Daily security scan
Date · 2026-09-12 (UTC — plugins first indexed that day)
84
added
0
critical
29
medium
55
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-locale-tr Turkish (Türkçe) language pack for DSH — client plugin registering the tr UI locale. | low | pass | 0/0/0 | 0/0 | 2026-09-12 00:14 |
| dsh-restart-btn DSH 重启按钮插件：设置页一键重启 dsh web，复用桌面启动器机制（node + lib/bin.js、日志重定向、TCP 就绪轮询），修复非 ASCII 路径下计划任务静默失败的问题。 | medium | warn | 0/3/7 | 0/0 | 2026-09-12 00:14 |
| dsh-typst-preview Live Typst preview in the DSH Web UI's native right Sidebar, rendered by a per-file tinymist preview server proxied over the app origin. | low | pass | 0/0/9 | 0/0 | 2026-09-12 02:14 |
| dsh-keep-going Restart DSH, then carry on: the answer in progress finishes, DSH closes in an orderly way, and every conversation the restart interrupted is woken. | medium | warn | 0/1/2 | 0/0 | 2026-09-12 02:14 |
| dsh-usage-dock DSH web plugin: per-session CNY cost pill that renders into the composer's shipped statistics row | low | pass | 0/0/5 | 0/0 | 2026-09-12 02:14 |
| dsh-plugins DSH web plugins: a model-generated next prompt in the composer, and an integrated terminal for chat code blocks. | medium | warn | 0/3/3 | 0/0 | 2026-09-12 02:14 |
| dsh-price-phase DSH Web GUI 峰谷时段徽标：显示 DeepSeek API 当前处于高峰还是空闲时段（周一至周五 9-12/14-18 为高峰，周末全天半价），含距下次切换的倒计时 | low | pass | 0/0/0 | 0/0 | 2026-09-12 02:14 |
| dsh-wayfinder-ui DSH plugin: spawns one live session per ready Wayfinder task and draws the dependency map in the chat GUI | low | pass | 0/0/2 | 0/0 | 2026-09-12 02:14 |
| dsh-luna-preset DSH 的「露娜模式」agent preset：魔界小恶魔人设 + 六层情感引擎（emotion_sense），能力等同内置 standard preset | medium | warn | 0/3/0 | 0/3 | 2026-09-12 02:14 |
| dsh-imgview DSH 对话内图片卡插件：show_image 工具 + 同源图片路由 + 可点击放大灯箱卡片 | low | pass | 0/0/0 | 0/0 | 2026-09-12 02:14 |
| dsh-zhihu 知乎 CLI 连接插件 for DSH：包装本机 pyzhihu-cli 为 zhihu_* 工具（18 个，写操作默认关闭），附 Web 可视化入口（侧栏「知」球 + 设置页卡片） | low | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-llm-balance-siderbar DSH plugin for querying LLM service provider usage: reads each configured provider's remaining balance or subscription quota and shows it in an always-visible card in the web GUI | low | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-conversation-bindings Peer communication, supervision, and tool guardrails between conversations in one DSH process. | low | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-header-balance DSH Web GUI 会话页头部余额芯片：经宿主侧 Remote 用你的 API Key 查询 DeepSeek 账户余额，点击跳转充值，悬停可见赠送/充值拆分。API Key 不进浏览器。 | low | pass | 0/0/4 | 0/0 | 2026-09-12 04:12 |
| dsh-AGE dsh-AGE 是一个**无聊插件**，用来在 deepseek-harness 的网页界面里模拟「安全组件扫描时卡顿」的体验。 | low | pass | 0/0/1 | 0/0 | 2026-09-12 04:12 |
| dsh-notify DSH plugin: Windows desktop notifications + sound when an agent turn finishes or the harness is waiting for you. | medium | warn | 0/1/0 | 0/0 | 2026-09-12 04:12 |
| dsh-session-topics Sidebar topic grouping plugin for DSH - client-only, zero host-service dependency, with offline smoke tests. | low | pass | 0/0/3 | 0/0 | 2026-09-12 04:12 |
| dsh-prompt-boost-pro Enhance the composer draft before sending: a sparkle button in the DSH web GUI rewrites your prompt in a structured or light mode, with an original-versus-enhanced preview. | low | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-deepseek-tide DSH Web GUI plugin: DeepSeek API peak/valley pricing indicator in the session header | low | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-openspec 把 OpenSpec（规范驱动开发）接入 DSH：内置六个 agent skill，并从插件自身依赖解析 openspec CLI，无需全局安装、无需按项目拷贝 .agents/skills ｜ OpenSpec (spec-driven development) for DSH: six bundled agent skills + CLI resolution from the plugin dependency. No global install. | medium | warn | 0/2/8 | 0/0 | 2026-09-12 04:12 |
| dsh-restart One-click restart for DSH: a web button (plus a dsh_restart agent tool) hands the relaunch to a detached helper, the page reconnects by itself, and a recovery console shows the boot errors when the new host fails | medium | warn | 0/2/6 | 0/0 | 2026-09-12 04:12 |
| dsh-model-fold Model picker grouped by source for DSH: source list with a slide-in side panel (or inline fold) for each provider's models | low | pass | 0/0/3 | 0/0 | 2026-09-12 04:12 |
