Daily security scan
Date · 2026-09-02 (UTC — plugins first indexed that day)
Static scan · new today
rule heuristics · shape only0
critical
11
high
8
medium
66
low
Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.
Dynamic audit · subset of new today
model reads source · no execution0
critical
2
high
2
medium
1
low
Only entries static-flagged ≥ warn are audited; tier = highest finding. Of 85 new entries, 80 are out of the queue or have no conclusion yet.
| Plugin | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-write-create-only write 仅创建：禁止 write 覆盖已存在文件，目标已存在时自动拒绝并提示改用 edit，防止模型误覆写已有内容。纯 host 端 dsh 插件。 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 00:13 |
| dsh-model-compat-guard DSH compatibility guard plugin: fixes reasoning-model compaction truncation, doomed sandbox-escalation fail-close, and missing tool description for GPT/Qwen/third-party models | low | not audited | 0/0/0 | 0/0 | 2026-09-02 00:13 |
| DSH-Balance-Mini DSH 的极简版余额监视器插件：常驻余额徽章、红绿灯配色、多供应商、高峰/空闲时段。 | low | not audited | 0/0/7 | 0/0 | 2026-09-02 00:13 |
| dsh-frecency Resident-index + frecency file search for DSH — shadows the built-in grep/glob tools · DSH 常驻索引 + frecency 文件搜索，同名覆盖内置 grep/glob | low | not audited | 0/0/0 | 0/0 | 2026-09-02 00:13 |
| dsh-plastic-memory Memory plugin with built-in governance for DSH: 为你的 DSH Agent 赋予可塑性记忆 | low | not audited | 0/0/1 | 0/0 | 2026-09-02 00:13 |
| dsh-plugin-elevenlabs-callback DSH plugin: when a run finishes or needs approval, get a link on your phone, hear the result from an ElevenLabs voice agent and say what to do next | high | not audited | 3/2/18 | 0/0 | 2026-09-02 02:13 |
| DSH-Syntax-Checker | low | not audited | 0/0/3 | 0/0 | 2026-09-02 02:13 |
| archive-restore DSH 归档会话管理插件，支持查看归档列表、原位恢复与跨区迁移，Web 侧边栏一键管理 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 02:13 |
| DSH-Balance-Mini DSH 的极简版余额监视器插件：常驻余额徽章、红绿灯配色、多供应商、高峰/空闲时段。 | low | not audited | 0/0/7 | 0/0 | 2026-09-02 02:13 |
| DSH-Shortcut DSH 的 Windows 桌面快捷方式工具：双击智能启动/唤起、浏览器打开前自动最小化、崩溃一键重装救援（不删用户数据）。圆角官方图标，纯 PowerShell 零依赖。 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 02:13 |
| DeepTail A Tauri 2 client — desktop, iOS, and Android — that connects to DSH hosts and gives you one control plane over the agent sessions running on all of them. | low | not audited | 0/0/0 | 0/0 | 2026-09-02 02:13 |
| dsh-self-restart | high | medium | 1/2/2 | 0/0 | 2026-09-02 02:13 |
| dsh-quick-invoke `dsh-quick-invoke` 是一个面向 DSH Web 的独立 Cordis 插件，为 Skill、Agent preset 和 Plugin 提供统一的 `/` 快捷入口、候选选择和 Host 命令执行能力。 本插件不修改 DSH 核心，不提供任意 Tool 直调语法。Tool 仍由 Agent 根据自然语言选择，并继续经过 DSH 的 tools、approval、guard 和 permission 流程。 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-memory-plugin Pluggable persistent memory bundle for DSH | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-death-forensics In-process death black box for DSH hosts: heartbeat windows, crash stacks, end-kind self-check, death_forensics_report tool. | low | not audited | 0/0/2 | 0/0 | 2026-09-02 04:13 |
| dsh-kimi Kimi (Kimi Code account) integration bundle for DSH: provider route, models, device-code login and auto token refresh | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-weather dsh的天气插件（没有高大上的东西，生活不易，出门记得看天气~） | medium | not audited | 0/1/5 | 0/0 | 2026-09-02 04:13 |
