Daily security scan
Date · 2026-09-05 (UTC — plugins first indexed that day)
65
added
0
critical
20
medium
45
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-clinebot DSH companion for ClineBot / ClinePass: dedicated settings page, live quota dashboard, in-UI key saving, curated & custom models, /cline command. | low | pass | 0/0/4 | 0/0 | 2026-09-05 00:13 |
| dsh-cron Scheduled cron tasks, background automation and agent execution for DSH. | medium | warn | 1/2/5 | 0/0 | 2026-09-05 00:13 |
| dsh-xiaomili 小米粒（dsh-xiaomili）—— 常驻 chatbox 右侧的金毛秘书插件：实时旁听对话、识别意图、提取关键词/概念、自动生成秘书简报，记忆可持久化。 | medium | warn | 1/0/4 | 0/0 | 2026-09-05 00:13 |
| dsh-recovery-center Local plugin recovery points and an independent emergency recovery UI for DSH. English / 中文. | medium | warn | 3/5/10 | 0/0 | 2026-09-05 02:13 |
| dsh-ask-first Adaptive product discovery for DSH using native question dialogs. | low | pass | 0/0/0 | 0/0 | 2026-09-05 02:13 |
| dsh-goal-auto | medium | warn | 0/2/3 | 0/0 | 2026-09-05 02:13 |
| user-management dsh 插件 · 用户管理：dsh web 登录门禁 + 用户/角色/登录记录/访问记录管理，首个注册者即管理员 | medium | warn | 0/3/10 | 0/0 | 2026-09-05 02:13 |
| dsh-session-guard Per-session advisory locks that stop two dsh processes from corrupting one session log. Companion to dsh-session-rescue. | low | pass | 0/0/1 | 0/0 | 2026-09-05 04:13 |
| dsh-amphoreus 翁法罗斯 × DSH：黄金裔席位工作区与画布工作台（基于 DSH 构建，非官方） | low | pass | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-file-explorer-kit DSH file explorer: browse the active session's workspace and preview files (Markdown/image/PDF/text/binary) right inside the chat GUI — a standard Cordis bundle plugin (read-only /dsh-files host routes + a conversation.view file tab). | low | pass | 0/0/4 | 0/0 | 2026-09-05 04:13 |
| dsh-chatgpt-free DSH ChatGPT Free bridges standard ChatGPT Web directly into DSH | low | pass | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-runtime-observability DSH 运行时可观测性插件。基于 OpenTelemetry 采集事件循环、内存、CPU、工作负载与子代理生命周期指标；支持断路器、ELU 降级联动及可选 Pyroscope 连续 Profiling。 Runtime metrics, continuous profiling & telemetry resilience plugin for DSH. Collects event loop, memory, CPU, workload & subagent lifecycle metrics; circuit breaker, ELU gating, optional Pyroscope profiling. | low | pass | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-server-kit A secure, Docker-first server distribution for DSH with web setup, password authentication, persistent storage, health checks, and repeatable upgrades. | medium | warn | 1/1/15 | 0/0 | 2026-09-05 04:13 |
| chat-pace Configurable chat auto-scroll for the DSH web UI | low | pass | 0/0/3 | 0/0 | 2026-09-05 06:13 |
| dsh-disk-manager DSH plugin: scan the whole C drive, classify every big item (safe cache / relocatable / junction-movable / abandoned / config-memory redline / personal), delete/move/redirect on demand with dry-run & undo. C?????????:????+??+?/?/??,???????? | medium | warn | 4/4/2 | 0/0 | 2026-09-05 06:13 |
| awesome-architecture-dsh 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | pass | 0/0/2 | 0/0 | 2026-09-05 06:13 |
| dsh-message-rewrite Codex 风格消息原地编辑 DSH 插件：hover ✎ 编辑 → 同会话截断并重新生成回复（surface replacement） | low | pass | 0/0/1 | 0/0 | 2026-09-05 06:13 |
| dsh-napcatqq-remote 基于 NapCatQQ / OneBot 11 的 DSH QQ 远程操控插件，支持文件、图片、表情、任务追加与会话切换。 | low | pass | 0/0/8 | 0/0 | 2026-09-05 06:13 |
| routinekit Turn successful agent tool calls into reviewed, parameterized routines you can replay. DSH, MCP, and native WebMCP. | medium | warn | 1/2/8 | 0/0 | 2026-09-05 06:13 |
