Daily security scan
Date · 2026-09-13 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report9 of 43 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 43 new entries: 9 with a conclusion, 7 queued, 0 failed (no conclusion), 27 low-risk not queued.
Data file updated 2026-10-30 07:30 (UTC+8); latest conclusion audited 2026-10-23 08:59 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| dsh-model-switch DSH 全局插件：用任意按键（含 spare 键、蓝牙小键盘、遥控器 HID 键盘等）**一键切换模型与思考强度**。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-13 00:13 |
| acryl-dsh-editor-plugin-cli | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 00:13 |
| acryl-dsh-editor-plugin-web | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 00:13 |
| dsh-restart-button DSH 设置 → General 一键重启按钮:重启宿主进程并自动刷新页面。One-click restart row for the DSH Web GUI (DSH 0.1.5+). | lowD↓ | medium | low | 0/6/11 | 0/0 | 2026-09-13 02:13 |
| dsh-upgrade-tools Keep your DSH profile current: six compatibility checks against any core version, inspect a plugin before installing it, snapshot and restore the whole profile, update only what has a newer release, recheck the deferred list, and probe what really loads and answers — imports, apply(), route handlers, shadowed UI, dead endpoints. Menu, CLI, JSON. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 02:13 |
| dsh-agent-toolface 工具面分档（DSH agent preset 行）：按证据化的 deny 集在 agent 作用域收窄模型可见工具，lean/full 一键切换 + 审计留痕，降低工具 schema 的固定上下文成本与工具选择稀释。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-13 02:13 |
| dsh-semantic-docs DSH 本地语义文档系统工具面：semantic_list/get/check/register + D1–D6 drift 判据（单一真源、文档随代码、未验证显式、留白诚实）。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 02:13 |
| dsh-wemedia-workbench Local-first media workbench for DSH: AI-assisted workflows, revision-bound reviews, native approvals and persistent jobs. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 04:14 |
| dsh-desktop-shell 把 DSH 的 WebUI 爆改成真正的桌面应用（DSH 插件）：WebView2 独立窗口 + 托盘常驻 + 无痕启动 + 就绪门控 + 调试模式；零 Electron 依赖，载荷仅 1.2MB。 | Turn the DSH Web UI into a real desktop app from inside DSH: WebView2 window, tray residency, silent start, debug console. No Electron. | medium | medium | queued | 0/2/9 | 0/0 | 2026-09-13 04:14 |
| dsh-ponytail Ponytail (lazy senior dev mode) for DSH: six skills, an always-on anti-over-engineering ruleset, and a Plugin configuration card. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-13 04:14 |
| dsh-msg9-kit 给每个 dsh workspace 一个 msg9.io 收件箱：Agent 用工具收发，GUI 点 ✉ 看同一份邮件 | one msg9.io inbox per dsh workspace | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-13 04:14 |
| dsh-billing-badge Billing season and account balance chip for the DSH web GUI: a native-looking pill after the cache-hit stat, with a panel on click. DSH 计费时段与余额插件 | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-13 04:14 |
| dsh-model-picker Enhanced model picker for the dsh web GUI — replaces the composer's model seat | lowD↓ | medium | low | 0/8/20 | 0/0 | 2026-09-13 04:14 |
| DSH-Prompt-Optimization DSH的提示词优化插件，帮助优化对话框中输入的提示词与项目要求 | low | low | not queued (low risk) | 0/0/7 | 0/0 | 2026-09-13 06:14 |
| dsh-github-sync 把 dsh 会话、插件清单与设置备份到私有 GitHub 仓库（纯 REST，无需 git 二进制），每台机器一个独立目录，可在另一台机器按整机 / 工作区 / 单会话恢复。 | mediumD↑ | low | medium | 0/0/7 | 0/0 | 2026-09-13 06:14 |
| dsh-round-rightclick | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-13 06:14 |
| dsh-background DSH Web GUI 的自定义背景插件：图片 / 动图 / 视频 / 内置极光渐变，磨砂玻璃质感，配浮动控制面板 | lowD↓ | medium | low | 0/7/36 | 0/0 | 2026-09-13 06:14 |
| dsh-console-hub 一个DSH Telnet/Raw TCP连接控制插件，典型场景为串口服务器和网络设备 | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-13 06:14 |
| dsh-plugin-photoshop 让 DSH 的 AI 直接驱动你本机的 Photoshop：批量抠图、批量处理、任意 PS 脚本。7 个工具、93 个操作、零依赖。 | mediumD↓ | high | medium | 4/2/1 | 0/0 | 2026-09-13 06:14 |
| dsh-custom-css DSH Web GUI 扩展：在 设置 → 通用 → 外观 下方增加一行自定义 CSS 编辑器（DevTools 风格编辑体验：补全 / 校验 / 规则面板） | lowD↓ | medium | low | 0/4/6 | 0/0 | 2026-09-13 06:14 |
| dsh-image-annotate Annotate a pending composer image in place (pen / box / arrow / typed text) and insert the PNG back next to the original. Minimal footprint: nothing in DSH UI is restyled, no host routes, no dependencies. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-13 08:13 |
