2026-W40
Published 2026-09-27
Critical-risk plugins
0 plugins rated critical — vet-critical or blocking patterns (secrets / exfiltration / destructive / mining)
| Plugin | What it is | Risk |
|---|---|---|
| None |
Needs review (medium)
106 plugins rated medium — vet suspicious, or retired "high" hits like code execution / shell
| Plugin | What it is | Risk |
|---|---|---|
| dsh-web-profile ★ 0 | — | Medium |
| @dgagf111/dsh-hydrasearch ★ 0 | TinyFish + AnySearch web search and fetch provider for DeepSeek Harness: one failover-chain provider with an operator-controlled backend priority and a settings card. | Medium |
| dsh-smart-reminder ★ 0 | Smart calendar reminder & schedule assistant for DSH Web GUI: lunar calendar, holidays, system notifications on macOS/Windows, and WeCom/platform push integration. | Medium |
| dsh-upgrade-kit ★ 0 | DSH 装备升级套件：看钱（dsh-cost 费用面板）、看文件（file-preview 预览）、搜外网（research-mcp）、看图片（vision-bridge）。一条命令全装。 | Medium |
| dsh-tmwebdriver ★ 0 | One tool, infinite reach: arbitrary JS in your real logged-in browser. Unlike fixed-action plugins, browser_execute_js does anything DevTools can — read, click, type, fill, navigate, screenshot, CDP. Plus list_tabs/snapshot/type. Zero-setup, self-healing. | Medium |
| dsh-remote ★ 0 | Remote access suite for DeepSeek Harness: QR pairing, HMAC sessions, cloudflared tunnel and PWA. Zero installs on any device. | Medium |
| claude-in-dsh ★ 3 | 在 dsh web 里用本机 Claude Code 驱动会话：原生渲染、权限档、模型/effort、命令面板、broker 托管进程 | Medium |
| cli ★ 5 | AtlasCloud CLI installers and release artifacts | Medium |
| dsh-desktop ★ 2 | DeepSeek Harness 桌面端（macOS / Windows）：双击即用的官方 dsh「瘦壳」——不内置 dsh、首次运行自动安装，无需 Node/npm 等任何环境，带版本管理与回滚、App 内更新、插件管理与干净卸载。 | Medium |
| dsh-remote ★ 0 | Operate DeepSeek Harness from your phone: self-hosted relay + desktop plugin tunnel with a mobile-adapted web UI. MIT | Medium |
| dsh-cordis-mcp ★ 1 | DeepSeek Harness 插件：把 DSH 的动态 Cordis 工具集（inspect/define/run/stop/undefine）以 MCP 暴露给 Claude Code。端点强制身份认证，token 可在 DSH 设置页配置。 | Medium |
| vision-toolkit-for-dsh-v0.1-maybe- ★ 1 | Zero-dependency vision OCR/Q&A toolkit (CLI + local web GUI) for OpenAI-compatible VLMs: Zhipu GLM, Qwen, OpenAI, OpenRouter, SiliconFlow | Medium |
| dsh-auto-classifier ★ 1 | — | Medium |
| dsh-launcher ★ 0 | macOS 程序坞一键启动 DeepSeek Harness (DSH) 的快捷启动器 / One-click DSH launcher for macOS Dock | Medium |
| dsh-balance-plugin ★ 64 | deepSeek 余额监控与用量统计（DSH 动态 Cordis 插件）：余额监控 · 官方充值入口 · 用量统计 · 三方插件管理 | Medium |
| dsh-convmap ★ 1 | DeepSeek Harness web 插件：在主对话区左缘中部渲染「对话地图」刻度（每条 = 一轮用户提问），hover 梯度展开并预览该轮提问/回复摘要，点击跳转（未渲染的老轮次自动分页加载后再跳），滚动时当前轮次自动高亮。 | Medium |
| paper-workbench ★ 0 | — | Medium |
| conjugate-spectral-geometry ★ 2 | Conjugate Spectral Geometry - Geometric Theory of quantum error correction: 12-volume/117-paper index + DeepSeek RAG knowledge AI (Open WebUI). | Medium |
| dsh-balance ★ 2 | DeepSeek Harness web 插件：输入框下方状态栏展示当前供应商的余额/用量 —— DeepSeek 官方余额 + 本会话花费，Kimi Coding、OpenCode Go、GLM Coding Plan 等订阅用量（支持的供应商见 README）。按 provider 判断、2 秒轮询实时切换、5 分钟缓存。 | Medium |
| dsh-security ★ 2 | 在 DeepSeek Harness (DSH) 内等价重建 OpenAI codex-security 安全审计能力的原生插件 | Medium |
Showing the 20 most severe.
Automated heuristic scan (static analysis) — a scalable first line of defense; may produce false positives. Not a manual review.
Weekly report archive
8 reportsWhat does this weekly report measure?
This report measures the automated static scan state of the dsh.so plugin registry during 2026-W40: the number of scanned plugins, the distribution across three tiers (low, medium, critical), and the plugins whose risk tier changed since the previous archive.
Why isn't this report an endorsement?
A report row reflects public repository metadata and heuristic rule matches, not a manual audit or runtime verification. False positives and false negatives are possible, so risk flags are a reason to inspect a plugin before install rather than a substitute for that inspection.
Source: dsh.so security standards · Maintained by dsh.so · Published