Daily security scan
Date · 2026-09-03 (UTC — plugins first indexed that day)
Static scan · new today
rule heuristics · shape only0
critical
15
high
15
medium
47
low
Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.
Dynamic audit · subset of new today
model reads source · no execution0
critical
2
high
4
medium
1
low
Only entries static-flagged ≥ warn are audited; tier = highest finding. Of 77 new entries, 70 are out of the queue or have no conclusion yet.
| Plugin | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| relay-dsh-plugin-monitor-author DSH Skill for discovering and safely authoring Relay Monitor Bundles. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-session-slm-router Shadow-mode SLM router for DSH: per-turn weak/strong prediction via vertical-small-model CLI, writes shadow JSONL log | high | not audited | 2/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-v-token-insight a plugin of token insight for DSH. | low | not audited | 0/0/3 | 0/0 | 2026-09-03 00:13 |
| relay-dsh-plugin-monitor-process Identity-safe process monitoring capability for Relay on DSH. | high | not audited | 1/0/0 | 0/0 | 2026-09-03 00:13 |
| relay-dsh-plugin-monitor-time Time deadline Monitor Bundle extension for Relay on DSH. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-github-ci | low | not audited | 0/0/10 | 0/0 | 2026-09-03 00:13 |
| dsh-imgdraw DSH 文生图插件：draw_image 模型工具 + 输入框生图按钮（异步生成/4 格网格/下载保留删除）+ /imgdraw 路由 + 持久化历史。Text-to-image for DSH. | medium | not audited | 0/1/6 | 0/0 | 2026-09-03 02:13 |
| dsh-stardew-theme | low | not audited | 0/0/0 | 0/0 | 2026-09-03 02:13 |
| dsh-mcp-oauth-client Universal MCP manager and client bridge for DSH | high | not audited | 1/2/4 | 0/0 | 2026-09-03 02:13 |
| dsh-subagent-cursor DSH 插件：Cursor-as-subagent 提供方——一次本地 @cursor/sdk one-shot 运行、摘要优先结果、可无人值守的 Profile Bundle | low | not audited | 0/0/0 | 0/0 | 2026-09-03 02:13 |
| kimi-ppt-skill DSH presentation skill: PPT/演示文稿生成与导出，含 DSH 内纯本地导出 (python-pptx) 与本地预览渲染 (Pillow)。 | medium | not audited | 0/1/3 | 0/0 | 2026-09-03 02:13 |
| dsh-knowledge-sqlite DSH 跨会话知识插件：ctx.knowledge 服务 + knowledge_* 工具，SQLite FTS5 trigram 中文子串检索 + L1 查询扩展（V1.11 契约） | low | not audited | 0/0/1 | 0/0 | 2026-09-03 02:13 |
| stickies 面向 DSH 的本地优先 Markdown 便利贴插件 | medium | not audited | 0/3/1 | 0/0 | 2026-09-03 02:13 |
| dsh-subagent-pi-plus Pi true-gateway plugin for DSH: /pi-lock direct connection to a durable Pi session — queued/steered conversation, live output, durable binding + auto-reattach. Personal fork of @deepseek-ai/dsh-subagent-codex. | low | not audited | 0/0/2 | 0/0 | 2026-09-03 04:13 |
| dsh-stickies 面向 DSH 的本地优先 Markdown 便利贴插件 | medium | not audited | 0/3/1 | 0/0 | 2026-09-03 04:13 |
| dsh-plugin-width-slider 对话宽度滑块插件：DSH Desktop 设置面板滑块，按下即全屏预览实时调节对话宽度，自动隐藏原生拖拽手柄 | low | not audited | 0/0/2 | 0/0 | 2026-09-03 04:13 |
| dsh-superpowers DSH port of obra/superpowers: 14 agentic skills (brainstorming/planning/SDD/TDD/debugging/review/worktrees) + session-start bootstrap injection. | high | medium | 1/6/12 | 0/0 | 2026-09-03 04:13 |