| dsh-local-models Use local models via Llama.cpp on your DSH | medium | warn | 2/3/15 | 0/0 | 2026-09-05 06:13 |
| dsh-browser-unified DSH浏览器插件 | low | pass | 0/0/0 | 0/0 | 2026-09-05 06:13 |
| dsh-plugin-supanexus-core SupaNexus platform core: branding, OAuth quick setup, dual-line model provider, and app plugin market | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-session-snapshot Rolling, integrity-verified backups of every dsh session at turn boundaries — corruption costs at most the in-flight turn. Part of the session-integrity suite. | low | pass | 0/0/3 | 0/0 | 2026-09-05 08:13 |
| dsh-arch-advisor 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | pass | 0/0/2 | 0/0 | 2026-09-05 08:13 |
| dsh-tool-args-unwrap Fix malformed tool-call arguments (nested arguments wrappers, key aliases) at the dsh llm/stream seam. 修复畸形工具参数的 dsh 插件 | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-xmap xmap Excel schema-map tools for DSH (7 tools: sheets/headers/hash/extract/verify/save-spec/aggregate) | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-plugin-guard DSH 插件安全体检：静态代码 + 依赖审查 + AI 在线审计，绿/黄/红三级报告面板。 | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-workspace-bootstrap DSH 插件 增加默认工作区 | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-memgas DSH 长期记忆插件：四通道检索融合 + 记忆演化闭环，检索方法来自 ICLR 2026 论文 MemGAS。Long-term memory plugin for DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-plugin-insights DSH 插件生态质量评估数据层 · objective health scores (A-D, health-v1) for the whole DSH plugin ecosystem — 全量客观健康分/真伪判定/生态分析/开放数据 | medium | warn | 3/1/3 | 0/0 | 2026-09-05 08:13 |
| dsh-marketing-toolkit DSH 营销工具箱插件：侧边栏一键进入封面图生成 / 朋友圈文案 / 短视频脚本 / 开头黄金3秒检验四个营销 Agent 通道 | low | pass | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-research-writing Research writing bundle for DSH: literature search/citation + LaTeX/BibTeX guard in one install. | low | pass | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-plugin-product-design Product Design workflow suite for DSH (DSH Desktop): a router plus nine pd-* skills — minimum brief gate, three visual directions, evidence-grounded audits/research, URL cloning, frontend builds with a design-QA gate. Original rewrite of the workflow methodology. | low | pass | 0/0/5 | 0/0 | 2026-09-05 10:13 |
| dsh-biz-bridge DSH业务桥接插件 —— 通过标准 HTTP 协议把 DSH 的 agent 能力开放给业务系统。 | medium | warn | 0/1/0 | 0/0 | 2026-09-05 10:13 |
| dsh-opencode-go-usage DSH web plugin: floating widget showing real-time OpenCode Go subscription usage (rolling / weekly / monthly) for every API key. Maintained fork of @xiaweiliang060035/dsh-opencode-go-usage. | low | pass | 0/0/2 | 0/0 | 2026-09-05 10:13 |
| dsh-drop Drag and paste files into DSH Web: one preview rail, native image attachments, and file references added only when sending. | low | pass | 0/0/2 | 0/0 | 2026-09-05 10:13 |
| dsh-ppt-studio | medium | warn | 0/1/4 | 0/0 | 2026-09-05 10:13 |
| dsh-safe dsh 启动保险丝：社区插件不兼容导致 dsh 启动失败时，自动禁用坏插件并重试 | medium | warn | 1/0/3 | 0/0 | 2026-09-05 10:13 |
| dsh-xiuxian dsh 插件 · 修仙陪伴：随机唤醒一位《凡人修仙传》角色，Q版电子宠物悬浮陪伴你写代码（自带2496角色数据集） | low | pass | 0/0/12 | 0/0 | 2026-09-05 10:13 |
| dsh-mattpocock-skills DSH 技能包插件（汉化版）：mattpocock/skills 25 个 promoted 技能全文汉化打包，经 ctx.skills 注册。原出处 https://github.com/mattpocock/skills（Matt Pocock，MIT）。 | low | pass | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-kb dsh 插件 · 团队知识库：离线知识共享（FDE 盒子），浏览/全文检索/加工入口；写路径收口 agent，基于 Karpathy LLM Wiki 模式 | medium | warn | 0/2/8 | 0/0 | 2026-09-05 10:13 |