| dsh-palimpsest DSH 宿主插件：让 AI 智能体在新会话里按需检索同一工作目录下的历史会话记忆（只读、不落盘、不注入）｜ DSH host plugin: on-demand recall of past sessions in the same working directory for AI agents | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-lifecycle-inspector Diagnose DSH plugin Fiber lifecycles, live Cordis Effects, and teardown outcomes | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-model-router Flash-only reasoning-effort routing for DSH, setting the DeepSeek flash model reasoning effort per step. The model never changes; effort max is opt-in. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-13 08:13 |
| dsh-cache-safe-tool-result A DSH plugin that keeps tool results cache-prefix safe: truncate a result before it first enters the session surface, and never rewrite a tool result a provider request has already delivered. | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-13 08:13 |
| dsh-session-rename DSH plugin: a model-facing rename_session tool, so the agent can retitle a session from inside the conversation. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-fold-it-up DSH Web 插件：强制折叠每一轮的工作过程，答案照常显示，历史轮次与上下文注入行一并折叠。 | lowD↓ | medium | low | 0/8/39 | 0/0 | 2026-09-13 08:13 |
| dsh-feishu-auth Feishu (Lark) OAuth login gate for the DSH web GUI — a signed session cookie in front of every HTTP request. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-13 08:13 |
| dsh-orbit Installable GitHub release mirror for @kasenri/dsh-orbit. Canonical source: KasenRi/dsh-orbit-browser-plugins. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-usage-unified Machine-wide DSH token usage statistics — trends, a custom date range, per-model bucket splits, call details, CSV/JSON export. 全机 DSH 用量统计：趋势 / 自定义区间 / 模型四桶 / 调用明细 / 导出，中英双语、浅深色。 | low | low | not queued (low risk) | 0/0/10 | 0/0 | 2026-09-13 10:13 |
| dsh-browser Installable GitHub release mirror for @kasenri/dsh-browser. Canonical source: KasenRi/dsh-orbit-browser-plugins. | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-13 10:13 |
| dsh-autofork Agent 忙时自动分叉会话：你新发的指令立刻在新会话里得到响应，旧会话留在后台跑完并把结果回注（DSH 插件） | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-13 10:13 |
| smart-session-title Automatic session titles for DSH, using the conversation model. English and Chinese documentation. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-kdocs-sidebar 金山文档 (WPS 云文档) 接入 DSH：侧边右栏面板 / 预览文件 / 引用文件和文件夹到对话 / 编辑器打开 | lowD↓ | medium | low | 0/1/3 | 0/0 | 2026-09-13 10:13 |
| dsh-character-presets DSH 角色预设集：10 个角色共用一套六层情感引擎——露娜 / 小喵 / 绯音 / 凛 / 芽衣 / 白夜 / 阿尔玛 / 小铃 / 三千代 / 灰 | medium | medium | queued | 0/3/0 | 0/3 | 2026-09-13 10:13 |
| dsh-role-cards DSH Web 插件：新建会话界面上的角色卡 + 工作区卡选择器（毛玻璃卡片墙 / 横向滚动 / 角色主题色 / 入场动画） | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-13 10:13 |
| pi-web-ui-plugins | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-13 10:13 |
| dsh-session-title-pattern 自动管理 dsh 会话标题，统一成「日期｜类型｜主题」的格式：类型与主题由模型对整段对话总结。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-plugin-subagent-roles DSH - Subagent Roles Plugin | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-13 12:13 |
| dsh-email-notify DSH 邮件通知插件：任务完成 / 工具等你授权 / 助手在等你回答时发邮件给你，配一个「离开模式」开关。设置全部集成在 harness 设置界面里。 | lowD↓ | medium | low | 0/4/18 | 0/0 | 2026-09-13 12:13 |
| dsh-llm-codex Codex route for DSH: local Codex CLI first, OpenAI-compatible API fallback | medium | medium | queued | 0/2/10 | 0/0 | 2026-09-13 12:13 |
| dsh-client-ui-wallpaper Changes the wallpaper of the dsh Web GUI. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-13 12:13 |
| dsh-browser-annotate Browser tools, Chrome DevTools Protocol, and right-click annotation for the DSH agent — plus the desktop shell that owns the real Chromium beside your session | medium | medium | queued | 0/2/6 | 0/0 | 2026-09-13 12:13 |
Dynamic audit results · new today (9 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Host half is a loopback sync API; token never leaks and path guards hold, but the plugin-install fallback spawns a shell with manifest-derived names, and the PAT sits in plaintext config.json.