| dsh-live-model-catalog DSH 插件：让 llm-pi-ai 路由（含自定义服务商）的模型目录与推理档位跟着端点更新——补上新模型与 contextWindow/maxTokens/input/reasoningEfforts，端点给出推理信息即写入思考档位，并修好「获取可用模型」按钮；只走官方 settings 接缝，不打补丁、可卸载。| DSH plugin: keeps llm-pi-ai routes (hand-written and custom providers included) in step with their own /models: new models, capabilities, reasoning levels, live fetch button. No patching. | low | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-remote-ssh-worktree A DSH plugin that runs the harness's file, shell, and terminal tools inside a git worktree on a remote machine over SSH. The remote agent installs itself: it ships as a static Rust binary from GitHub Releases, listens on a random loopback port, and updates when the plugin does. | low | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-consumer-audit Audit a DSH profile for capabilities nothing consumes, and record completion claims with the evidence that supports them. | medium | warn | 0/2/16 | 0/0 | 2026-09-12 04:12 |
| dsh-weixin-minigame Preview, develop, and debug (through logs and screenshots) WeChat Mini Games inside the dsh Web GUI | low | pass | 0/0/4 | 0/0 | 2026-09-12 04:12 |
| dsh-project-handbook DSH plugin that generates a company-grade project handover and onboarding handbook from repository evidence. | low | pass | 0/0/2 | 0/0 | 2026-09-12 06:11 |
| dsh-doctor DSH 诊断插件：把 home、进程、端口、大 session、版本问题收成一份可粘贴的报告。不替代 Desktop / TUI。 | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-safety-restart Safe, seamless restart for DSH: the agent can restart the host itself and resume afterwards. Four gates (restart-loop breaker, other sessions mid-turn, unresolvable profile bundles, unavailable app.relaunch) refuse with a reason instead of forcing it. | medium | warn | 0/3/7 | 0/0 | 2026-09-12 06:11 |
| dsh-clock-context Give your DSH agent a clock: injects the current date and time into the runtime context on every turn, so the agent can read the time instead of inferring it. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-open-terminal dsh-TUI /term: open a system terminal in a workspace folder — blank opens the working-directory root, a fragment fuzzy-matches folders. | medium | warn | 0/1/2 | 0/0 | 2026-09-12 06:11 |
| dsh-web-search-order DSH plugin: ordered web-search provider fallback (omp-style webSearchOrder) over the providers already registered in ctx.web | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_report ZA Research report stage — academic paper writing for asset pricing + ML/DL research. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-plugin-screenshot-ask DSH 截图提问插件：原生框选截图直接进输入框，全程不落盘（DSH plugin, Windows） | medium | warn | 0/3/7 | 0/0 | 2026-09-12 06:11 |
| ZA_data ZA Research data stage — data discovery and quality assessment for asset pricing + ML/DL research. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_literature ZA Research literature stage — search, synthesis, and citation-chain tracking for asset pricing + ML/DL research. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_ppt ZA Research PPT stage — presentation generation (Beamer/Quarto) from the paper. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_analysis ZA Research analysis stage — end-to-end model training and estimation for asset pricing + ML/DL research. | low | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-voice-input Voice input for DSH: a microphone seat in the composer and a Web settings page that transcribes through the browser or any OpenAI-compatible /audio/transcriptions endpoint, with a fully offline local Whisper server included. | medium | warn | 0/9/15 | 0/0 | 2026-09-12 06:11 |
| dsh-rule-lens 规则透镜（RuleScope Lens）— DSH 本地插件：AGENTS.md/rules 加载可视化、预算治理、硬拦截、Lint、遵守率 | Rule visibility, budget governance & hard guards for DSH | low | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-creative-studio Portable AI image-retouching and video-editing skill pack for DSH: matting with quality tiers, inpainting retouch, text/logo compositing, batch platform exports, footage review, timeline editing. | low | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-plugin-migration-workbuddy Migrate WorkBuddy sessions, memories, MCP drafts, and automation tasks into DSH — preview-first, read-only on the source | low | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-session-notice DSH 会话 Bark 通知插件：会话头部按钮切换「会通知」状态（持久化），轮次停止时经 Bark 推送到手机；设置页配 server/key 并提供 ping→push→register 三步连通测试 | low | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-live-data 实时数据聚合插件（10 个工具 / 8 个免密钥公开接口）：汇率、天气、npm、GitHub、PyPI、B站、A股、大盘、金价（元/克）、IP 归属地。All-in-one live-data plugin for DSH. | low | pass | 0/0/7 | 0/0 | 2026-09-12 08:12 |