| dsh-search-router DSH search router plugin: multi-provider web_search with live switching, status, and automatic fallback. | low | pass | 0/0/12 | 0/0 | 2026-09-05 10:13 |
| dsh-ledger-compact dsh-plugin: OMP-style ingress shaping plus optional local /fast-compact for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-plugin-task-coordinator Codex-style cross-task coordination for DSH: list, inspect, spawn, message and steer top-level sessions from a supervisor agent. | medium | warn | 1/0/2 | 0/0 | 2026-09-05 10:13 |
| DSH-P2M DSH 插件管家（dsh-p2m / A插件）：统一管理+冲突处理+按用时排序 | A plugin manager & conflict resolver for DSH (DSH/Cordis) | medium | warn | 3/7/9 | 0/0 | 2026-09-05 10:13 |
| DSH- 本项目是一键静默启动DSH Web 的 Windows 桌面快捷方式包。这个快捷方式有鲸鱼图标并且不会出现黑色终端窗口。双击桌面上的DeepSeek快捷方式即可后台启动dsh web，并自动打开浏览器。也有一些简单纠错，如找不到 `dsh` / `npx` 时会弹出中文提示，不会说是点了没反应，还有一个，就是此脚本按自身所在目录解析路径，放到任意位置都能用 | low | pending | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-desktop Deepseek-Harness-Desktop | medium | warn | 0/4/4 | 0/0 | 2026-09-05 10:13 |
| dsh-remote-auth | low | pass | 0/0/2 | 0/0 | 2026-09-05 12:13 |
| dsh-file-upload-local | low | pass | 0/0/2 | 0/0 | 2026-09-05 12:13 |
| dsh-codebuddy-cli dsh-codebuddy-cli | medium | warn | 1/4/12 | 0/0 | 2026-09-05 12:13 |
| dsh-model-groups DSH grouped provider and manufacturer model selector | low | pass | 0/0/0 | 0/0 | 2026-09-05 12:13 |
| dsh-arch-advisor-offline 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-admin-bridge Scoped, short-lived administrator access for DSH, without storing sudo passwords | medium | warn | 1/2/4 | 0/0 | 2026-09-05 14:13 |
| dsh-local-search 拒绝花里胡哨，让你的dsh用本地网络搜索信息 | Zero-dependency local Bing search DSH plugin | low | pass | 0/0/1 | 0/0 | 2026-09-05 14:13 |
| dsh-glob-rules | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-rgb-input-glow DSH Web 插件：「光污染」RGB 流光皮肤（输入框/侧栏/hero 等 WebGL bloom + CSS 光效，独立皮肤不修改任何原皮肤） | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-font-customizer DSH字体定制插件：更换界面/代码字体与正文字号，识别本机已安装字体，设置持久化保存。 | low | pass | 0/0/3 | 0/0 | 2026-09-05 14:13 |
| dsh-done-notify dsh 插件：离开页面时 agent 完成任务/等待审批/提问，弹系统通知，点击跳回会话 · System notifications for DSH when agents need you while you're away | low | pass | 0/0/5 | 0/0 | 2026-09-05 14:13 |
| web-search-advanced | low | pass | 0/0/3 | 0/0 | 2026-09-05 14:13 |
| dsh-secure-context-fix Fix the DSH Web GUI over plain HTTP on a LAN: injects a crypto.randomUUID polyfill (getRandomValues-backed) before dsh bundle code runs | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-security-guard DSH plugin security guard: 28-rule static scanner, risk scoring, whitelist/blacklist policy, local web dashboard and in-DSH risk popups./DSH 插件安全卫士：28 条规则静态扫描、风险评分、白名单/黑名单、本地 Web 仪表盘与 DSH 内风险弹窗。 | medium | warn | 3/3/13 | 0/0 | 2026-09-05 14:13 |
| dsh-aqua-glass | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh_HUDV1.0.0 做了一个DSH 的右上角悬浮任务台，它能够实时显示当前时段是波峰（贵/红）还是波谷（便宜/绿），还提供了模型、工具、Agent、定价与 24 小时的峰谷轨迹。整体设计风格就是左侧信息 + 右侧看板娘，希望大家喜欢。。 | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-voice-input-qwen-asr 基于dsh的语音输入插件 | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-model-select-search Search-enabled composer model seat for DSH (sticky fuzzy search) | low | pass | 0/0/0 | 0/0 | 2026-09-05 14:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
21 reports2026-09-05current65 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-05. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published