Daily security scan
Date · 2026-09-03 (UTC — plugins first indexed that day)
77
added
0
critical
30
medium
47
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| relay-dsh-plugin-monitor-author DSH Skill for discovering and safely authoring Relay Monitor Bundles. | low | pass | 0/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-session-slm-router Shadow-mode SLM router for DSH: per-turn weak/strong prediction via vertical-small-model CLI, writes shadow JSONL log | medium | warn | 2/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-v-token-insight a plugin of token insight for DSH. | low | pass | 0/0/3 | 0/0 | 2026-09-03 00:13 |
| relay-dsh-plugin-monitor-process Identity-safe process monitoring capability for Relay on DSH. | medium | warn | 1/0/0 | 0/0 | 2026-09-03 00:13 |
| relay-dsh-plugin-monitor-time Time deadline Monitor Bundle extension for Relay on DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-03 00:13 |
| dsh-github-ci | low | pass | 0/0/10 | 0/0 | 2026-09-03 00:13 |
| dsh-imgdraw DSH 文生图插件：draw_image 模型工具 + 输入框生图按钮（异步生成/4 格网格/下载保留删除）+ /imgdraw 路由 + 持久化历史。Text-to-image for DSH. | medium | warn | 0/1/6 | 0/0 | 2026-09-03 02:13 |
| dsh-stardew-theme | low | pass | 0/0/0 | 0/0 | 2026-09-03 02:13 |
| dsh-mcp-oauth-client Universal MCP manager and client bridge for DSH | medium | warn | 1/2/4 | 0/0 | 2026-09-03 02:13 |
| dsh-subagent-cursor DSH 插件：Cursor-as-subagent 提供方——一次本地 @cursor/sdk one-shot 运行、摘要优先结果、可无人值守的 Profile Bundle | low | pass | 0/0/0 | 0/0 | 2026-09-03 02:13 |
| kimi-ppt-skill DSH presentation skill: PPT/演示文稿生成与导出，含 DSH 内纯本地导出 (python-pptx) 与本地预览渲染 (Pillow)。 | medium | warn | 0/1/3 | 0/0 | 2026-09-03 02:13 |
| dsh-knowledge-sqlite DSH 跨会话知识插件：ctx.knowledge 服务 + knowledge_* 工具，SQLite FTS5 trigram 中文子串检索 + L1 查询扩展（V1.11 契约） | low | pass | 0/0/1 | 0/0 | 2026-09-03 02:13 |
| stickies 面向 DSH 的本地优先 Markdown 便利贴插件 | medium | warn | 0/3/1 | 0/0 | 2026-09-03 02:13 |
| dsh-subagent-pi-plus Pi true-gateway plugin for DSH: /pi-lock direct connection to a durable Pi session — queued/steered conversation, live output, durable binding + auto-reattach. Personal fork of @deepseek-ai/dsh-subagent-codex. | low | pass | 0/0/2 | 0/0 | 2026-09-03 04:13 |
| dsh-stickies 面向 DSH 的本地优先 Markdown 便利贴插件 | medium | warn | 0/3/1 | 0/0 | 2026-09-03 04:13 |
| dsh-plugin-width-slider 对话宽度滑块插件：DSH Desktop 设置面板滑块，按下即全屏预览实时调节对话宽度，自动隐藏原生拖拽手柄 | low | pass | 0/0/2 | 0/0 | 2026-09-03 04:13 |
| dsh-superpowers DSH port of obra/superpowers: 14 agentic skills (brainstorming/planning/SDD/TDD/debugging/review/worktrees) + session-start bootstrap injection. | medium | warn | 1/6/12 | 0/0 | 2026-09-03 04:13 |
| dsh-godot-game-studio Seven bounded Godot 4 MCP tools for DSH: audit, test, simulate, validate, and release | medium | warn | 1/0/5 | 0/0 | 2026-09-03 04:13 |
| dsh-browser-slotpool DSH bundle: slot-pool wrapper for concurrent browser sessions｜并发浏览器会话槽位池插件 | medium | warn | 1/2/5 | 0/0 | 2026-09-03 04:13 |
| dsh-token-stats DSH token usage statistics plugin: aggregates all local session logs into cumulative/peak/streak stats, daily & weekly trends, hour-of-day distribution, GitHub-style year heatmap, per-model breakdown — Settings page + sidebar today card. | low | pass | 0/0/7 | 0/0 | 2026-09-03 04:13 |