| dsh-godot-game-studio Seven bounded Godot 4 MCP tools for DSH: audit, test, simulate, validate, and release | high | not audited | 1/0/5 | 0/0 | 2026-09-03 04:13 |
| dsh-browser-slotpool DSH bundle: slot-pool wrapper for concurrent browser sessions｜并发浏览器会话槽位池插件 | high | medium | 1/2/5 | 0/0 | 2026-09-03 04:13 |
| dsh-token-stats DSH token usage statistics plugin: aggregates all local session logs into cumulative/peak/streak stats, daily & weekly trends, hour-of-day distribution, GitHub-style year heatmap, per-model breakdown — Settings page + sidebar today card. | low | not audited | 0/0/7 | 0/0 | 2026-09-03 04:13 |
| dsh-stock-quote DSH web plugin: collapsible draggable A-share quote widget (沪深300 + individual stocks, live price + change %) | low | not audited | 0/0/3 | 0/0 | 2026-09-03 04:13 |
| dsh-4-role-workflow 4-agent workflow (PM + Browser + Programmer + DataEng) for complex DSH tasks. Real run in docs/run-example.md. | high | high | 10/2/0 | 0/0 | 2026-09-03 04:13 |
| dsh-xhs-collector XHS batch collector via CDP Chrome + residential IP. Real case study: 8 keywords, 500+ notes. docs/case-study.md | low | not audited | 0/0/0 | 0/0 | 2026-09-03 04:13 |
| dsh-security-guard DSH runtime security guard plugin - loader import confinement, HTTP Host header validation (QVD-2026-52631/57410). AI-assisted. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-plugin-updater Package-level plugin manager with update detection and a GitHub marketplace for DSH | low | not audited | 0/0/4 | 0/0 | 2026-09-03 06:13 |
| dsh-realtimeavatar Realtime Avatar (realtimeavatar.ai) for the DSH: harness-held API key, public docs as skills, rta_* tools, /rta onboarding, zero runtime dependencies | low | not audited | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-agy-ui DSH Antigravity UI & Experience Enhancement Companion Plugin | low | not audited | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-gemini-oauth-bridge Bridge Google AI subscription (Antigravity/Gemini OAuth) into DSH as an OpenAI-compatible endpoint | medium | not audited | 0/1/8 | 0/0 | 2026-09-03 06:13 |
| dsh-webhook-notifier DSH 事件通知插件：AI 回合完成、权限申请、提问、出错等 7 种场景发生时，向 Webhook 发送自定义 HTTP 通知，支持 GET/POST、预设字段/自定义文本、type+type_cn、发送日志 | low | not audited | 0/0/4 | 0/0 | 2026-09-03 06:13 |
| dsh-plugin-feihualing DSH 飞花令游戏插件：简易 / 古法严格双模式，按会话独立维护令字、得分、已用诗句与剩余提示次数 | low | not audited | 0/0/3 | 0/0 | 2026-09-03 06:13 |
| dsh-deliverables-accordion | low | not audited | 0/0/2 | 0/0 | 2026-09-03 06:13 |
| dsh-pet 一只常驻 DSH 界面的鲸鱼娘女仆长「会话监督挂件」。替主人监督 AI 助手的工作——读工具调用结果做证据，戳破"口嗨式完成"，用自然女仆口吻温柔纠偏，并一键给出可直接复制的修正 Prompt。标准 DSH bundle，代码+立绘自包含、开箱即用。 | low | not audited | 0/0/5 | 0/0 | 2026-09-03 06:13 |
| dsh-xiaoheihe | medium | not audited | 0/1/9 | 0/0 | 2026-09-03 08:13 |
| dsh-side-session DSH side-chat (旁会话) plugin: launch a fresh continuable parallel session from the conversation header while the main session keeps running. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-credentials-mysql DSH 基于 MySQL 的后端凭证库插件 (ctx.credentials) | low | not audited | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-bgjobs 将命令提交为独立于 DSH 进程的后台任务，关闭 DSH 也不影响运行，并提供实时网页面板与离线 CLI/GUI 管理。Runs commands as background jobs that keep executing when DSH exits, with a live web panel and offline CLI/GUI management. | low | not audited | 0/0/6 | 0/0 | 2026-09-03 08:13 |