| dsh-circuit-breaker Loop guard for DSH: denies repeated identical tool calls and caps per-agent calls, outside the model where instructions cannot reach | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-memory | low | not audited | 0/0/2 | 0/0 | 2026-09-02 04:13 |
| dsh-plugin-oh-my-engine Approval-gated OME engineering delivery Agent Preset for DSH | low | not audited | 0/0/1 | 0/0 | 2026-09-02 04:13 |
| dsh-prompt-history-plugin dsh 输入框的提示词导航插件，支持上下键查看历史输入 | low | not audited | 0/0/1 | 0/0 | 2026-09-02 04:13 |
| dsh-lifeline Right-side message navigation rail for DSH — per-message ticks, hover preview, smooth jump, star bookmarks, realtime slide animation | low | not audited | 0/0/1 | 0/0 | 2026-09-02 04:13 |
| dsh-chinese-poetry A token-free Chinese classical poetry plugin for DSH Web: search, filters, Feihua, daily poem, favorites, and AI explain. Powered by the free public chinese-poetry-api. | low | not audited | 0/0/3 | 0/0 | 2026-09-02 04:13 |
| dsh-composer-dynamic-island Compact DSH Web composer island with a Community v0.15 host manifest and no user-defined button positioning. | low | not audited | 0/0/3 | 0/0 | 2026-09-02 04:13 |
| dsh-nightshift | low | not audited | 0/0/2 | 0/0 | 2026-09-02 04:13 |
| dsh-polish 需要你做的 UI 验收（重启后逐项过一遍） 1. 书本图标右侧出现四角星按钮：细线空心、四角顶点小圆点、浅灰，与相邻按钮同尺寸，深色主题正常 2. 悬浮显示「优化并细化当前用户输入」 3. 权限下拉切 Read Only → 按钮置灰；切回恢复 4. 空输入点击 → Toast「请先输入内容再进行优化细化」 5. 有文本点击 → loading 旋转 → 全文覆盖（非追加）→ 光标在末尾可直接续写 6. 优化质量抽查：保留原意、逻辑通顺、无废话、语气一致、无解释性前后缀 7. 机器回复运行中按钮置灰；+新增/Read Only/书本图标/发送等原功能无回归 | low | not audited | 0/0/1 | 0/0 | 2026-09-02 04:13 |
| dsh-chat-history 给 DSH 聊天输入框加上 CLI 风格历史记忆：上下键召回之前发送过的内容（纯客户端插件，重启不丢） | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-plugin-ollama-monitor Ollama 监控与测评平台 · DSH 插件组合包：agent 工具 + Web 设置页面板（npm: ollama-monitor） | high | high | 4/6/24 | 0/0 | 2026-09-02 04:13 |
| dsh-ui-screenshot DSH 的 Web 插件：在输入框添加截图按钮，截屏并作为草稿图片插入，仅当模型支持视觉时显示。 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-mcp-security dsh-mcp-security | low | not audited | 0/0/0 | 0/0 | 2026-09-02 04:13 |
| dsh-codex-web-auth ChatGPT / Codex browser sign-in for DSH's built-in openai-codex provider — no OpenAI API key required. | low | not audited | 0/0/2 | 0/0 | 2026-09-02 04:13 |
| dsh-mcsm-panel DSH Desktop plugin that lets your AI control MCSManager (MCSM 10.x) Minecraft servers from the chat: server console, file management, instance start/restart/stop/kill, and direct file uploads. | medium | not audited | 0/1/4 | 0/0 | 2026-09-02 06:13 |
| dsh-about 为 DSH Web 设置面板添加“关于”页，展示当前运行的 DSH 版本、插件版本与项目主页。 | low | low | 0/0/1 | 0/0 | 2026-09-02 06:13 |
| dsh-agent-hub | low | not audited | 0/0/0 | 0/0 | 2026-09-02 06:13 |
| dsh-plugin-xt-memory Cross-session self-learning memory for DSH, ported from XT-AGENT packages/memory. BM25 relevance injection + background extraction (sanitize/dedupe/merge) + lifecycle archive + memory_read/memory_search/memory_write tools. | low | not audited | 0/0/7 | 0/0 | 2026-09-02 06:13 |
| dsh-settings-beautify One design language for the DSH settings surface: unified typography, cards, controls, focus and motion across every settings page, including pages contributed by other plugins. | low | not audited | 0/0/2 | 0/0 | 2026-09-02 06:13 |