| dsh-qqbot-dafeiyu QQ Bot IM channel plugin for DSH: per-peer sessions, image generation, TTS voice replies, attachments. | low | pass | 0/0/0 | 0/0 | 2026-09-12 08:12 |
| dsh-office-toolkit DSH 宿主插件：给 AI 智能体增加读写 Word/Excel 的工具（docx/xlsx/xls/doc/rtf/odt，纯 JS 跨平台）｜ DSH host plugin: Word/Excel read & write tools for AI agents | medium | warn | 0/1/1 | 0/0 | 2026-09-12 08:12 |
| dsh-conversation-link DSH对话互通插件：同一进程里的对话可以互相发现、直接发消息、盯进度、设护栏——不用先绑定，也不用开子代理。多对话协作 / 跨会话通信 / 监工。Peer messaging, supervision & tool guards between conversations. | low | pass | 0/0/2 | 0/0 | 2026-09-12 08:12 |
| dsh-network Let DSH access the internet seamlessly. | medium | warn | 0/1/2 | 0/0 | 2026-09-12 08:12 |
| dsh-plugins-hub Third-party plugin hub for DSH — official/community grouped plugin list inside Settings → Plugins, with update checks, one-click update, uninstall, and live enable/disable. | low | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-astrbot-ingress HTTP ingress plugin: let AstrBot (QQ / OneBot / official IM) drive a local DSH agent | medium | warn | 0/3/6 | 0/0 | 2026-09-12 08:12 |
| dsh-image-settings User-tunable inline image display for dsh web sessions: larger, auto-unrolled read_image tool view with an Image settings card | low | pass | 0/0/0 | 0/0 | 2026-09-12 08:12 |
| dsh-deepseek-web DSH 插件：把 chat.deepseek.com 网页版接进 DSH（deepseek_web_ask / deepseek_web_analyze_lines / deepseek_web_status + 一键登录面板）。纯 Node，MIT License。 | medium | warn | 0/4/9 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-codex-ui Codex-style sidebar skin for the DSH Web GUI: a Projects + Recents browser, a New chat row that starts a session without picking a project and allocates its own working directory, and a draft composer that writes nothing until you send. | low | pass | 0/0/7 | 0/0 | 2026-09-12 08:12 |
| dsh-api-balance DSH 桌面插件：在桌面角落常驻一个置顶小窗，实时显示 DeepSeek API 余额与本次开机消耗的 token。七套配色、可用自己的图片当背景、× 收进托盘。 | medium | warn | 0/1/3 | 0/0 | 2026-09-12 08:12 |
| dsh-turn-chime DSH Web 插件：任务完成后播放提示音（可开关、可调音量、可上传自己的音频；内置提示音由脚本合成） | low | pass | 0/0/3 | 0/0 | 2026-09-12 08:12 |
| dsh-session-title-refresh DSH 会话标题插件：在会话菜单中根据对话内容重新总结标题，零运行时依赖 | low | pass | 0/0/2 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-multi-root-workspace DSH 外部插件：把工作区可写范围从一个主根扩展为「主根 + N 个附加根」，不改上游任何包。Out-of-tree DSH plugin widening the workspace sandbox scope to a primary root plus N additional roots, with a root registry, a /workspace-folders command and a browser panel. | low | pass | 0/0/15 | 0/0 | 2026-09-12 08:12 |
| dsh-devops GitLab + Kubernetes monitoring plugin for DSH — track CI/CD pipelines and K8s cluster health in one place. | low | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-tunnel-plugin 把本机的 DSH Web GUI 安全地发布到公网， 让你在外面用浏览器就能用家里那台机器。 | medium | warn | 1/10/28 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-tool-management 一站式管理 DSH 的 MCP 服务与 Skills：工具级开关、密钥打码、技能回收站 | Unified MCP & skills manager for DSH: per-tool toggles, secret masking, skill trash | medium | warn | 0/5/8 | 0/0 | 2026-09-12 10:12 |
| dsh-usage-stats DSH 用量统计插件：本地 SQLite 账本，按天 / 服务商 / 模型统计 token 用量 | low | pass | 0/0/2 | 0/0 | 2026-09-12 10:12 |
| dsh-experience-map dsh-experience-map | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-team-rooms Team rooms for DSH: persistent shared rooms across independent sessions - a message bus, a shared task board and a timeline. Extracted from dsh-background-agents, whose background-agent half is superseded by DSH's native continuable subagents. | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-ppt-maker DSH web plugin: adds a PPT 制作 entry to the composer + menu that kicks off a bundled, self-contained PPT workflow prompt. One menu pick, one short message, no repeated approval prompts. | medium | warn | 1/0/3 | 0/0 | 2026-09-12 10:12 |
