Daily security scan
Date · 2026-09-05 (UTC — plugins first indexed that day)
Static scan · new today
rule heuristics · shape only0
critical
14
high
6
medium
45
low
Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.
Dynamic audit · subset of new today
model reads source · no execution0
critical
0
high
5
medium
1
low
Only entries static-flagged ≥ warn are audited; tier = highest finding. Of 65 new entries, 59 are out of the queue or have no conclusion yet.
| Plugin | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-clinebot DSH companion for ClineBot / ClinePass: dedicated settings page, live quota dashboard, in-UI key saving, curated & custom models, /cline command. | low | not audited | 0/0/4 | 0/0 | 2026-09-05 00:13 |
| dsh-cron Scheduled cron tasks, background automation and agent execution for DSH. | high | medium | 1/2/5 | 0/0 | 2026-09-05 00:13 |
| dsh-xiaomili 小米粒（dsh-xiaomili）—— 常驻 chatbox 右侧的金毛秘书插件：实时旁听对话、识别意图、提取关键词/概念、自动生成秘书简报，记忆可持久化。 | high | not audited | 1/0/4 | 0/0 | 2026-09-05 00:13 |
| dsh-recovery-center Local plugin recovery points and an independent emergency recovery UI for DSH. English / 中文. | high | low | 3/5/10 | 0/0 | 2026-09-05 02:13 |
| dsh-ask-first Adaptive product discovery for DSH using native question dialogs. | low | not audited | 0/0/0 | 0/0 | 2026-09-05 02:13 |
| dsh-goal-auto | medium | not audited | 0/2/3 | 0/0 | 2026-09-05 02:13 |
| user-management dsh 插件 · 用户管理：dsh web 登录门禁 + 用户/角色/登录记录/访问记录管理，首个注册者即管理员 | medium | not audited | 0/3/10 | 0/0 | 2026-09-05 02:13 |
| dsh-session-guard Per-session advisory locks that stop two dsh processes from corrupting one session log. Companion to dsh-session-rescue. | low | not audited | 0/0/1 | 0/0 | 2026-09-05 04:13 |
| dsh-amphoreus 翁法罗斯 × DSH：黄金裔席位工作区与画布工作台（基于 DSH 构建，非官方） | low | not audited | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-file-explorer-kit DSH file explorer: browse the active session's workspace and preview files (Markdown/image/PDF/text/binary) right inside the chat GUI — a standard Cordis bundle plugin (read-only /dsh-files host routes + a conversation.view file tab). | low | not audited | 0/0/4 | 0/0 | 2026-09-05 04:13 |
| dsh-chatgpt-free DSH ChatGPT Free bridges standard ChatGPT Web directly into DSH | low | not audited | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-runtime-observability DSH 运行时可观测性插件。基于 OpenTelemetry 采集事件循环、内存、CPU、工作负载与子代理生命周期指标；支持断路器、ELU 降级联动及可选 Pyroscope 连续 Profiling。 Runtime metrics, continuous profiling & telemetry resilience plugin for DSH. Collects event loop, memory, CPU, workload & subagent lifecycle metrics; circuit breaker, ELU gating, optional Pyroscope profiling. | low | not audited | 0/0/0 | 0/0 | 2026-09-05 04:13 |
| dsh-server-kit A secure, Docker-first server distribution for DSH with web setup, password authentication, persistent storage, health checks, and repeatable upgrades. | high | not audited | 1/1/15 | 0/0 | 2026-09-05 04:13 |
| chat-pace Configurable chat auto-scroll for the DSH web UI | low | not audited | 0/0/3 | 0/0 | 2026-09-05 06:13 |
| dsh-disk-manager DSH plugin: scan the whole C drive, classify every big item (safe cache / relocatable / junction-movable / abandoned / config-memory redline / personal), delete/move/redirect on demand with dry-run & undo. C?????????:????+??+?/?/??,???????? | high | not audited | 4/4/2 | 0/0 | 2026-09-05 06:13 |
