Daily security scan
Date · 2026-09-09 (UTC — plugins first indexed that day)
48
added
0
critical
15
medium
33
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-whale-widget-sankou DSH 小鲸鱼余额挂件·三口皮肤版 —— 基于 MeteorNOX/DeepSeek-Balance-Whale-Widget（MIT）的修改版：自定义桌宠“三口”形象/语音/生气与吃撑状态/吃透明动画，含余额提醒与菜单修复 | medium | warn | 0/2/7 | 0/0 | 2026-09-09 00:13 |
| dsh-agent-pet A pet in the DSH Web UI that changes pose with your agent, with an eight-pose sprite sheet you can generate from one sentence. | low | pass | 0/0/5 | 0/0 | 2026-09-09 00:13 |
| dsh-webdav-server dsh 插件 · WebDAV 服务器：把一个目录变成 Windows/macOS/Linux 都能挂载成本地磁盘的服务（令牌认证/只读模式/热更新配置） | medium | warn | 0/2/18 | 0/0 | 2026-09-09 00:13 |
| dsh-ai-saas-deal-finder DSH plugin that finds the cheapest legitimate AI/SaaS purchase option based on region, eligibility, payment methods, taxes, and service policies. | low | pass | 0/0/0 | 0/0 | 2026-09-09 02:13 |
| dsh-artifacts An Artifacts tab for the DSH web GUI sidebar: lists the files an agent produced and previews them in place, with live reload. | low | pass | 0/0/9 | 0/0 | 2026-09-09 02:13 |
| dsh-paste-code-block Cherry Studio-style paste: text/code blocks pasted into the DSH Web composer collapse into a bordered, collapsible, language-tagged card; restored as fenced code blocks on send. | low | pass | 0/0/0 | 0/0 | 2026-09-09 02:13 |
| dsh-mobile Flutter mobile app + Dart wire-protocol SDK for the DSH | low | pass | 0/0/0 | 0/0 | 2026-09-09 02:13 |
| dsh-translator 基于 DSH 插件规范打造的输入框悬浮快捷翻译与历史找回挂件。支持直接复用当前会话已选大模型，内置智谱 AI 免费模型预设，并支持添加多个自定义 OpenAI 兼容接口。 | medium | warn | 0/2/11 | 0/0 | 2026-09-09 02:13 |
| dsh-desktop-drop-path | low | pass | 0/0/0 | 0/0 | 2026-09-09 06:13 |
| dsh-queue-first-enter DSH Web plugin: with an empty composer, Enter steers the first queued message into the running turn. | low | pass | 0/0/2 | 0/0 | 2026-09-09 06:13 |
| dsh-read-image-view Show local images read by read_image directly in the DSH web chat — inline thumbnail + lightbox, pure client plugin | low | pass | 0/0/0 | 0/0 | 2026-09-09 06:13 |
| dsh-scheduled-send | medium | warn | 0/1/3 | 0/0 | 2026-09-09 06:13 |
| dsh-advisor | low | pass | 0/0/1 | 0/0 | 2026-09-09 06:13 |
| dsh-context-window DSH 插件：复刻 Codex 最新上下文窗口管理 — token 预算提示 / 模型可调用的 new_context / 交接式换窗替代摘要压缩 | DSH plugin reimplementing Codex's context window management: token-budget notice, model-facing new_context, handoff window reset instead of summary compaction | low | pass | 0/0/0 | 0/0 | 2026-09-09 06:13 |
| llm-capture | low | pass | 0/0/1 | 0/0 | 2026-09-09 06:13 |
| dsh-outlook | medium | warn | 0/2/4 | 0/0 | 2026-09-09 06:13 |
| dsh-todo-board Cross-session TODO board for DSH: a draggable floating panel groups tasks by working directory, each task carries a run mode (remind / auto-continue in the current session / auto-open a new session) and two checkboxes (AI done, user verified). | low | pass | 0/0/7 | 0/0 | 2026-09-09 08:13 |
| dsh-plugin-updater Safe one-click plugin updater for DSH: backup, verified update with real boot smoke test, auto-rollback, and a launch-aware restart button. 深度求索 Harness 插件安全一键更新器 | medium | warn | 0/6/4 | 0/0 | 2026-09-09 08:13 |
| dsh-automode Automode for DSH: a fourth permission preset — full access with an LLM classifier as the only gate before every tool call. | low | pass | 0/0/3 | 0/0 | 2026-09-09 08:13 |
| dsh-turn-fold Two-level folding for DSH reasoning and tool calls (targets DSH 0.1.5-alpha.1) | low | pass | 0/0/2 | 0/0 | 2026-09-09 08:13 |
| dsh-save-session DSH plugin: export the current session as filtered Markdown or rendered HTML (with TOC) via one-click buttons in the session header | low | pass | 0/0/0 | 0/0 | 2026-09-09 08:13 |
| mega-index-map Cross-workspace interop Library: record, index and search files, tools, environments, knowledge and work records across workspaces for reuse. | medium | warn | 0/6/4 | 0/0 | 2026-09-09 08:13 |