| dsh-plan-bridge DSH plugin: one local bridge for ChatGPT Codex / Claude / ZCode (GLM) / Qwen subscription plans — settings status card, one-click provisioning, zero core changes | medium | not audited | 0/1/5 | 0/0 | 2026-09-03 08:13 |
| dsh-wsl-launcher Windows desktop launcher for DSH Web running in WSL | high | medium | 1/3/11 | 0/0 | 2026-09-03 08:13 |
| dsh-context-maid DSH 自动上下文策展插件：tool 输出内容感知瘦身 + 无效日志清理 + 工作流/记忆钉扎保护 + 先归档后压缩 + 摘要模型可配 | low | not audited | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-sensenova-provider | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| rein-scene-forge-dsh-plugin DSH plugin for Rein Scene Forge robot scene authoring | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-panda-calendar 熊猫日历 · DSH client-plugin：公历/农历/干支/生肖/节气、传统与外国节日、中国法定节假日（含调休）、多城市天气 — token-free Chinese calendar & weather plugin for DSH Web. | high | not audited | 1/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-storage-mysql DSH 基于 MySQL 的后端存储插件 可通过 storage-domain 配置用于 workspace、session-projection-cache 和 message-feedback 数据的存储 | low | not audited | 0/0/2 | 0/0 | 2026-09-03 08:13 |
| dsh-web-verify-panel 让 agent 的网页打开请求在 DSH 侧边栏内完成，不用弹出系统浏览器窗口 | medium | not audited | 0/3/7 | 0/0 | 2026-09-03 08:13 |
| dsh-research DSH bundle for evidence-first PDF reading, durable paper records, and cross-paper synthesis. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-browser-use 为 DSH 插件生态打造的浏览器自动化插件 | low | not audited | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-plugin-toolkit DSH personal toolkit: runtime-toggleable quality-of-life optimizations, each shipped as one card in the Toolkit settings page. | medium | not audited | 0/1/6 | 0/0 | 2026-09-03 08:13 |
| dsh-plugin-vision Give your DSH agent eyes via any OpenAI-compatible vision model - 11 provider presets (Doubao/Qwen-VL/GLM-V/OpenAI/Gemini/Ollama...), capability checkboxes that inject live prompt guidance, and analysis of images the user drops into the chat; the agent writes its own observation prompt, and base64 never enters its context. | medium | not audited | 0/2/9 | 0/0 | 2026-09-03 08:13 |
| fylar-office-editor Office document preview, editing, and DOCX generation for DSH, powered by Fylar Office SDK. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-vision-patch Patch custom provider vision model | low | not audited | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| task-progress-bar | low | not audited | 0/0/5 | 0/0 | 2026-09-03 10:14 |
| dsh-session-folders | low | not audited | 0/0/0 | 0/0 | 2026-09-03 10:14 |
| dsh-godot-play 在 DSH Web GUI 一键构建并试玩 Godot Web 导出。Build & play Godot Web exports in the DSH GUI with one click. | medium | not audited | 0/1/4 | 0/0 | 2026-09-03 10:14 |
| dsh-single-terminal 基于dsh的终端插件 | low | not audited | 0/0/4 | 0/0 | 2026-09-03 10:14 |