| awesome-architecture-dsh 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | not audited | 0/0/2 | 0/0 | 2026-09-05 06:13 |
| dsh-message-rewrite Codex 风格消息原地编辑 DSH 插件：hover ✎ 编辑 → 同会话截断并重新生成回复（surface replacement） | low | not audited | 0/0/1 | 0/0 | 2026-09-05 06:13 |
| dsh-napcatqq-remote 基于 NapCatQQ / OneBot 11 的 DSH QQ 远程操控插件，支持文件、图片、表情、任务追加与会话切换。 | low | not audited | 0/0/8 | 0/0 | 2026-09-05 06:13 |
| routinekit Turn successful agent tool calls into reviewed, parameterized routines you can replay. DSH, MCP, and native WebMCP. | high | not audited | 1/2/8 | 0/0 | 2026-09-05 06:13 |
| dsh-local-models Use local models via Llama.cpp on your DSH | high | medium | 2/3/15 | 0/0 | 2026-09-05 06:13 |
| dsh-browser-unified DSH浏览器插件 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 06:13 |
| dsh-plugin-supanexus-core SupaNexus platform core: branding, OAuth quick setup, dual-line model provider, and app plugin market | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-session-snapshot Rolling, integrity-verified backups of every dsh session at turn boundaries — corruption costs at most the in-flight turn. Part of the session-integrity suite. | low | not audited | 0/0/3 | 0/0 | 2026-09-05 08:13 |
| dsh-arch-advisor 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | not audited | 0/0/2 | 0/0 | 2026-09-05 08:13 |
| dsh-tool-args-unwrap Fix malformed tool-call arguments (nested arguments wrappers, key aliases) at the dsh llm/stream seam. 修复畸形工具参数的 dsh 插件 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-xmap xmap Excel schema-map tools for DSH (7 tools: sheets/headers/hash/extract/verify/save-spec/aggregate) | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-plugin-guard DSH 插件安全体检：静态代码 + 依赖审查 + AI 在线审计，绿/黄/红三级报告面板。 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-workspace-bootstrap DSH 插件 增加默认工作区 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-memgas DSH 长期记忆插件：四通道检索融合 + 记忆演化闭环，检索方法来自 ICLR 2026 论文 MemGAS。Long-term memory plugin for DSH. | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-plugin-insights DSH 插件生态质量评估数据层 · objective health scores (A-D, health-v1) for the whole DSH plugin ecosystem — 全量客观健康分/真伪判定/生态分析/开放数据 | high | not audited | 3/1/3 | 0/0 | 2026-09-05 08:13 |
| dsh-marketing-toolkit DSH 营销工具箱插件：侧边栏一键进入封面图生成 / 朋友圈文案 / 短视频脚本 / 开头黄金3秒检验四个营销 Agent 通道 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 08:13 |
| dsh-research-writing Research writing bundle for DSH: literature search/citation + LaTeX/BibTeX guard in one install. | low | not audited | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-plugin-product-design Product Design workflow suite for DSH (DSH Desktop): a router plus nine pd-* skills — minimum brief gate, three visual directions, evidence-grounded audits/research, URL cloning, frontend builds with a design-QA gate. Original rewrite of the workflow methodology. | low | not audited | 0/0/5 | 0/0 | 2026-09-05 10:13 |
| dsh-biz-bridge DSH业务桥接插件 —— 通过标准 HTTP 协议把 DSH 的 agent 能力开放给业务系统。 | medium | not audited | 0/1/0 | 0/0 | 2026-09-05 10:13 |
| dsh-opencode-go-usage DSH web plugin: floating widget showing real-time OpenCode Go subscription usage (rolling / weekly / monthly) for every API key. Maintained fork of @xiaweiliang060035/dsh-opencode-go-usage. | low | not audited | 0/0/2 | 0/0 | 2026-09-05 10:13 |