| dsh-plugin-skill-palette | low | not audited | 0/0/0 | 0/0 | 2026-09-02 06:13 |
| dsh-fs-allowlist | low | not audited | 0/0/4 | 0/0 | 2026-09-02 06:13 |
| dsh-temp-workspace 为DSH增加临时工作区功能！ | high | not audited | 2/1/12 | 0/0 | 2026-09-02 06:13 |
| dsh-pocket Watch and steer your DSH agent from a phone browser: approve tool calls, send a message, stop a turn | medium | not audited | 0/2/2 | 0/0 | 2026-09-02 06:13 |
| dsh-slot-homestead 老虎机庄园｜A pixel-art desktop ecosystem for DSH with time-based fish, crop and animal growth, day/night ambience and collectible slot rewards. | medium | not audited | 0/2/3 | 0/0 | 2026-09-02 06:13 |
| wilsonix-studio AI-powered desktop DAW - stem separation, chord detection, karaoke | low | not audited | 0/0/0 | 0/0 | 2026-09-02 06:13 |
| dsh-token-speed DSH web plugin: draggable ring gauge showing live model output speed (tok/s) with per-step detail panel | low | not audited | 0/0/2 | 0/0 | 2026-09-02 06:13 |
| Hrequest 轻量级 Node.js 多线程 API 压测工具，支持代理轮询、请求参数随机化注入和实时进度监控。 | low | not audited | 0/0/1 | 0/0 | 2026-09-02 06:13 |
| dsh-work 基于dsh构建的个人工作Agent | low | not audited | 0/0/0 | 0/0 | 2026-09-02 06:13 |
| dsh-timer-task | high | not audited | 1/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-guard-sensitive-paths Approval guard for DSH: write/edit/editor/bash calls touching sensitive paths (.env, .git, SSH keys, .pem) become an approval ask. | low | not audited | 0/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-statusbar-config 用 ${变量} 模板完全自定义 DSH 状态栏统计行 · template-driven DSH status bar | low | not audited | 0/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-smart-reminder Smart calendar reminder & schedule assistant for DSH Web GUI: lunar calendar, holidays, system notifications on macOS/Windows, and WeCom/platform push integration. | high | high | 4/0/5 | 0/0 | 2026-09-02 08:13 |
| dsh-usage-export DSH plugin for token usage cost, PDF/Markdown transcript export, and expanded conversation statistics. | low | not audited | 0/0/1 | 0/0 | 2026-09-02 08:13 |
| dsh-vision-assist dsh视觉助手，辅助没有多模态的主模型识别图片内容 | low | not audited | 0/0/5 | 0/0 | 2026-09-02 08:13 |
| dsh-wx-bridge 微信桥接 DSH 插件：扫码绑定官方 ClawBot（iLink 协议），私聊驱动 DSH 会话 — WeChat bridge plugin for DSH | low | not audited | 0/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-concise One-click Concise output style for DSH: results first, no filler — Claude Code's built-in Concise style as a dsh plugin. Toggle right of the model picker, global, persistent, zero-config. | low | medium | 0/0/6 | 0/0 | 2026-09-02 08:13 |
| dsh-skill-store DSH 社区技能商店：浏览、搜索并一键安装来自 SkillHub / ClawHub / GitHub 的 13 万+ Agent Skills，支持星标排序与中文分类 | low | not audited | 0/0/10 | 0/0 | 2026-09-02 08:13 |
| dsh-telemetry | medium | not audited | 0/1/1 | 0/0 | 2026-09-02 08:13 |
| dsh-self-preserve DSH hook plugin: a session may not stop the harness it runs inside | low | not audited | 0/0/2 | 0/0 | 2026-09-02 08:13 |
| dsh-live2d deepseek-harness对live2d的支持 | low | not audited | 0/0/7 | 0/0 | 2026-09-02 08:13 |
| dsh-launcher deepseek-harness 启动器与运行环境管理器（Tauri 2 + Rust + React） | low | not audited | 0/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-serena-guide A DSH plugin that steers agents to Serena's LSP symbolic tools over built-in code tools. | low | not audited | 0/0/0 | 0/0 | 2026-09-02 08:13 |