| dsh-stock-quote DSH web plugin: collapsible draggable A-share quote widget (沪深300 + individual stocks, live price + change %) | low | pass | 0/0/3 | 0/0 | 2026-09-03 04:13 |
| dsh-4-role-workflow 4-agent workflow (PM + Browser + Programmer + DataEng) for complex DSH tasks. Real run in docs/run-example.md. | medium | warn | 10/2/0 | 0/0 | 2026-09-03 04:13 |
| dsh-xhs-collector XHS batch collector via CDP Chrome + residential IP. Real case study: 8 keywords, 500+ notes. docs/case-study.md | low | pass | 0/0/0 | 0/0 | 2026-09-03 04:13 |
| dsh-security-guard DSH runtime security guard plugin - loader import confinement, HTTP Host header validation (QVD-2026-52631/57410). AI-assisted. | low | pass | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-plugin-updater Package-level plugin manager with update detection and a GitHub marketplace for DSH | low | pass | 0/0/4 | 0/0 | 2026-09-03 06:13 |
| dsh-realtimeavatar Realtime Avatar (realtimeavatar.ai) for the DSH: harness-held API key, public docs as skills, rta_* tools, /rta onboarding, zero runtime dependencies | low | pass | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-agy-ui DSH Antigravity UI & Experience Enhancement Companion Plugin | low | pass | 0/0/0 | 0/0 | 2026-09-03 06:13 |
| dsh-gemini-oauth-bridge Bridge Google AI subscription (Antigravity/Gemini OAuth) into DSH as an OpenAI-compatible endpoint | medium | warn | 0/1/8 | 0/0 | 2026-09-03 06:13 |
| dsh-webhook-notifier DSH 事件通知插件：AI 回合完成、权限申请、提问、出错等 7 种场景发生时，向 Webhook 发送自定义 HTTP 通知，支持 GET/POST、预设字段/自定义文本、type+type_cn、发送日志 | low | pass | 0/0/4 | 0/0 | 2026-09-03 06:13 |
| dsh-plugin-feihualing DSH 飞花令游戏插件：简易 / 古法严格双模式，按会话独立维护令字、得分、已用诗句与剩余提示次数 | low | pass | 0/0/3 | 0/0 | 2026-09-03 06:13 |
| dsh-deliverables-accordion | low | pass | 0/0/2 | 0/0 | 2026-09-03 06:13 |
| dsh-pet 一只常驻 DSH 界面的鲸鱼娘女仆长「会话监督挂件」。替主人监督 AI 助手的工作——读工具调用结果做证据，戳破"口嗨式完成"，用自然女仆口吻温柔纠偏，并一键给出可直接复制的修正 Prompt。标准 DSH bundle，代码+立绘自包含、开箱即用。 | low | pass | 0/0/5 | 0/0 | 2026-09-03 06:13 |
| dsh-xiaoheihe | medium | warn | 0/1/9 | 0/0 | 2026-09-03 08:13 |
| dsh-side-session DSH side-chat (旁会话) plugin: launch a fresh continuable parallel session from the conversation header while the main session keeps running. | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-credentials-mysql DSH 基于 MySQL 的后端凭证库插件 (ctx.credentials) | low | pass | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-bgjobs 将命令提交为独立于 DSH 进程的后台任务，关闭 DSH 也不影响运行，并提供实时网页面板与离线 CLI/GUI 管理。Runs commands as background jobs that keep executing when DSH exits, with a live web panel and offline CLI/GUI management. | low | pass | 0/0/6 | 0/0 | 2026-09-03 08:13 |
| dsh-plan-bridge DSH plugin: one local bridge for ChatGPT Codex / Claude / ZCode (GLM) / Qwen subscription plans — settings status card, one-click provisioning, zero core changes | medium | warn | 0/1/5 | 0/0 | 2026-09-03 08:13 |
| dsh-wsl-launcher Windows desktop launcher for DSH Web running in WSL | medium | warn | 1/3/11 | 0/0 | 2026-09-03 08:13 |