| dsh-raw-html-v2 VCP visual-synesthesia plugin v2 for DSH (official Slot API): raw-HTML vcp-root cards, streaming render, KaTeX/Mermaid/SVG, builtin fonts | high | high | 2/3/4 | 0/0 | 2026-09-03 10:14 |
| dsh-clawbot dsh-clawbot | low | not audited | 0/0/2 | 0/0 | 2026-09-03 10:14 |
| dsh-git DSH Web GUI 的完整 Git 管理插件：分支切换/fetch/pull/commit/push，可折叠悬浮面板 + 输入框胶囊 | high | not audited | 2/0/1 | 0/0 | 2026-09-03 10:14 |
| dsh-launcher DSH 轻量 Windows 启动器。选一个版本，启动 dsh web。 | high | not audited | 6/7/20 | 0/0 | 2026-09-03 10:14 |
| dsh-script-manager DSH 自定义操作脚本管理插件，将验证过的操作流程固化为可复用脚本，不耗 token、支持参数化和执行验收。 | low | not audited | 0/0/3 | 0/0 | 2026-09-03 10:14 |
| dsh-ticktick TickTick (Dida365) task bridge for DSH: Session-header task panel (list filter, undone/completed views, search, drag reorder), 11 curated agent tools, settings card, over the official TickTick MCP endpoint. | medium | not audited | 0/2/5 | 0/0 | 2026-09-03 12:13 |
| tencent-agent-mail-dsh-plugin Tencent Agent Mail (agent.qq.com) workbench plugin for DSH: polling, LLM classification, fullscreen workbench, archive/trash, attachment download, mail-to-agent command channel. 腾讯Agent邮箱DSH插件 | high | medium | 4/2/4 | 0/0 | 2026-09-03 12:13 |
| dsh-archive-manager | low | not audited | 0/0/3 | 0/0 | 2026-09-03 12:13 |
| dsh-plugin-voice-input-demo Minimal Chinese voice input plugin for the DSH Web UI | low | not audited | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-auto-review Codex-style Auto Review inspired plugin for DSH, with native bridge and Linux sandbox integration | low | not audited | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-reasoning-bridge Reasoning Bridge for dsh: hand high-cost reasoning to web AI (ChatGPT first, multi-target); keep local evidence, adoption gate, edits, and tests. Contract-based handoffs, versioned consent, SHA-256 receipts. Zero dependencies. | low | not audited | 0/0/2 | 0/0 | 2026-09-03 12:13 |
| dsh-wooden-fish dsh 木鱼，dsh 干活你敲木鱼，每天增加一点点功德 | low | not audited | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-log-viewer DSH 日志分析插件：Java 服务日志分析，AI 工具与 Web 仪表盘 | medium | not audited | 0/1/1 | 0/0 | 2026-09-03 12:13 |
| dsh-fullwidth-punctuation DSH 插件：让 AI 回答输出中文全角标点（用户直接复制回答内容也是全角）。监听 llm/stream 做智能半角→全角转换，跳过代码块/数字/URL/markdown，并注入 system prompt 提示。 | low | not audited | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-clearview A calmer reading view for DSH: native process details, live reasoning, and clean final answers. | low | not audited | 0/0/1 | 0/0 | 2026-09-03 12:13 |
| DSH-guardian for DSH | high | low | 2/1/4 | 0/0 | 2026-09-03 12:13 |
| dsh-plugin-auto-review Provider-backed automatic approval review for DSH | low | not audited | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-reach Multi-channel decision & remote-control bridge for DSH: pushes any workspace's approval/question cards to IM channels (WeChat iLink first) and answers them from chat, with a session console, per-channel security, and an open push service. | low | not audited | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-stall-sentinel Lightweight stall watchdog for DSH - auto-wires subprocess spawn, reminds + forensics on stall, never kills. | high | not audited | 2/0/1 | 0/0 | 2026-09-03 14:13 |
