Daily security scan
Date · 2026-09-10 (UTC — plugins first indexed that day)
96
added
1
critical
17
medium
78
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-tts-flash 给 DSH 的语音朗读插件：AI 回复流式 TTS 朗读，思考等待期还有趣味语音短语反馈。Edge TTS 开箱即用，支持任意 OpenAI 兼容云端引擎。 | low | pass | 0/0/9 | 0/0 | 2026-09-10 00:13 |
| plugin-effort-slider Notched reasoning-effort slider grouped with the model picker for DSH — native styling, themeable, i18n | low | pass | 0/0/0 | 0/0 | 2026-09-10 00:13 |
| dsh-link-collect DSH bundle（DSH 插件）：链接收藏 —— 把收藏的链接（标题/简介/图标/标签/正文）持久化为本地 Markdown 收藏夹，带 Web 侧栏页面。 | medium | warn | 0/5/21 | 0/0 | 2026-09-10 02:13 |
| dsh-plugin-proxy-env DSH plugin: inject proxy environment variables at startup and self-check the whole proxy chain | medium | warn | 0/2/13 | 0/0 | 2026-09-10 02:13 |
| dsh-claude-compat DSH 插件，兼容claude的skill、rules加载规则，mcp配置 | low | pass | 0/0/2 | 0/0 | 2026-09-10 02:13 |
| dsh-steer | low | pass | 0/0/1 | 0/0 | 2026-09-10 04:13 |
| dsh-loop-continue | low | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-memorix-panel Memorix memory panel for the DSH Web GUI: browse every project and memory, read full details, archive/restore and create memories — writes go through the official memorix CLI. | medium | warn | 0/1/4 | 0/0 | 2026-09-10 04:13 |
| dsh-web-auth | low | pass | 0/0/4 | 0/0 | 2026-09-10 04:13 |
| dsh-agent-bridge 飞书机器人 → DSH 会话桥：在指定工作区开真会话，用 DSH 现有模型+插件执行任务并回传结论 — DSH bundle。 | medium | warn | 0/2/3 | 0/0 | 2026-09-10 04:13 |
| dsh-unitverse Unit conversion plugin for DSH: one `convert` tool plus a locale-aware Web view, covering 10 categories (length, area, volume, time, angle, speed, temperature, pressure, energy/heat, power) with 80+ units. 单位换算 DSH 插件：十大类 80+ 单位，convert 工具与 Web 视图均支持中英文。 | low | pass | 0/0/2 | 0/0 | 2026-09-10 04:13 |
| dsh-plugin-forge 插件工坊：在任意工作区按 dph 格式快速脚手架 DSH 本地插件，并维护踩坑经验库持续修正开发 — DSH bundle。 | medium | warn | 0/6/2 | 0/0 | 2026-09-10 04:13 |
| dsh-notes DSH bundle（DSH 插件）：笔记 —— 按目录分组的本地 Markdown 笔记，带 Web 侧栏页面，读取根/分组下的 AGENTS 等规则 md 作为写作上下文。 | medium | warn | 0/2/15 | 0/0 | 2026-09-10 04:13 |
| dsh-sysbrief 系统理解简报工作流：解析 PRD/PDF、分批追问澄清目标系统并沉淀 BRIEF.md，最终打包可上传交付物 — DSH bundle。 | low | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-es DSH 使用 Everything(es.exe) 工具进行 NTFS 全盘搜索，使用 POSIX 风格路径进行交互，兼容 MSYS(git bash) 路径。 | low | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-agent-group-panel 飞书多助手机器人控制台：开启/关闭/重连守护进程、状态与最近动态、直达任务工作区 — DSH bundle。 | low | pass | 0/0/2 | 0/0 | 2026-09-10 04:13 |
| tolten-image-attach Attach an image to the DSH composer and the session model switches itself to a vision model — then restores your previous model when the image is removed. Material Design 3 button, native file picker, thumbnails. MIT. | low | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-agnes-media | low | pass | 0/0/3 | 0/0 | 2026-09-10 04:13 |
| dsh-gpt-image 控制已登录的网页版 ChatGPT 生成图片并下载到本地 — DSH bundle 插件。 | low | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-tidewatch DSH 动态插件：悬浮面板显示 DeepSeek API 高峰/低谷时段、倒计时与账户余额 | low | pass | 0/0/1 | 0/0 | 2026-09-10 04:13 |
| dsh-preset-md 给 DSH 助手赋予人格、灵魂与长期记忆：用 Markdown 定义伙伴的身份、性格、准则与记忆，自动写日记、自动更新记忆。Give your DSH assistant a soul, personality, and long-term memory. | medium | warn | 0/1/3 | 0/0 | 2026-09-10 04:13 |
| dsh-lexiforge DSH 语言模组（LangPack）框架插件：以 ZIP 配置包提供 A/B/C 三种处理引擎与复合管线、术语检索增强、流拦截与安全安装机制，内置市场分发与风险免责闸门。LexiForge is a community LangPack framework plugin for DSH. | low | pass | 0/0/6 | 0/0 | 2026-09-10 06:13 |
| dsh-process-panel dsh 侧栏「进程任务」面板：启动/停止/重启长时后台进程 + 实时日志，AI 侧配 sv_* 工具。A process panel plugin for DSH. | medium | warn | 0/1/3 | 0/0 | 2026-09-10 06:13 |
| dsh-files-pane In-browser files pane for the DSH Web GUI: a Session View tab that browses the host's files and reads them in place. · DSH 网页「文件」视图标签：两栏目录导航 + 就地阅读文件 | low | pass | 0/0/3 | 0/0 | 2026-09-10 08:13 |
| dsh-stack Enforced safety rails for stacked PRs in DSH — every sync, land, and cleanup is guarded, and "tests passed" is proven per commit with SHA-bound validation records. | medium | warn | 0/1/0 | 0/0 | 2026-09-10 08:13 |