| dsh-context-maid DSH 自动上下文策展插件：tool 输出内容感知瘦身 + 无效日志清理 + 工作流/记忆钉扎保护 + 先归档后压缩 + 摘要模型可配 | low | pass | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-sensenova-provider | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| rein-scene-forge-dsh-plugin DSH plugin for Rein Scene Forge robot scene authoring | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-panda-calendar 熊猫日历 · DSH client-plugin：公历/农历/干支/生肖/节气、传统与外国节日、中国法定节假日（含调休）、多城市天气 — token-free Chinese calendar & weather plugin for DSH Web. | medium | warn | 1/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-storage-mysql DSH 基于 MySQL 的后端存储插件 可通过 storage-domain 配置用于 workspace、session-projection-cache 和 message-feedback 数据的存储 | low | pass | 0/0/2 | 0/0 | 2026-09-03 08:13 |
| dsh-web-verify-panel 让 agent 的网页打开请求在 DSH 侧边栏内完成，不用弹出系统浏览器窗口 | medium | warn | 0/3/7 | 0/0 | 2026-09-03 08:13 |
| dsh-research DSH bundle for evidence-first PDF reading, durable paper records, and cross-paper synthesis. | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-browser-use 为 DSH 插件生态打造的浏览器自动化插件 | low | pass | 0/0/1 | 0/0 | 2026-09-03 08:13 |
| dsh-plugin-toolkit DSH personal toolkit: runtime-toggleable quality-of-life optimizations, each shipped as one card in the Toolkit settings page. | medium | warn | 0/1/6 | 0/0 | 2026-09-03 08:13 |
| dsh-plugin-vision Give your DSH agent eyes via any OpenAI-compatible vision model - 11 provider presets (Doubao/Qwen-VL/GLM-V/OpenAI/Gemini/Ollama...), capability checkboxes that inject live prompt guidance, and analysis of images the user drops into the chat; the agent writes its own observation prompt, and base64 never enters its context. | medium | warn | 0/2/9 | 0/0 | 2026-09-03 08:13 |
| fylar-office-editor Office document preview, editing, and DOCX generation for DSH, powered by Fylar Office SDK. | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| dsh-vision-patch Patch custom provider vision model | low | pass | 0/0/0 | 0/0 | 2026-09-03 08:13 |
| task-progress-bar | low | pass | 0/0/5 | 0/0 | 2026-09-03 10:14 |
| dsh-session-folders | low | pass | 0/0/0 | 0/0 | 2026-09-03 10:14 |
| dsh-godot-play 在 DSH Web GUI 一键构建并试玩 Godot Web 导出。Build & play Godot Web exports in the DSH GUI with one click. | medium | warn | 0/1/4 | 0/0 | 2026-09-03 10:14 |
| dsh-single-terminal 基于dsh的终端插件 | low | pass | 0/0/4 | 0/0 | 2026-09-03 10:14 |
| dsh-raw-html-v2 VCP visual-synesthesia plugin v2 for DSH (official Slot API): raw-HTML vcp-root cards, streaming render, KaTeX/Mermaid/SVG, builtin fonts | medium | warn | 2/3/4 | 0/0 | 2026-09-03 10:14 |
| dsh-clawbot dsh-clawbot | low | pass | 0/0/2 | 0/0 | 2026-09-03 10:14 |
| dsh-git DSH Web GUI 的完整 Git 管理插件：分支切换/fetch/pull/commit/push，可折叠悬浮面板 + 输入框胶囊 | medium | warn | 2/0/1 | 0/0 | 2026-09-03 10:14 |
| dsh-launcher DSH 轻量 Windows 启动器。选一个版本，启动 dsh web。 | medium | warn | 6/7/20 | 0/0 | 2026-09-03 10:14 |
| dsh-script-manager DSH 自定义操作脚本管理插件，将验证过的操作流程固化为可复用脚本，不耗 token、支持参数化和执行验收。 | low | pass | 0/0/3 | 0/0 | 2026-09-03 10:14 |
| dsh-ticktick TickTick (Dida365) task bridge for DSH: Session-header task panel (list filter, undone/completed views, search, drag reorder), 11 curated agent tools, settings card, over the official TickTick MCP endpoint. | medium | warn | 0/2/5 | 0/0 | 2026-09-03 12:13 |