| dsh-ds-kanban | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| dsh-xingtu-skills DSH plugin: 26 production AI-agent skills (Caveman token compression, Ponytail minimalism, engineering practice) as a standard dsh-plugin bundle. 行途技能 DSH 插件包 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| dsh-browser-verify Browser verification for DSH — open, mock, assert, screenshot in a few tool calls, screenshots auto-project into the model context | high | not audited | 3/1/3 | 0/0 | 2026-09-02 10:13 |
| dsh-gray-test dsh gray-model detection plugin — launch N concurrent sessions, stream reasoning chains, auto-classify gray models (I'm+ing > Let me×5), normal models (Let me≥3), and abnormal models (no features). Supports standard/PTC/minimal/cordis presets. | low | not audited | 0/0/10 | 0/0 | 2026-09-02 10:13 |
| dsh-llm-error-retry 用于在deepseek-harnees中报错时重试大模型请求，支持配置http状态，字段-值命中。 | medium | not audited | 0/1/6 | 0/0 | 2026-09-02 10:13 |
| dsh-plugins | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| taskfold Keeps long coding-agent sessions lean: wrap work in named tasks and, when one is done, fold its whole span into a short titled summary. The conversation stays readable, context costs stay low, and every fold's original content can be read back on demand. For [DSH](https://www.npmjs.com/package/@deepseek-ai/dsh) . | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| dsh-f1-skin An F1 Race Control themed skin for the DSH Web UI — Red Bull, Ferrari, McLaren & Mercedes team themes, broadcast-photo backdrops, and a native settings panel, in dark and light. | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| dsh-farm DSH service farm: register, start, stop, restart and watch long-running project services — agent tools + overview drawer UI, farm.yaml support | high | not audited | 1/0/5 | 0/0 | 2026-09-02 10:13 |
| dsh-dev-git-graph DSH Web Git Graph panel — a faithful port of vscode-git-graph 1.30.0, auto-bound to the session workspace, with full git operations and light/dark theming. First of the dsh-dev-* graph plugin series. | low | not audited | 0/0/0 | 0/0 | 2026-09-02 10:13 |
| dsh-remote-ssh Run your DSH workspace on a remote host over SSH - connection sidebar, remote directory browser, per-session routing, agent ssh_exec/route-status; files and commands execute on your target while sessions, GUI and $DSH_HOME stay local. | low | not audited | 0/0/15 | 0/0 | 2026-09-02 10:13 |
| dsh-auto-driving 让 DSH 智能体进入自动驾驶 🚗：模型故障自动回退、静默卡死自动保活重试、权限/提问/方案审批自动放行，AUTO-MODE.md 全程审计——无人值守、永不停摆的自愈式 AI 编码会话。 | low | not audited | 0/0/2 | 0/0 | 2026-09-02 10:13 |
| dsh-desktop Electron desktop shell for DSH: runs the published dsh CLI as a sidecar | high | not audited | 2/2/1 | 0/0 | 2026-09-02 10:13 |
| dsh-notify-xc | low | not audited | 0/0/2 | 0/0 | 2026-09-02 12:13 |
| dsh-notifier | low | not audited | 0/0/4 | 0/0 | 2026-09-02 12:13 |
| dsh-web-search-anysearch AnySearch search provider plugin for DSH (ctx.web) with round-robin API-key rotation and per-key cooldown failover | low | not audited | 0/0/1 | 0/0 | 2026-09-02 12:13 |
| dsh-token-saver DSH plugin: aggressive token savings, no task-quality loss | medium | not audited | 0/1/8 | 0/0 | 2026-09-02 12:13 |