| opencode2dsh DSH plugin — free OpenCode Zen models for DSH. Free LLM API, no API key needed. 在 DSH 中使用 OpenCode Zen 免费模型，无需 API key | medium | not audited | 0/2/6 | 0/0 | 2026-09-03 14:13 |
| dsh-plugin-better-plan better-plan: DSH 计划/待办侧边栏插件 | DSH plan/todo sidebar plugin | low | not audited | 0/0/1 | 0/0 | 2026-09-03 14:13 |
| dsh-grok-adaptation | low | not audited | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-opencode-free-models 无限免费额度的deepseek harnes 免费模型插件-免费api-DSH 插件 — 在聊天界面里实时展示 OpenCode Zen 的最新免费模型，无需登录、无需密钥，直接在模型选择器选用即可对话。切换网络实现无限额度，无限量token自由！ | medium | not audited | 0/1/16 | 0/0 | 2026-09-03 14:13 |
Site-wide fused risk
Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total
266
critical
0
high
195
medium
22354
low
Critical-tier plugins (266)
claude-paperdsh-sentineldsh-review-loopdeepseek-harness-fnosdsh-for-vscpi-mm-visiondsh-plugin-verifyds-web-uideepseek-harness-desktop-7dsh-plugin-managerdsh-fffdeepseek-harness-pluginsdsh-desktop-pet-2dsh-science-workbenchdsh-lan-2dsh-workshopdeepseekharnessremotegatewaydsh-lorebookmddsh-plugin-market-5dsh-file-paneldsh-np-pptdeepseek-harness-android-appdsh-web-remotedsh-self-harness-toolsdsh-change-reviewdsh-hotswapmakocodedsh-skill-mcp-paneldsh-tavern-2dsh-mc-agentdsh-webdsh-doctor-4dsh-design-studiodsh-tailscale-consoledhs-theme-plugindeepseek-harness-moltdsh-command-check-updatedsh-auth-gatedsh-silly-pluginopendshdsh-tool-code-reviewdsh-task-consoledsh-agent-eval-2deepseek-harness-plugins-3dsher-bbs-plugindeepseek-harness-plugs-managedsh-dev-serverdsh-about-updaterdsh-toolbox-webdsh-remote-publicdsh-notifier-2dsh-plugin-containerdsh-desktop-huacaideepseek-herness-desktoppaperlabchromex-browserdsh-github-tooldsh-lan-access-3dsh-custom-uidsh-pet-6desk-harnessdsh-plugin-larkdsh-webgatedsh-tavern-3dsh-anchored-monitordsh-neutrinoliving-dream-dshdsh-comfyuidsh-desktop-68dsh-wechatclawbotorbit-dsh-plugindsh-perm-guarddsh-cc-pluginsdsh-tool-generate-imagedsh-routed-subagentdsh-swarmdsh-nuphus-mcpdsh-lark-alldsh-ide-panelschat-deepseek-visiondeepseek-harness-liquid-glass-themedshscandsh-pwsh-directdsh-capcheckdsh-minecraft-themedsh-plugin-market-20dsh-diffgeomdsh-remote-7dsh-logcatdsh-ide-bridgedsh-mail-connectordsh-fleetdsh-desktop-tools-2dsh-usage-6dsh-mobilesharedsh-plugin-market-22dsh-profile-porttavern-launcherdsh-file-linkspdfreaderdsh-publish-plugindsh-workshop-3dsh-qq-remotedsh-settings-prodsh-github-pushdsh-web-remote-frpdsh-pentesterdsh-tool-lensdsh-testsuitecodereaderdsh-webroadweave-for-dshdsh-tool-git-3dsh-memory-eternaldsh-capability-managerdsh-arbitrary-hostdsh-plugins-76dsh-storedsh-lanchatdsh-k8sdsh-worktabledsh-tts-playerdsh-agent-browser-2dsh-image-readdsh-stats-expanddsh-usage-stats-11dsh-input-enhancementdsh-safe-launchdsh-balance-plugin-6atri-for-dshconvoportdsh-experience-librarydeepseek-harness-desktop-54dsh-relay-2dscoderdsh-inline-images-2dsh-community-plugins-2dsh-process-boarddsh-rtk-toolsdsh-plugin-offline-packagerdsh-asset-managerdsh-vsceditordsh-suhuang-scrolldsh-free-models-hubdsh-freeroutedsh-bg-plugindsh-sandbox-permissions-not-strictly-wider-justification-empty-fixdsh-applauncherdsh-public-accessdshessentialtoolsdsh-qrcode-hassle-freedsh-call-shrinkdsh-automation-3dsh-skill-hub-3dsh-desktop-102dsh-kit-4dsh-plugin-ollama-monitordsh-smart-reminderdsh-plugins-94dsh-4-role-workflowdsh-raw-html-v2dsh-gbdsh-git-review-2dsh-plugin-canvas-prodsh-search-prodsh-git-9dsh-tmwebdriverdsh-fleet-2dsh-cc-backupdsh-token-pulsephone-tunnel-poolsee-the-screendeepseek-harness-minimal-omnidsh-plugin-forge-5dsh-session-progressdsh-move-ragdsh-cad-viewerdsh-agentic-proxydsh-wechat-bridge-5dsh-windows-remote-sshdsh-remote-file-systemdsh-better-display-2dsh-better-uiuxdsh-default-promptdsh-agent-clusterdsh-sidebar-plusvscode-dsh-sidebardsh-agnes-studiodsh-youdaonotedsh-plugin-repo-snapshotdsh-netease-music-2dsh-lobsterai-daddydsh-cua-previewdsh-buddy-spikedsh-novel-appdsh-desktop-settingsdsh-zcode-connectoranoslide-pluginsdsh-destinywind-tpmdsh-wakervoice-inputdsh-draw-plugindsh-ipynb-previewdsh-ask-formdsh-remote-access-cidrdsh-genbox-plugindsh-wsl-projectsdsh-mcp-unified-paneldsh-archive-keeper-plugindsh-nutstore-backupdsh-kp-notesdsh-flow-3dsh-aocidsh-service-boardcad-ppt-skillsdsh-wbdsh-web-appdsh-text-explaindsh-ledger-memorydsh-artcraftdsh-remote-13zadloop-ultimate-toolkitdsh-ai-balldsh-mcp-manager-19dsh-deploy-webdsh-plugin-cdpdsh-upgrade-2dsh-envkitdsh-desktop-app-4dsh-pwa-launcherdsh-steal-codedsh-tools-5dsh-helper-plugin-workspace-browserdsh-console-plugindsh-olivia-bridgedsh-obsidian-sync-2dsh-git-serverdsh-android-scrcpyzcode-dispatchdsh-armor-switchdsh-tool-suitepi-control-chromedsh-skill-market-4dsh-chatsyncdsh-liquid-glass-theme-2dsh-remote-guidsh-plugins-151dsh-plugin-30dsh-skill-creator-5dsh-xl-free-modeldsh-browser-agent-4dsh-plugin-market-30dsh-maplestory-wzdsh-tool-mathfigdsh-phone-bridge-3dsh-latex-studiodsh-6dsh-brand-textmindie-agent-dshdsh-bili-scroll-2wa-agentdsh-opencode-free-3dsh-phone-remote-2dsh-android-phonedsh-dispatch-2dsh-pocket-oauth
Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
66 reports2026-10-21220 added0 crit69 medium2026-10-200 added0 crit0 medium2026-10-190 added0 crit0 medium2026-10-18609 added1 crit221 medium2026-10-17306 added0 crit0 medium2026-10-160 added0 crit0 medium2026-10-15110 added1 crit47 medium2026-10-1499 added1 crit33 medium2026-10-13102 added1 crit36 medium2026-10-120 added0 crit0 medium2026-10-110 added0 crit0 medium2026-10-10104 added0 crit40 medium2026-10-098 added0 crit1 medium2026-10-08100 added0 crit39 medium2026-10-070 added0 crit0 medium2026-10-060 added0 crit0 medium2026-10-050 added0 crit0 medium2026-10-0472 added0 crit30 medium2026-10-0388 added0 crit36 medium2026-10-0299 added1 crit47 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit51 medium2026-09-2969 added0 crit22 medium2026-09-2864 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-03current77 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-03. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.
Source: dsh.so security standards · Maintained by dsh.so · Published