| dsh-drop Drag and paste files into DSH Web: one preview rail, native image attachments, and file references added only when sending. | low | not audited | 0/0/2 | 0/0 | 2026-09-05 10:13 |
| dsh-ppt-studio | medium | not audited | 0/1/4 | 0/0 | 2026-09-05 10:13 |
| dsh-safe dsh 启动保险丝：社区插件不兼容导致 dsh 启动失败时，自动禁用坏插件并重试 | high | medium | 1/0/3 | 0/0 | 2026-09-05 10:13 |
| dsh-xiuxian dsh 插件 · 修仙陪伴：随机唤醒一位《凡人修仙传》角色，Q版电子宠物悬浮陪伴你写代码（自带2496角色数据集） | low | not audited | 0/0/12 | 0/0 | 2026-09-05 10:13 |
| dsh-mattpocock-skills DSH 技能包插件（汉化版）：mattpocock/skills 25 个 promoted 技能全文汉化打包，经 ctx.skills 注册。原出处 https://github.com/mattpocock/skills（Matt Pocock，MIT）。 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-kb dsh 插件 · 团队知识库：离线知识共享（FDE 盒子），浏览/全文检索/加工入口；写路径收口 agent，基于 Karpathy LLM Wiki 模式 | medium | medium | 0/2/8 | 0/0 | 2026-09-05 10:13 |
| dsh-search-router DSH search router plugin: multi-provider web_search with live switching, status, and automatic fallback. | low | not audited | 0/0/12 | 0/0 | 2026-09-05 10:13 |
| dsh-ledger-compact dsh-plugin: OMP-style ingress shaping plus optional local /fast-compact for DSH | low | not audited | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-plugin-task-coordinator Codex-style cross-task coordination for DSH: list, inspect, spawn, message and steer top-level sessions from a supervisor agent. | high | not audited | 1/0/2 | 0/0 | 2026-09-05 10:13 |
| DSH-P2M DSH 插件管家（dsh-p2m / A插件）：统一管理+冲突处理+按用时排序 | A plugin manager & conflict resolver for DSH (DSH/Cordis) | high | medium | 3/7/9 | 0/0 | 2026-09-05 10:13 |
| DSH- 本项目是一键静默启动DSH Web 的 Windows 桌面快捷方式包。这个快捷方式有鲸鱼图标并且不会出现黑色终端窗口。双击桌面上的DeepSeek快捷方式即可后台启动dsh web，并自动打开浏览器。也有一些简单纠错，如找不到 `dsh` / `npx` 时会弹出中文提示，不会说是点了没反应，还有一个，就是此脚本按自身所在目录解析路径，放到任意位置都能用 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 10:13 |
| dsh-desktop Deepseek-Harness-Desktop | medium | not audited | 0/4/4 | 0/0 | 2026-09-05 10:13 |
| dsh-remote-auth | low | not audited | 0/0/2 | 0/0 | 2026-09-05 12:13 |
| dsh-file-upload-local | low | not audited | 0/0/2 | 0/0 | 2026-09-05 12:13 |
| dsh-codebuddy-cli dsh-codebuddy-cli | high | not audited | 1/4/12 | 0/0 | 2026-09-05 12:13 |
| dsh-model-groups DSH grouped provider and manufacturer model selector | low | not audited | 0/0/0 | 0/0 | 2026-09-05 12:13 |
| dsh-arch-advisor-offline 给 DSH 装一位"读过架构书"的架构顾问：实时查阅 40 教程/31 模板/6 案例，引导设计并产出需求/概要/详细/数据库文档。· Persistent DSH plugin: an in-chat architecture consultant that queries the awesome-architecture knowledge base and guides engineering-doc authoring. | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-admin-bridge Scoped, short-lived administrator access for DSH, without storing sudo passwords | high | not audited | 1/2/4 | 0/0 | 2026-09-05 14:13 |
| dsh-local-search 拒绝花里胡哨，让你的dsh用本地网络搜索信息 | Zero-dependency local Bing search DSH plugin | low | not audited | 0/0/1 | 0/0 | 2026-09-05 14:13 |
| dsh-glob-rules | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-rgb-input-glow DSH Web 插件：「光污染」RGB 流光皮肤（输入框/侧栏/hero 等 WebGL bloom + CSS 光效，独立皮肤不修改任何原皮肤） | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-font-customizer DSH字体定制插件：更换界面/代码字体与正文字号，识别本机已安装字体，设置持久化保存。 | low | not audited | 0/0/3 | 0/0 | 2026-09-05 14:13 |
