Daily security scan
Date · 2026-08-22 (UTC — plugins first indexed that day)
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| agentscars A public commons of real AI-agent failure patterns ("scars") — searchable via API and MCP. Live at agentscars.com. Private for now, open-sourcing once ready. | low | pass | 0/0/4 | 0/0 | 2026-08-22 00:40 |
| dsh-plugin-session-manager-custom DSH Web plugin for local session data management | medium | warn | 0/1/2 | 0/0 | 2026-08-22 00:40 |
| dsh-image-tiler DSH插件：将大图像分割成带标签的800像素图块，并保留概览图，同时保留视觉模型所需的细节。包含设置卡。DSH plugin: slice large images into labeled 800px tiles + overview, preserving detail for vision models. Settings card included. | low | pass | 0/0/0 | 0/0 | 2026-08-22 00:40 |
| dsh-hooks-git-ai A DSH plugin that records which files the agent edited, with which model, and in which session into git-ai | low | pass | 0/0/0 | 0/0 | 2026-08-22 00:40 |
| dsh-font-size DSH Web GUI plugin: 'Conversation font size' slider (12-22 px) in Settings → General. | low | pass | 0/0/4 | 0/0 | 2026-08-22 00:40 |
| dsh-jj-vcs Jujutsu version-control plugin and skill for DSH multi-agent teams | medium | warn | 0/3/3 | 0/0 | 2026-08-22 00:40 |
| dsh-pm dsh-pm is the ChunSun × DSH reference plugin: an AI-native project-delivery loop driven by ChunSun. Requirements / Runs / Steps / acceptance scenarios & cases / work-memory, a session delivery panel, and 28 chunsun_* model tools — with the platform as the single source of truth. MIT. | low | pass | 0/0/0 | 0/0 | 2026-08-22 00:40 |
| dsh-novel-writing DSH 自动化小说写作发布流水线插件：claude-writing-workflow 迁移版 agent 预设 + 小说工作台（可视化/实时渲染/章节编辑）+ 多平台发布配置与数据驱动优化闭环 | medium | warn | 1/0/4 | 0/0 | 2026-08-22 00:40 |
| dsh-one-gateway Private DSH One Gateway — loopback, identity-first ingress for DSH | low | pass | 0/0/2 | 0/0 | 2026-08-22 00:40 |
| dsh-lanchat | medium | warn | 2/1/10 | 0/0 | 2026-08-22 00:40 |
| dsh-android DSH plugin for Android — build, run, and interact with a live emulator or USB device stream inside a conversation, driven entirely through adb. | medium | warn | 0/2/7 | 0/0 | 2026-08-22 00:40 |
| Dsh-dev Version-aware workspace core for building DSH plugins | medium | warn | 0/5/8 | 0/0 | 2026-08-22 00:40 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
50 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-08-22. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published