Daily security scan
Date · 2026-09-11 (UTC — plugins first indexed that day)
31
added
0
critical
12
medium
19
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-mcp-lazy Lazy MCP gateway for DSH: one stable proxy tool instead of N tool schemas, servers connect on first use and idle out, metadata cached to disk. | low | pass | 0/0/4 | 0/0 | 2026-09-11 00:14 |
| dsh-backup-migrator Plugin environment backup and migration for DSH | medium | warn | 0/1/2 | 0/0 | 2026-09-11 00:14 |
| dsh-skill-recommender Session-profile skill recommender for DSH | medium | warn | 0/1/9 | 0/0 | 2026-09-11 00:14 |
| dsh-aliyun-mcp Alibaba Cloud OpenAPI MCP connection for DSH | low | pass | 0/0/6 | 0/0 | 2026-09-11 00:14 |
| dsh-goofish-mcp Xianyu (Goofish) read-only monitoring MCP for DSH | low | pass | 0/0/3 | 0/0 | 2026-09-11 00:14 |
| dsh-feishu-mcp Feishu (Lark) OpenAPI MCP connection for DSH | medium | warn | 0/3/10 | 0/0 | 2026-09-11 00:14 |
| dsh-zsxq Knowledge Planet (zsxq) integration for DSH | low | pass | 0/0/6 | 0/0 | 2026-09-11 00:14 |
| dsh-plugins Independent DSH plugins: cost metrics + browser_use tool. One pnpm monorepo, independently installable and vendable. | medium | warn | 0/1/11 | 0/0 | 2026-09-11 00:14 |
| dsh-npm NPM registry management for DSH | medium | warn | 0/3/8 | 0/0 | 2026-09-11 00:14 |
| QQ.dsh-qqbot 基于DSH-QQBOT项目的dsh-qqbotGPT优化版本 | low | pass | 0/0/0 | 0/0 | 2026-09-11 00:14 |
| dsh-wallpaper-position dsh-dream-skin satellite: per-image wallpaper position (X/Y px) settings row. Vibe-coded. | low | pass | 0/0/5 | 0/0 | 2026-09-11 02:13 |
| dsh-whale-tools dsh-whale-widget satellite: replace the whale mascot with any image (auto cutout) + restart button + heartbeat. Vibe-coded. | medium | warn | 0/5/8 | 0/0 | 2026-09-11 02:13 |
| dsh-local-dba A local database-administration (DBA) plugin for [DSH](https://github.com/deepseek-ai/deepseek-harness). It ships as a Cordis plugin bundle that registers a set of `db_*` model-facing tools, letting the agent query, inspect schema, run DDL/DML, back up/restore and analyze slow queries against **MySQL / MariaDB** and **PostgreSQL**. | medium | warn | 0/2/7 | 0/0 | 2026-09-11 02:13 |
| dsh-sakurafrp dsh-mobile satellite: manage the SakuraFrp phone-desktop link from DSH UI (status, gateway toggle, pairing QR, devices, self-heal). Vibe-coded. | medium | warn | 0/9/15 | 0/0 | 2026-09-11 02:13 |
| dsh-imagegen-zhenzhen DSH image-generation plugin with native support for zhenzhen-image style async task gateways (submit + poll), including multi-reference image-to-image. Fork of @dickpy/dsh-imagegen. | low | pass | 0/0/1 | 0/0 | 2026-09-11 02:13 |
| dsh-newwindows ⚡ Summary-free context window rollover, model-authored notes, and scoped history lookup plugin for DSH. Inspired by OpenAI Codex. | low | pass | 0/0/0 | 0/0 | 2026-09-11 02:13 |
| dsh-provider-headers Per-provider request headers in the DSH Models settings page, with per-conversation ${sessionId} expansion. | low | pass | 0/0/1 | 0/0 | 2026-09-11 02:13 |
| dsh-reveal-fix Fix DSH's "reveal in file manager" silently doing nothing on Windows. User-space plugin — survives dsh upgrades, no core files patched. | medium | warn | 0/1/0 | 0/0 | 2026-09-11 02:13 |
| dsh-task-board DSH Web GUI 的任务看板插件：侧边栏入口 + 五列看板，任务经 DSH 会话真实执行，host 端持久化并跨设备实时同步。Task board plugin for the DSH web GUI. | low | pass | 0/0/0 | 0/0 | 2026-09-11 02:13 |
| dsh_superpowers Superpowers for the DSH: a dsh plugin that registers the Superpowers skills as a skill catalog and injects the using-superpowers bootstrap into the system prompt. | medium | warn | 0/5/13 | 0/0 | 2026-09-11 02:13 |
| dsh-find-plugin Find DSH plugins from inside the agent - live GitHub dsh-plugin topic search + the curated awesome-dsh-plugin list, with token auth, rate-limit resilience and offline fallback. Fork of awesome-dsh-plugin/dsh-find-plugin. | low | pass | 0/0/6 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-desk DSH 插件管家：用人话说明每个插件是做什么的，一键停用/启用（热生效），安全卸载。Settings → Plugins → 插件管家 | low | pass | 0/0/4 | 0/0 | 2026-09-11 04:13 |
| dsh-livebench-panel DSH web plugin: a LiveBench tab in the Trajectory view. Run LiveBench evaluations against every model configured in the DSH and read scores in place. | medium | warn | 0/3/6 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-use-images 再dsh里面可以使用图片api | low | pass | 0/0/1 | 0/0 | 2026-09-11 04:13 |
| dsh-loomy-connect Use the models that ship with the Loomy desktop app inside DSH — no API key. Also adds a Settings card showing the signed-in account and Loomy credits (permanent + daily gift). | medium | warn | 0/3/16 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-reasoning-efforts 给 DSH 的第三方中转模型补上「推理等级」选择器 —— 和官方模型在聊天框里的体验完全一致。 | low | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| dsh-bg-new DSH 网页界面换背景：侧栏「壁纸」按钮弹出右侧抽屉，支持系统预设/纯色/渐变/图片/视频，滚轮+拖动小图同时管缩放与定位，毛玻璃质感，本地媒体伺服不走云端。DSH web background & wallpaper plugin with drawer UI, glassmorphism and local media serving. | low | pass | 0/0/3 | 0/0 | 2026-09-11 04:13 |
| dsh-clipboard-menu Adds a right-click cut/copy/paste/select-all menu to DSH composer inputs. | low | pass | 0/0/3 | 0/0 | 2026-09-11 04:13 |
| dsh-research-kit dsh-research-kit 是一个 浏览器侧 DSH 插件：它维护科研资源目录、把工作流和用户参数组装成可编辑 Prompt，并由 DSH 当前会话负责实际发送与执行。 | low | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-session-delete 删除dsh的会话内容 | low | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| ai-memory Personal AI memory semantic layer SDK (Rust + SQLite) — short/mid/long-term memory with hybrid recall | low | pass | 0/0/1 | 0/0 | 2026-09-11 04:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
27 reports2026-09-11current31 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-11. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published