的快捷启动器 / One-click DSH launcher for macOS Dock | Medium |
| dsh-balance-plugin ★ 60 | deepSeek 余额监控与用量统计（DSH 动态 Cordis 插件）：余额监控 · 官方充值入口 · 用量统计 · 三方插件管理 | Medium |
| dsh-convmap ★ 2 | DeepSeek Harness web 插件：在主对话区左缘中部渲染「对话地图」刻度（每条 = 一轮用户提问），hover 梯度展开并预览该轮提问/回复摘要，点击跳转（未渲染的老轮次自动分页加载后再跳），滚动时当前轮次自动高亮。 | Medium |
| dsh-moodball ★ 1 | DeepSeek Harness Pet | Medium |
| paper-workbench ★ 0 | — | Medium |
| dsh-balance ★ 3 | DeepSeek Harness web 插件：输入框下方状态栏展示当前供应商的余额/用量 —— DeepSeek 官方余额 + 本会话花费，Kimi Coding、OpenCode Go、GLM Coding Plan 等订阅用量（支持的供应商见 README）。按 provider 判断、2 秒轮询实时切换、5 分钟缓存。 | Medium |
| conjugate-spectral-geometry ★ 2 | Conjugate Spectral Geometry - Geometric Theory of quantum error correction: 12-volume/117-paper index + DeepSeek RAG knowledge AI (Open WebUI). | Medium |
| dsh-better-tool-ui ★ 1 | DeepSeek Harness web 插件：把工具调用（含 MCP）、流式工具行与 thinking 行渲染成紧凑时间线 | Medium |
Showing the 20 most severe.
Automated heuristic scan (static analysis) — a scalable first line of defense; may produce false positives. Not a manual review.
Weekly report archive
6 reportsWhat does this weekly report measure?
This report measures the automated static scan state of the dsh.so plugin registry during 2026-W38: the number of scanned plugins, the distribution across three tiers (low, medium, critical), and the plugins whose risk tier changed since the previous archive.
Why isn't this report an endorsement?
A report row reflects public repository metadata and heuristic rule matches, not a manual audit or runtime verification. False positives and false negatives are possible, so risk flags are a reason to inspect a plugin before install rather than a substitute for that inspection.
Source: dsh.so security standards · Maintained by dsh.so · Published