| dsh-session-kit Manage DSH conversations from inside a conversation: new_conversation, rename_session, list_sessions, read_session, archive_session model tools plus official-slot UI actions | low | pass | 0/0/7 | 0/0 | 2026-09-10 08:13 |
| dsh-zhouli 《周礼》插件：给 DSH 提供带稳定坐标（篇序.职官序）的全文检索工具，含职官员额／职掌索引与 Kanripo 两本互校勘记，并附一套依六官法度行事的 agent 预设。引文可核，不凭记忆。 | low | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-plugin-tokensmarket Token Market provider bundle for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-totp 为 DSH 加一道由你掌控的访问验证。An access-verification step for DSH, under your control. | medium | warn | 0/1/13 | 0/0 | 2026-09-10 08:13 |
| dsh-plugins Personal dsh plugins for the DSH web profile (agent-monitor, quick-notes) | low | pass | 0/0/4 | 0/0 | 2026-09-10 08:13 |
| dsh_BetterInput | medium | warn | 0/3/14 | 0/0 | 2026-09-10 08:13 |
| dsh-token-usage 实时 Token 用量仪表盘 · Real-time token usage dashboard for DSH — live totals, filters by model/day/month/project, smooth trend chart. | low | pass | 0/0/5 | 0/0 | 2026-09-10 08:13 |
| dsh_plugin 用Harmess搞的自用插件合集 | low | pass | 0/0/4 | 0/0 | 2026-09-10 08:13 |
| dsh-plugin-preset-default-guard Repairs a stale agent-presets.default so New Session stops failing silently after a preset rename (DSH plugin). | low | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-pr-watch DSH plugin: reports what changed in your authored pull requests since your last check — merged, closed, or gone stale. | low | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-tps-meter 一款搭配 DSH 客户端的悬浮窗小工具，实时监测并显示会话的实时与平均 Token 输出速率（tokens/s） | low | pass | 0/0/5 | 0/0 | 2026-09-10 08:13 |
| dsh-keyless-search 免 API key 的多引擎搜索 provider for DSH (ctx.web)：真实浏览器 Google + 国际版 Bing + 中文 Bing，带代理自动探测、语言感知与浏览器空闲回收 | medium | warn | 0/1/4 | 0/0 | 2026-09-10 10:13 |
| dsh-effort-slider 为 DSH 添加支持 Off、Low、High、Max 档位的可拖动推理强度滑块。 | low | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-wecom DSH plugin: WeCom (WeChat Work) smart-robot integration over the long-connection (WebSocket) API. Per-session agents, idempotent msgid dedup, stream/markdown replies, media download/upload, whitelist, welcome/feedback events. | low | pass | 0/0/5 | 0/0 | 2026-09-10 10:13 |
| dsh-auto-continue dsh plugin: auto-continue after quota/rate-limit reset + peak/valley idle-task suspend/resume, with composer toggles and a status line. | low | pass | 0/0/0 | 0/0 | 2026-09-10 10:13 |
| dsh-prompt-refine DSH 提示词优化插件 —— 发送前点一下 ✨,模型结合上下文给出「补丁式」建议,勾选回填,不抢发送权。 | low | pass | 0/0/3 | 0/0 | 2026-09-10 10:13 |
| dsh-fork-relink DSH fork 伴随插件:fork 后自动重链子 agent 记录到新会话 / Auto-relink subagent records to a forked DSH session. Co-developed with AI. | low | pass | 0/0/4 | 0/0 | 2026-09-10 10:13 |
| dsh-plugin-gpt-load DSH plugin: serve every gpt-load model from one provider group, each model on its own wire protocol (OpenAI Chat Completions or Anthropic Messages), synced from /api/models | medium | warn | 0/4/7 | 0/0 | 2026-09-10 10:13 |
| dsh-update-status Read-only DSH Web version status and release-channel guidance plugin | low | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-upgrade-guard DSH 升级安全网：宿主升级后自动巡检插件兼容性，支持修复/禁用；宿主启动失败时由宿主外 supervisor 自动救援或回滚到上一个宿主版本。 | medium | warn | 0/2/9 | 0/0 | 2026-09-10 10:13 |
| dsh-rollback TRAE-style conversation rollback plugin for DSH | low | pass | 0/0/3 | 0/0 | 2026-09-10 10:13 |
| dsh-quick-replies dsh-quick-replies | low | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-chat-interaction Abstract interaction layer between DSH and IM platforms (Feishu, WeCom, ...). Channel-agnostic hub with proven interaction patterns (dedupe, instant ack, wait-reply, followup wakeup, scoring-based model routing, approval gate) plus pluggable adapters for Feishu and WeCom. | medium | warn | 0/7/1 | 0/0 | 2026-09-10 10:13 |
| dsh-tweaks 让 DSH更顺手的一套小改动：prompt-history / model-capabilities / turn-file-revert 三个独立插件 | low | pass | 0/0/0 | 0/0 | 2026-09-10 10:13 |