| tencent-agent-mail-dsh-plugin Tencent Agent Mail (agent.qq.com) workbench plugin for DSH: polling, LLM classification, fullscreen workbench, archive/trash, attachment download, mail-to-agent command channel. 腾讯Agent邮箱DSH插件 | medium | warn | 4/2/4 | 0/0 | 2026-09-03 12:13 |
| dsh-archive-manager | low | pass | 0/0/3 | 0/0 | 2026-09-03 12:13 |
| dsh-plugin-voice-input-demo Minimal Chinese voice input plugin for the DSH Web UI | low | pass | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-auto-review Codex-style Auto Review inspired plugin for DSH, with native bridge and Linux sandbox integration | low | pass | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-reasoning-bridge Reasoning Bridge for dsh: hand high-cost reasoning to web AI (ChatGPT first, multi-target); keep local evidence, adoption gate, edits, and tests. Contract-based handoffs, versioned consent, SHA-256 receipts. Zero dependencies. | low | pass | 0/0/2 | 0/0 | 2026-09-03 12:13 |
| dsh-wooden-fish dsh 木鱼，dsh 干活你敲木鱼，每天增加一点点功德 | low | pass | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-log-viewer DSH 日志分析插件：Java 服务日志分析，AI 工具与 Web 仪表盘 | medium | warn | 0/1/1 | 0/0 | 2026-09-03 12:13 |
| dsh-fullwidth-punctuation DSH 插件：让 AI 回答输出中文全角标点（用户直接复制回答内容也是全角）。监听 llm/stream 做智能半角→全角转换，跳过代码块/数字/URL/markdown，并注入 system prompt 提示。 | low | pass | 0/0/0 | 0/0 | 2026-09-03 12:13 |
| dsh-clearview A calmer reading view for DSH: native process details, live reasoning, and clean final answers. | low | pass | 0/0/1 | 0/0 | 2026-09-03 12:13 |
| DSH-guardian for DSH | medium | warn | 2/1/4 | 0/0 | 2026-09-03 12:13 |
| dsh-plugin-auto-review Provider-backed automatic approval review for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-reach Multi-channel decision & remote-control bridge for DSH: pushes any workspace's approval/question cards to IM channels (WeChat iLink first) and answers them from chat, with a session console, per-channel security, and an open push service. | low | pass | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-stall-sentinel Lightweight stall watchdog for DSH - auto-wires subprocess spawn, reminds + forensics on stall, never kills. | medium | warn | 2/0/1 | 0/0 | 2026-09-03 14:13 |
| opencode2dsh DSH plugin — free OpenCode Zen models for DSH. Free LLM API, no API key needed. 在 DSH 中使用 OpenCode Zen 免费模型，无需 API key | medium | warn | 0/2/6 | 0/0 | 2026-09-03 14:13 |
| dsh-plugin-better-plan better-plan: DSH 计划/待办侧边栏插件 | DSH plan/todo sidebar plugin | low | pass | 0/0/1 | 0/0 | 2026-09-03 14:13 |
| dsh-grok-adaptation | low | pass | 0/0/0 | 0/0 | 2026-09-03 14:13 |
| dsh-opencode-free-models 无限免费额度的deepseek harnes 免费模型插件-免费api-DSH 插件 — 在聊天界面里实时展示 OpenCode Zen 的最新免费模型，无需登录、无需密钥，直接在模型选择器选用即可对话。切换网络实现无限额度，无限量token自由！ | medium | warn | 0/1/16 | 0/0 | 2026-09-03 14:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
19 reports2026-09-03current77 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-03. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published