| dsh-plumb-identity Per-agent plumb session identity for DSH: every conversation, workspace, and subagent gets its own stable plumb session id on a shared plumb MCP connection | low | not audited | 0/0/3 | 0/0 | 2026-09-02 12:13 |
| dsh-ds-ponytail Lazy senior dev mode for DSH: ponytail skill family (ponytail, review, audit, debt, gain, help) adapted from DietrichGebert/ponytail (MIT). Install: dsh plugin --profile web add dsh-ds-ponytail | low | not audited | 0/0/0 | 0/0 | 2026-09-02 12:13 |
| dsh-manutd-fixtures | medium | not audited | 0/2/0 | 0/0 | 2026-09-02 12:13 |
| dsh-desktop | high | not audited | 1/2/8 | 0/0 | 2026-09-02 12:13 |
| dsh-tiddlywiki | high | not audited | 3/2/12 | 0/0 | 2026-09-02 12:13 |
| dsh-readme-writer 一个给 DSH用的 Agent Skill，负责写 / 优化 GitHub 项目 README.md。 | low | not audited | 0/0/0 | 0/0 | 2026-09-02 12:13 |
| dshctl dshctl — DSH web 服务后台管理脚本(启停/日志/构建/一键更新) | low | not audited | 0/0/0 | 0/0 | 2026-09-02 12:13 |
| UnWr | low | not audited | 0/0/1 | 0/0 | 2026-09-02 12:13 |
| dsh-desktop | low | not audited | 0/0/0 | 0/0 | 2026-09-02 12:13 |
Site-wide fused risk
Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total
266
critical
0
high
195
medium
22354
low
Critical-tier plugins (266)
claude-paperdsh-sentineldsh-review-loopdeepseek-harness-fnosdsh-for-vscpi-mm-visiondsh-plugin-verifyds-web-uideepseek-harness-desktop-7dsh-plugin-managerdsh-fffdeepseek-harness-pluginsdsh-desktop-pet-2dsh-science-workbenchdsh-lan-2dsh-workshopdeepseekharnessremotegatewaydsh-lorebookmddsh-plugin-market-5dsh-file-paneldsh-np-pptdeepseek-harness-android-appdsh-web-remotedsh-self-harness-toolsdsh-change-reviewdsh-hotswapmakocodedsh-skill-mcp-paneldsh-tavern-2dsh-mc-agentdsh-webdsh-doctor-4dsh-design-studiodsh-tailscale-consoledhs-theme-plugindeepseek-harness-moltdsh-command-check-updatedsh-auth-gatedsh-silly-pluginopendshdsh-tool-code-reviewdsh-task-consoledsh-agent-eval-2deepseek-harness-plugins-3dsher-bbs-plugindeepseek-harness-plugs-managedsh-dev-serverdsh-about-updaterdsh-toolbox-webdsh-remote-publicdsh-notifier-2dsh-plugin-containerdsh-desktop-huacaideepseek-herness-desktoppaperlabchromex-browserdsh-github-tooldsh-lan-access-3dsh-custom-uidsh-pet-6desk-harnessdsh-plugin-larkdsh-webgatedsh-tavern-3dsh-anchored-monitordsh-neutrinoliving-dream-dshdsh-comfyuidsh-desktop-68dsh-wechatclawbotorbit-dsh-plugindsh-perm-guarddsh-cc-pluginsdsh-tool-generate-imagedsh-routed-subagentdsh-swarmdsh-nuphus-mcpdsh-lark-alldsh-ide-panelschat-deepseek-visiondeepseek-harness-liquid-glass-themedshscandsh-pwsh-directdsh-capcheckdsh-minecraft-themedsh-plugin-market-20dsh-diffgeomdsh-remote-7dsh-logcatdsh-ide-bridgedsh-mail-connectordsh-fleetdsh-desktop-tools-2dsh-usage-6dsh-mobilesharedsh-plugin-market-22dsh-profile-porttavern-launcherdsh-file-linkspdfreaderdsh-publish-plugindsh-workshop-3dsh-qq-remotedsh-settings-prodsh-github-pushdsh-web-remote-frpdsh-pentesterdsh-tool-lensdsh-testsuitecodereaderdsh-webroadweave-for-dshdsh-tool-git-3dsh-memory-eternaldsh-capability-managerdsh-arbitrary-hostdsh-plugins-76dsh-storedsh-lanchatdsh-k8sdsh-worktabledsh-tts-playerdsh-agent-browser-2dsh-image-readdsh-stats-expanddsh-usage-stats-11dsh-input-enhancementdsh-safe-launchdsh-balance-plugin-6atri-for-dshconvoportdsh-experience-librarydeepseek