| dsh-cooldown-retry Patient auto-retry for DSH — reads the retry delay out of an upstream 429 capacity-cooldown message and waits it out, instead of giving up after two fast retries. | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-sidebar-image-zoom dsh plugin: zoomable, pannable image preview for the right-sidebar document pane (wheel zoom anchored at cursor, drag pan, fit / 1:1). / dsh 右侧边栏图片预览缩放插件 | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-zen-spoof | low | pass | 0/0/3 | 0/0 | 2026-09-10 12:13 |
| dsh-session-pilot Pilot your DSH conversations from inside a conversation: new_conversation, rename_session, list_sessions, read_session, archive_session model tools plus official-slot UI actions | low | pass | 0/0/7 | 0/0 | 2026-09-10 12:13 |
| dsh-price-monitor Session cost monitor for DSH — a dsh-better-sidebar tab (that sidebar is required; this package ships no UI of its own) showing per-turn, per-attempt token cost priced by official or manual plans | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| cordis-plugin-graph DSH/Cordis Web plugin: a zoomable relation graph of every loaded plugin (dependencies, resolved providers, Loader-tree nesting) as a Settings tab next to 'Plugin list'. | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| moqian-dsh-plugin-list DSH插件清单：收录 9 个开源 dsh-plugin —— 工具安全守卫、实时日志转发、会话复盘导出、Obsidian 长期记忆、学术文献检索、TODO 扫描、桌面通知提醒、飞花令、热梗弹幕。附仓库地址、npm 包名与安装命令。 | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-ssh-workspace-manager DSH web plugin: SSH hosts, workspace bindings, remote exec/sync/compose | critical | fail | 1/0/1 | 0/0 | 2026-09-10 12:13 |
| dsh-wei-sitecontrol Site controller for DSH: register websites/HTTP services and manage their lifecycle, git, and release-based SSH deploys — with server probing, stored deploy scripts, rollback and scheduled publishing. | medium | warn | 4/15/16 | 0/0 | 2026-09-10 12:13 |
| dsh-archived-sessions DSH 设置面板新增「已归档会话」页：列出全部已归档会话并一键恢复。Settings page listing archived sessions with one-click restore. | low | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-brand 方便魔改作者轻量化自定义商标 | low | pass | 0/0/4 | 0/0 | 2026-09-10 12:13 |
| dsh-peak-balance Peak/off-peak billing clock with live DeepSeek balance and per-turn cost above the dsh-tui prompt, plus an optional flashing peak-hour warning frame. | low | pass | 0/0/1 | 0/0 | 2026-09-10 12:13 |
| DSH-runner-rlm-tools-bsl Плагин DSH: MCP-сервер rlm-tools-bsl (анализ кода 1С) запускается и останавливается вместе с DSH | medium | warn | 0/4/7 | 0/0 | 2026-09-10 12:13 |
| dsh-code-security | low | pass | 0/0/0 | 0/0 | 2026-09-10 13:14 |
| dsh-resume-turn DSH 断点续接插件：模型回复因网络中断/超时半途失败时，自动把已生成的部分输出带进下一轮，让模型从中断处继续，而不是从零全量重跑。DSH plugin: on a mid-stream network failure, auto-resume the turn from its partial output instead of restarting from scratch. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-llm-opencode-go OpenCode Go models as a DSH provider, with session-affinity headers, a live model catalog, and a Web settings card | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| vision-exp-tile DSH插件：800×800 无损切块 + 坐标标注 + 直连 DeepSeek 视觉 API 识别聚合，专治大图看不清 | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-theme-inkstone | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-cost-pill DSH web plugin: session API cost + account balance, as a pill merged into the official composer stats row (费用 · 余额 · 缓存命中). | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| DSH-Metafolder-Plugin DSH Metafolder Plugin — visual meta-folders for the DSH sidebar workspaces, with drag and drop. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-notifications Desktop notifications and chimes for DSH Web | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-remote-dsh DSH plugin: a sidebar tab that takes over the whole page with another DSH instance's Web GUI, plus a remote session-state badge. 在侧边栏顶部加一个「远程」标签，整页切到另一台主机上的 DSH。 | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-tradewatcher DSH web plugin: 盯盘 market-dashboard sidebar tab — three quote strips with hover intraday charts, watchlist with industry alpha, ledger-driven portfolio P&L, A-share boards & detail drawer, host-side Eastmoney relay + read-only agent tools. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-update-audit Read-only update auditing for DSH profile plugins | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-markitdown Microsoft MarkItDown as a DSH tool: convert PDF, Word, Excel, PowerPoint, HTML, CSV, EPUB, or a URL into Markdown the model can read. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-chat-avatar 轻量级DSH聊天头像插件 | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-upgrade-rc1 Version-locked upgrade corridor for DSH plugins: dsh-v0.1.5-alpha.1 -> dsh-v0.1.5-rc.1 (card + skill + zero-dependency scanner) | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-autostart Windows 专用 DSH 插件:一键开机自启 + 一键重启 DSH 服务,全程无控制台窗口 | Windows-only DSH plugin for boot autostart and one-click restart | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-skills-anywhere Your skills, anywhere. Live Agent Skills provider for DSH: every agent's skill dirs (Claude Code, Codex, Cursor, 60+ more), Claude Code plugin marketplaces, and any GitHub skill repo. Zero copies, zero symlinks. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-ops DSH plugin operations: pre-boot health gate, failure attribution, dependency governance, and a web panel — the startup-lifecycle guard for the dsh plugin ecosystem. | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugins-store DSH plugin store - archived copies of the plugins installed in the local web profile, with manifest and profile snapshot | low | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-web-whale-maid DSH Web plugin — Anime maid whale desktop pet with satiety system and real-time LLM interaction | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-model-tester DSH plugin: one-click model availability testing (available / TPS / first token / elapsed) in the Models settings page | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-cursor-agent 在DeepSeek Hareness中引入Cursor Hareness，获得和Cursor一致的速度与体验。非官方调用cursor api，可能引入账号风险，谨慎使用。 | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-delete-chat | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-kaomoji Add Japanese kaomoji to DSH replies; prompt-injection plugin with a curated kaomojiya.org library. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-git-update-notifier 每天首次启动 dsh 时用 git 检测上游提交并在 Web GUI 中询问是否更新（适配源码 checkout，不改 npm 依赖） | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-vae-theme 《庐州月 · 许嵩》— DSH 国风水墨主题插件 | 夜色水墨长卷 · 金丝九宫格边框 · VAE 书法标志 · 全屏雨幕 · 国风歌词竖排轮播 | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-context-assembler Assembled context for DSH: a context tree over the session surface with per-node assemble modes (full / key / off), agent-authored presets, and a panel that decides what the model actually sees. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-file-explorer Workspace file explorer docked in the DSH sidebar — lazy file tree, Settings toggle, drag-to-resize. Also shipped as a single-session Cordis dynamic plugin. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-cost-meter Session spend for the DSH Web client: a stats-line pill that prices the durable tokenUsage projection with user-configured per-bucket unit prices. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-adrian-agents-group-work Group work for the DSH: turn one session into a room with a chair and several member agents that message each other and share a task list. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-image-studio Inline image card for DSH conversations: a bottom-left edit button that annotates, erases through a generated RGBA mask, and crops or resizes, then hands the edit back to the agent. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-memory-plus | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-paperlens | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-villager-hmm Play a Minecraft villager hmm whenever the model hums inside its reasoning chain. DSH plugin. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-remote-workspace Remote workspaces for DSH: run the agent on your server over SSH stdio. Zero file mirroring. | low | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
26 reports2026-09-10current96 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-10. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published