| dsh-context-mode Context window optimization for DSH agents. Sandboxes tool output in-process (only what you print enters the conversation), persists session memory in an FTS5 knowledge base, and enforces routing via a system-prompt routing section. | low | pass | 0/0/7 | 0/0 | 2026-09-09 08:13 |
| dsh-security Plugins for performing security audits using dsh | medium | warn | 0/3/0 | 0/3 | 2026-09-09 08:13 |
| dsh-client-theme-cyber DSH 主题 | low | pass | 0/0/0 | 0/0 | 2026-09-09 08:13 |
| oh-my-dsh-plugins | low | pass | 0/0/3 | 0/0 | 2026-09-09 08:13 |
| dsh-models-input-modalities DSH Web plugin: per-model input-modality selector (text/image) on the Models settings page for third-party (pi-ai) providers. | low | pass | 0/0/0 | 0/0 | 2026-09-09 08:13 |
| dsh-openkapsel Remote-only OpenKapsel workspace bridge for the DSH: replaces host filesystem and shell tools with a fail-closed remote tool set. Self-hosted alternative to cloud agent sandboxes. | medium | warn | 1/0/2 | 0/0 | 2026-09-09 08:13 |
| deepshell-agent A desktop agent powered by DSH. | low | pass | 0/0/4 | 0/0 | 2026-09-09 08:13 |
| dsh-composer-collapse Three-mode height manager for the DSH Web composer: auto / pinned open / pinned collapsed. DSH Web 输入框高度三态管理插件。 | low | pass | 0/0/2 | 0/0 | 2026-09-09 10:13 |
| dsh-plugin-log-forwarder DSH 实时日志转发插件：将 Agent 运行事件实时转发到 WebSocket / Loki / 本地文件 | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-plugin-cron | low | pass | 0/0/4 | 0/0 | 2026-09-09 10:13 |
| dsh-workspace-enhance 为 DSH 提供 Codex 风格工作区会话绑定、会话顶部快捷归档及已归档会话管理中心 | low | pass | 0/0/1 | 0/0 | 2026-09-09 10:13 |
| dsh-geolibre DSH plugin: render GeoJSON/vector data into an interactive GeoLibre map and let agents operate the live map (layers, styles, view, GeoLibre algorithms and Whitebox WASM tools) through agent tools. | medium | warn | 0/2/3 | 0/0 | 2026-09-09 10:13 |
| dsh-copy-session-ref 在会话行菜单复制规范 @session mention, 粘贴到输入框即可召回该会话上下文 | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-subagent-progress Live subagent progress dock for DSH — npm: dsh-subagent-progress | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-latex2office | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-thinktune DSH的 Ollama 适配器插件：让 qwen3.8 等思考模型的思考强度成为一个可配置、可选择的一等参数，同时原生支持多模态图片输入，并可在四种常见的思考控制协议之间一键切换。 | medium | warn | 0/1/6 | 0/0 | 2026-09-09 10:13 |
| dsh-antigravity Analysis and local fix for dsh-antigravity plugin CallId export error in DSH Desktop Beta | medium | warn | 0/3/9 | 0/0 | 2026-09-09 10:13 |
| dsh-better-workbench DSH 工作台插件，把常用的页面或者应用，Pin 在工作台 | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-custom-context-injector dsh-custom-context-injector 提供「自定义上下文」设置页并注入到模型上下文，支持落盘持久化。 | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| dsh-terminal Resizable native CLI terminal panes for DSH sessions. | low | pass | 0/0/5 | 0/0 | 2026-09-09 10:13 |
| dsh-super-advisor DSH SuperAdvisor: on-demand second opinions from a stronger model, with editable requests and per-call human approval. | low | pass | 0/0/1 | 0/0 | 2026-09-09 10:13 |
| dsh-nazuna-wallpaper-engine NAZUNA (彻夜之歌) themed wallpaper-engine for DSH: 七草荠 mascot, moonlight-violet liquid glass. Derivative of elysia395/dsh-wallpaper-engine v0.7.1 (MIT). | medium | warn | 0/2/1 | 0/0 | 2026-09-09 10:13 |
| dsh-accounts DSH 凭据桥接插件：AI 代填登录表单/注入 env 运行 CLI，值不进模型上下文；附网页管理界面 | medium | warn | 0/1/2 | 0/0 | 2026-09-09 10:13 |
| dsh-voice-input Voice input for the DSH Web composer: browser Web Speech with a Windows offline (System.Speech) fallback. | medium | warn | 0/2/11 | 0/0 | 2026-09-09 10:13 |
| dsh-fisher 摸鱼海岸：面向 DSH 的轻操作钓鱼与收藏娱乐插件。 | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
| um-dsh-plugin-skills Agent skill pack for DSH plugin development · 18-page distilled official dev guide (bilingual) · umdshdev | low | pass | 0/0/0 | 0/0 | 2026-09-09 10:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
25 reports2026-09-09current48 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-09. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published