| dsh-done-notify dsh 插件：离开页面时 agent 完成任务/等待审批/提问，弹系统通知，点击跳回会话 · System notifications for DSH when agents need you while you're away | low | not audited | 0/0/5 | 0/0 | 2026-09-05 14:13 |
| web-search-advanced | low | not audited | 0/0/3 | 0/0 | 2026-09-05 14:13 |
| dsh-secure-context-fix Fix the DSH Web GUI over plain HTTP on a LAN: injects a crypto.randomUUID polyfill (getRandomValues-backed) before dsh bundle code runs | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-security-guard DSH plugin security guard: 28-rule static scanner, risk scoring, whitelist/blacklist policy, local web dashboard and in-DSH risk popups./DSH 插件安全卫士：28 条规则静态扫描、风险评分、白名单/黑名单、本地 Web 仪表盘与 DSH 内风险弹窗。 | high | not audited | 3/3/13 | 0/0 | 2026-09-05 14:13 |
| dsh-aqua-glass | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh_HUDV1.0.0 做了一个DSH 的右上角悬浮任务台，它能够实时显示当前时段是波峰（贵/红）还是波谷（便宜/绿），还提供了模型、工具、Agent、定价与 24 小时的峰谷轨迹。整体设计风格就是左侧信息 + 右侧看板娘，希望大家喜欢。。 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-voice-input-qwen-asr 基于dsh的语音输入插件 | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
| dsh-model-select-search Search-enabled composer model seat for DSH (sticky fuzzy search) | low | not audited | 0/0/0 | 0/0 | 2026-09-05 14:13 |
Site-wide fused risk
Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total
266
critical
0
high
195
medium
22354
low
Critical-tier plugins (266)
claude-paperdsh-sentineldsh-review-loopdeepseek-harness-fnosdsh-for-vscpi-mm-visiondsh-plugin-verifyds-web-uideepseek-harness-desktop-7dsh-plugin-managerdsh-fffdeepseek-harness-pluginsdsh-desktop-pet-2dsh-science-workbenchdsh-lan-2dsh-workshopdeepseekharnessremotegatewaydsh-lorebookmddsh-plugin-market-5dsh-file-paneldsh-np-pptdeepseek-harness-android-appdsh-web-remotedsh-self-harness-toolsdsh-change-reviewdsh-hotswapmakocodedsh-skill-mcp-paneldsh-tavern-2dsh-mc-agentdsh-webdsh-doctor-4dsh-design-studiodsh-tailscale-consoledhs-theme-plugindeepseek-harness-moltdsh-command-check-updatedsh-auth-gatedsh-silly-pluginopendshdsh-tool-code-reviewdsh-task-consoledsh-agent-eval-2deepseek-harness-plugins-3dsher-bbs-plugindeepseek-harness-plugs-managedsh-dev-serverdsh-about-updaterdsh-toolbox-webdsh-remote-publicdsh-notifier-2dsh-plugin-containerdsh-desktop-huacaideepseek-herness-desktoppaperlabchromex-browserdsh-github-tooldsh-lan-access-3dsh-custom-uidsh-pet-6desk-harnessdsh-plugin-larkdsh-webgatedsh-tavern-3dsh-anchored-monitordsh-neutrinoliving-dream-dshdsh-comfyuidsh-desktop-68dsh-wechatclawbotorbit-dsh-plugindsh-perm-guarddsh-cc-pluginsdsh-tool-generate-imagedsh-routed-subagentdsh-swarmdsh-nuphus-mcpdsh-lark-alldsh-ide-panelschat-deepseek-visiondeepseek-harness-liquid-glass-themedshscandsh-pwsh-directdsh-capcheckdsh-minecraft-themedsh-plugin-market-20dsh-diffgeomdsh-remote-7dsh-logcatdsh-ide-bridgedsh-mail-connectordsh-fleetdsh-desktop-tools-2dsh-usage-6dsh-mobilesharedsh-plugin-market-22dsh-profile-porttavern-launcherdsh-file-linkspdfreaderdsh-publish-plugindsh-workshop-3dsh-qq-remotedsh-settings-prodsh-github-pushdsh-web-remote-frpdsh-pentesterdsh-tool-lensdsh-testsuitecodereaderdsh-webroadweave-for-dshdsh-tool-git-3dsh-memory-eternaldsh-capability-managerdsh-arbitrary-hostdsh-plugins-76dsh-storedsh-lanchatdsh-k8sdsh-worktabledsh-tts-playerdsh-agent-browser-2dsh-image-readdsh-stats-expanddsh-usage-stats-11dsh-input-enhancementdsh-safe-launchdsh-balance-plugin-6atri-