- mediumPlugin install fallback spawns a shell with profile and package names taken from cloud manifests · src/index.js:879
- lowAccess token persisted in plaintext config.json via a write helper that sets no file mode · src/index.js:558
No backdoor or hidden exfiltration: the flagged eval/spawn sites are the plugin's documented Photoshop bridge; the residual risk is the unguarded arbitrary-ExtendScript tool photoshop_run_jsx.
- mediumphotoshop_run_jsx runs arbitrary agent-supplied ExtendScript in Photoshop, and can also read and execute any local .jsx file · lib/index.js:742
Runtime host code is defensive; all scanner warnings are confined to developer-only CDP/install tools, with one low token-handling gap when a non-loopback --url is supplied.
- lowDev token helper sends the GUI token to any caller-supplied base URL · tools/web-token.mjs:36
Careful host plugin: all file routes are name-validated, symlink-checked and behind a fail-closed connection fence; only a low-risk OS-handler launch remains.
- lowAuthenticated client can make the Host hand a plugin-written file to the OS default handler · lib/index.js
No critical/high/medium issues found; static warnings are local helper scripts with fixed commands, and remaining items are low-severity hardening gaps.
- lowInstaller recursively deletes plugin-named paths under user-supplied --dir · scripts/install.mjs:67
- lowSMTP authorization code is persisted in plaintext config · lib/config.js
- lowSMTP envelope/header values are not checked for CRLF before use · lib/smtp.js
Runtime half is inert; the browser half only shadows a Chat renderer and toggles DOM hidden attributes — no network, shell, or code execution. One low-risk dev-probe logging gap.
- lowDev probe documents a token-bearing URL on argv and prints localStorage values to stdout · tools/probe-routes.mjs:12
The three static-scan 'critical' hits are defended constructs (shell:false spawn with argv JSON, allowlisted PDF fetch, promisified execFile); only a low hardening gap remains.
- lowCLI executable path is taken from env/config and spawned without ownership or signature checks · dsh-kdocs-inside/src/client/cli.js
Only dev/diagnostic scripts were provided; they read local DSH credentials to forge loopback session cookies and probe a localhost gateway, but never leave 127.0.0.1 and are not in the published package.
- lowDiagnostic scripts read the browser-session HMAC secret to forge auth cookies · scripts/compare-row-styles.mjs:13
- lowRoute prober reads the local gateway API key and sends it to a hard-coded localhost gateway · tools/model-probe/probe-named.mjs:15
Loopback-fenced restart plugin; SIGTERM/spawn operations target only its own process and argv, restart DoS is intended and auth-gated.
- lowRestart RPC is unrated-limited and delayMs is caller-controlled, allowing authenticated loopback restart loops · src/index.ts:348
- lowRestart/status responses and 500 body expose internal pid, boot id and tmp log paths · lib/index.js
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 23,757 in-scope entries (23,469 scanned + 288 pending).
Static scan for reference: low 23,302 · medium 0 · high 166 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
74 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-13. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2882 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published