| dsh-edu The educational version of DSH | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-image-guard DSH plugin: trims historical images to the provider image budget before sending, learns the image cap from HTTP 400 responses, and retries with fewer images. Reduces vision-token usage and prevents image-heavy sessions from failing. | medium | warn | 0/3/9 | 0/0 | 2026-09-12 10:12 |
| dsh-mermaid-comm DSH plugin: Make AI default to Mermaid diagrams in development conversations — prompt guidance, mermaid_validate syntax check, and output safety gate. Rendering via dsh-mermaid. | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-longtext-input DSH 长文本输入插件：把超长正文写进工作区 .dsh-longtext/ 下的 md 文件，输入框只留一个 @ 引用，保持聊天界面简洁。支持 Wallpaper Engine 毛玻璃。 | medium | warn | 0/3/1 | 0/0 | 2026-09-12 10:12 |
| dsh-composer-tabs 按照插件分类添加tab页到技能菜单里 | medium | warn | 0/1/2 | 0/0 | 2026-09-12 10:12 |
| dsh-hmos-skills HarmonyOS (鸿蒙) development skills for DSH — 39 official hmos-* skill bundles ported to the DSH skill registry: ArkTS/ArkUI, multi-device adaptation, Kit integration, and DFX crash/leak analysis. | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| Orderzx A live, stealth-capable, autonomous Chrome inside your DSH conversation — set-of-marks vision, Chrome-for-Android desktop-view parity, human takeover, 4-tier CAPTCHA handoff, standalone panel for any device (dsh-browser plugin). | medium | warn | 0/2/5 | 0/0 | 2026-09-12 10:12 |
| dsh-later DSH 会话内定时发送插件 | low | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-image-router DSH plugin: digest prompt images through a vision model and expose a describe_image tool — without ever changing the session's model. | low | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-plugin-vllm-ascend-profiler DSH plugin: parse vLLM-Ascend / Ascend NPU profiling artifacts, visualize Host/Device swimlanes plus cost shares, and emit structured, phase-aware optimization advice with Markdown/PDF export. | medium | warn | 0/2/7 | 0/0 | 2026-09-12 12:12 |
| dsh-token-live Composer readouts for the DSH: CJK-weighted draft token count, session spend at official peak/idle rates, context occupancy, and what the same usage would have cost on the costliest other model; client-only, with no host half and no credential access. | low | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-ide-lite Lightweight IDE-in-the-sidebar plugin for the dsh web GUI: workspace file tree, agent-change review (accept/reject + undo), full editing with diff and rendered markdown, plus an integrated terminal view. | low | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-launch-in-one-click A DSH plugin for Windows: writes a self-contained one-click launcher, and refuses to start a second instance when the target port already serves one. / 一个 Windows 专用的 DSH 插件：写入自包含的一键启动器；目标端口已有 Harness 实例时拒绝启动第二个。 | medium | warn | 0/3/15 | 0/0 | 2026-09-12 12:12 |
| dsh-delete-session Real deletion for DSH Web conversations: a session-row menu action and a Workspaces-header batch dialog; removes each session's log directory and projection cache. 给 DSH Web 侧栏补上真正的会话删除：右键菜单删单条、区头批量删多条，删掉日志目录与投影缓存。 | low | pass | 0/0/2 | 0/0 | 2026-09-12 12:12 |
| dsh-mobile-topbar DSH plugin: turns the sidebar into a compact top bar on mobile screens to save space | low | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-project-memory | medium | warn | 0/1/6 | 0/0 | 2026-09-12 12:12 |
| dsh-tidecost | low | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| I-am-Yuike 一个猫娘人格扮演插件（伪破限），去除dsh强制加入的附加提示词，只附带工具链和猫娘基准人格的插件 | medium | warn | 0/3/3 | 0/3 | 2026-09-12 12:12 |
| Thalamus θάλαμος —— 荷马史诗里屋子里最深处的那个房间，也是大脑中接住情绪的那枚丘脑。AI 陪伴微信机器人：DSH 插件，让一个独立的微信号成为一个有性格、有生活、对你特殊的她。 | medium | warn | 0/4/8 | 0/0 | 2026-09-12 12:12 |
| dsh-opencodego 在DSH中支持opencode支持GO订阅，包括模型获取以及能力设置、请求头自适应等 | low | pass | 0/0/3 | 0/0 | 2026-09-12 12:12 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
28 reports2026-09-12current84 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-12. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published