-harness-desktop-54dsh-relay-2dscoderdsh-inline-images-2dsh-community-plugins-2dsh-process-boarddsh-rtk-toolsdsh-plugin-offline-packagerdsh-asset-managerdsh-vsceditordsh-suhuang-scrolldsh-free-models-hubdsh-freeroutedsh-bg-plugindsh-sandbox-permissions-not-strictly-wider-justification-empty-fixdsh-applauncherdsh-public-accessdshessentialtoolsdsh-qrcode-hassle-freedsh-call-shrinkdsh-automation-3dsh-skill-hub-3dsh-desktop-102dsh-kit-4dsh-plugin-ollama-monitordsh-smart-reminderdsh-plugins-94dsh-4-role-workflowdsh-raw-html-v2dsh-gbdsh-git-review-2dsh-plugin-canvas-prodsh-search-prodsh-git-9dsh-tmwebdriverdsh-fleet-2dsh-cc-backupdsh-token-pulsephone-tunnel-poolsee-the-screendeepseek-harness-minimal-omnidsh-plugin-forge-5dsh-session-progressdsh-move-ragdsh-cad-viewerdsh-agentic-proxydsh-wechat-bridge-5dsh-windows-remote-sshdsh-remote-file-systemdsh-better-display-2dsh-better-uiuxdsh-default-promptdsh-agent-clusterdsh-sidebar-plusvscode-dsh-sidebardsh-agnes-studiodsh-youdaonotedsh-plugin-repo-snapshotdsh-netease-music-2dsh-lobsterai-daddydsh-cua-previewdsh-buddy-spikedsh-novel-appdsh-desktop-settingsdsh-zcode-connectoranoslide-pluginsdsh-destinywind-tpmdsh-wakervoice-inputdsh-draw-plugindsh-ipynb-previewdsh-ask-formdsh-remote-access-cidrdsh-genbox-plugindsh-wsl-projectsdsh-mcp-unified-paneldsh-archive-keeper-plugindsh-nutstore-backupdsh-kp-notesdsh-flow-3dsh-aocidsh-service-boardcad-ppt-skillsdsh-wbdsh-web-appdsh-text-explaindsh-ledger-memorydsh-artcraftdsh-remote-13zadloop-ultimate-toolkitdsh-ai-balldsh-mcp-manager-19dsh-deploy-webdsh-plugin-cdpdsh-upgrade-2dsh-envkitdsh-desktop-app-4dsh-pwa-launcherdsh-steal-codedsh-tools-5dsh-helper-plugin-workspace-browserdsh-console-plugindsh-olivia-bridgedsh-obsidian-sync-2dsh-git-serverdsh-android-scrcpyzcode-dispatchdsh-armor-switchdsh-tool-suitepi-control-chromedsh-skill-market-4dsh-chatsyncdsh-liquid-glass-theme-2dsh-remote-guidsh-plugins-151dsh-plugin-30dsh-skill-creator-5dsh-xl-free-modeldsh-browser-agent-4dsh-plugin-market-30dsh-maplestory-wzdsh-tool-mathfigdsh-phone-bridge-3dsh-latex-studiodsh-6dsh-brand-textmindie-agent-dshdsh-bili-scroll-2wa-agentdsh-opencode-free-3dsh-phone-remote-2dsh-android-phonedsh-dispatch-2dsh-pocket-oauth
Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
66 reports2026-10-21220 added0 crit69 medium2026-10-200 added0 crit0 medium2026-10-190 added0 crit0 medium2026-10-18609 added1 crit221 medium2026-10-17306 added0 crit0 medium2026-10-160 added0 crit0 medium2026-10-15110 added1 crit47 medium2026-10-1499 added1 crit33 medium2026-10-13102 added1 crit36 medium2026-10-120 added0 crit0 medium2026-10-110 added0 crit0 medium2026-10-10104 added0 crit40 medium2026-10-098 added0 crit1 medium2026-10-08100 added0 crit39 medium2026-10-070 added0 crit0 medium2026-10-060 added0 crit0 medium2026-10-050 added0 crit0 medium2026-10-0472 added0 crit30 medium2026-10-0388 added0 crit36 medium2026-10-0299 added1 crit47 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit51 medium2026-09-2969 added0 crit22 medium2026-09-2864 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-02current85 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-02. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.
Source: dsh.so security standards · Maintained by dsh.so · Published