for-dshconvoportdsh-experience-librarydeepseek-harness-desktop-54dsh-relay-2dscoderdsh-inline-images-2dsh-community-plugins-2dsh-process-boarddsh-rtk-toolsdsh-plugin-offline-packagerdsh-asset-managerdsh-vsceditordsh-suhuang-scrolldsh-free-models-hubdsh-freeroutedsh-bg-plugindsh-sandbox-permissions-not-strictly-wider-justification-empty-fixdsh-applauncherdsh-public-accessdshessentialtoolsdsh-qrcode-hassle-freedsh-call-shrinkdsh-automation-3dsh-skill-hub-3dsh-desktop-102dsh-kit-4dsh-plugin-ollama-monitordsh-smart-reminderdsh-plugins-94dsh-4-role-workflowdsh-raw-html-v2dsh-gbdsh-git-review-2dsh-plugin-canvas-prodsh-search-prodsh-git-9dsh-tmwebdriverdsh-fleet-2dsh-cc-backupdsh-token-pulsephone-tunnel-poolsee-the-screendeepseek-harness-minimal-omnidsh-plugin-forge-5dsh-session-progressdsh-move-ragdsh-cad-viewerdsh-agentic-proxydsh-wechat-bridge-5dsh-windows-remote-sshdsh-remote-file-systemdsh-better-display-2dsh-better-uiuxdsh-default-promptdsh-agent-clusterdsh-sidebar-plusvscode-dsh-sidebardsh-agnes-studiodsh-youdaonotedsh-plugin-repo-snapshotdsh-netease-music-2dsh-lobsterai-daddydsh-cua-previewdsh-buddy-spikedsh-novel-appdsh-desktop-settingsdsh-zcode-connectoranoslide-pluginsdsh-destinywind-tpmdsh-wakervoice-inputdsh-draw-plugindsh-ipynb-previewdsh-ask-formdsh-remote-access-cidrdsh-genbox-plugindsh-wsl-projectsdsh-mcp-unified-paneldsh-archive-keeper-plugindsh-nutstore-backupdsh-kp-notesdsh-flow-3dsh-aocidsh-service-boardcad-ppt-skillsdsh-wbdsh-web-appdsh-text-explaindsh-ledger-memorydsh-artcraftdsh-remote-13zadloop-ultimate-toolkitdsh-ai-balldsh-mcp-manager-19dsh-deploy-webdsh-plugin-cdpdsh-upgrade-2dsh-envkitdsh-desktop-app-4dsh-pwa-launcherdsh-steal-codedsh-tools-5dsh-helper-plugin-workspace-browserdsh-console-plugindsh-olivia-bridgedsh-obsidian-sync-2dsh-git-serverdsh-android-scrcpyzcode-dispatchdsh-armor-switchdsh-tool-suitepi-control-chromedsh-skill-market-4dsh-chatsyncdsh-liquid-glass-theme-2dsh-remote-guidsh-plugins-151dsh-plugin-30dsh-skill-creator-5dsh-xl-free-modeldsh-browser-agent-4dsh-plugin-market-30dsh-maplestory-wzdsh-tool-mathfigdsh-phone-bridge-3dsh-latex-studiodsh-6dsh-brand-textmindie-agent-dshdsh-bili-scroll-2wa-agentdsh-opencode-free-3dsh-phone-remote-2dsh-android-phonedsh-dispatch-2dsh-pocket-oauth
Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
66 reports2026-10-21220 added0 crit69 medium2026-10-200 added0 crit0 medium2026-10-190 added0 crit0 medium2026-10-18609 added1 crit221 medium2026-10-17306 added0 crit0 medium2026-10-160 added0 crit0 medium2026-10-15110 added1 crit47 medium2026-10-1499 added1 crit33 medium2026-10-13102 added1 crit36 medium2026-10-120 added0 crit0 medium2026-10-110 added0 crit0 medium2026-10-10104 added0 crit40 medium2026-10-098 added0 crit1 medium2026-10-08100 added0 crit39 medium2026-10-070 added0 crit0 medium2026-10-060 added0 crit0 medium2026-10-050 added0 crit0 medium2026-10-0472 added0 crit30 medium2026-10-0388 added0 crit36 medium2026-10-0299 added1 crit47 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit51 medium2026-09-2969 added0 crit22 medium2026-09-2864 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-05current65 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-05. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.
Source: dsh.so security standards · Maintained by dsh.so · Published