Daily security scan
Date · 2026-09-13 (UTC — plugins first indexed that day)
43
added
0
critical
15
medium
28
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-model-switch DSH 全局插件：用任意按键（含 spare 键、蓝牙小键盘、遥控器 HID 键盘等）**一键切换模型与思考强度**。 | low | pass | 0/0/2 | 0/0 | 2026-09-13 00:13 |
| acryl-dsh-editor-plugin-cli | low | pass | 0/0/0 | 0/0 | 2026-09-13 00:13 |
| acryl-dsh-editor-plugin-web | low | pass | 0/0/0 | 0/0 | 2026-09-13 00:13 |
| dsh-restart-button DSH 设置 → General 一键重启按钮:重启宿主进程并自动刷新页面。One-click restart row for the DSH Web GUI (DSH 0.1.5+). | medium | warn | 0/6/11 | 0/0 | 2026-09-13 02:13 |
| dsh-upgrade-tools Keep your DSH profile current: six compatibility checks against any core version, inspect a plugin before installing it, snapshot and restore the whole profile, update only what has a newer release, recheck the deferred list, and probe what really loads and answers — imports, apply(), route handlers, shadowed UI, dead endpoints. Menu, CLI, JSON. | low | pass | 0/0/0 | 0/0 | 2026-09-13 02:13 |
| dsh-agent-toolface 工具面分档（DSH agent preset 行）：按证据化的 deny 集在 agent 作用域收窄模型可见工具，lean/full 一键切换 + 审计留痕，降低工具 schema 的固定上下文成本与工具选择稀释。 | low | pass | 0/0/1 | 0/0 | 2026-09-13 02:13 |
| dsh-semantic-docs DSH 本地语义文档系统工具面：semantic_list/get/check/register + D1–D6 drift 判据（单一真源、文档随代码、未验证显式、留白诚实）。 | low | pass | 0/0/0 | 0/0 | 2026-09-13 02:13 |
| dsh-wemedia-workbench Local-first media workbench for DSH: AI-assisted workflows, revision-bound reviews, native approvals and persistent jobs. | low | pass | 0/0/0 | 0/0 | 2026-09-13 04:14 |
| dsh-desktop-shell 把 DSH 的 WebUI 爆改成真正的桌面应用（DSH 插件）：WebView2 独立窗口 + 托盘常驻 + 无痕启动 + 就绪门控 + 调试模式；零 Electron 依赖，载荷仅 1.2MB。 | Turn the DSH Web UI into a real desktop app from inside DSH: WebView2 window, tray residency, silent start, debug console. No Electron. | medium | warn | 0/2/9 | 0/0 | 2026-09-13 04:14 |
| dsh-ponytail Ponytail (lazy senior dev mode) for DSH: six skills, an always-on anti-over-engineering ruleset, and a Plugin configuration card. | low | pass | 0/0/1 | 0/0 | 2026-09-13 04:14 |
| dsh-msg9-kit 给每个 dsh workspace 一个 msg9.io 收件箱：Agent 用工具收发，GUI 点 ✉ 看同一份邮件 | one msg9.io inbox per dsh workspace | low | pass | 0/0/4 | 0/0 | 2026-09-13 04:14 |
| dsh-billing-badge Billing season and account balance chip for the DSH web GUI: a native-looking pill after the cache-hit stat, with a panel on click. DSH 计费时段与余额插件 | low | pass | 0/0/3 | 0/0 | 2026-09-13 04:14 |
| dsh-model-picker Enhanced model picker for the dsh web GUI — replaces the composer's model seat | medium | warn | 0/8/20 | 0/0 | 2026-09-13 04:14 |
| DSH-Prompt-Optimization DSH的提示词优化插件，帮助优化对话框中输入的提示词与项目要求 | low | pass | 0/0/7 | 0/0 | 2026-09-13 06:14 |
| dsh-github-sync 把 dsh 会话、插件清单与设置备份到私有 GitHub 仓库（纯 REST，无需 git 二进制），每台机器一个独立目录，可在另一台机器按整机 / 工作区 / 单会话恢复。 | low | pass | 0/0/7 | 0/0 | 2026-09-13 06:14 |
| dsh-round-rightclick | medium | warn | 0/1/5 | 0/0 | 2026-09-13 06:14 |
| dsh-background DSH Web GUI 的自定义背景插件：图片 / 动图 / 视频 / 内置极光渐变，磨砂玻璃质感，配浮动控制面板 | medium | warn | 0/7/36 | 0/0 | 2026-09-13 06:14 |
| dsh-console-hub 一个DSH Telnet/Raw TCP连接控制插件，典型场景为串口服务器和网络设备 | medium | warn | 0/1/7 | 0/0 | 2026-09-13 06:14 |
| dsh-plugin-photoshop 让 DSH 的 AI 直接驱动你本机的 Photoshop：批量抠图、批量处理、任意 PS 脚本。7 个工具、93 个操作、零依赖。 | medium | warn | 4/2/1 | 0/0 | 2026-09-13 06:14 |
| dsh-custom-css DSH Web GUI 扩展：在 设置 → 通用 → 外观 下方增加一行自定义 CSS 编辑器（DevTools 风格编辑体验：补全 / 校验 / 规则面板） | medium | warn | 0/4/6 | 0/0 | 2026-09-13 06:14 |
| dsh-image-annotate Annotate a pending composer image in place (pen / box / arrow / typed text) and insert the PNG back next to the original. Minimal footprint: nothing in DSH UI is restyled, no host routes, no dependencies. | low | pass | 0/0/3 | 0/0 | 2026-09-13 08:13 |
| dsh-palimpsest DSH 宿主插件：让 AI 智能体在新会话里按需检索同一工作目录下的历史会话记忆（只读、不落盘、不注入）｜ DSH host plugin: on-demand recall of past sessions in the same working directory for AI agents | low | pass | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-lifecycle-inspector Diagnose DSH plugin Fiber lifecycles, live Cordis Effects, and teardown outcomes | low | pass | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-model-router Flash-only reasoning-effort routing for DSH, setting the DeepSeek flash model reasoning effort per step. The model never changes; effort max is opt-in. | low | pass | 0/0/1 | 0/0 | 2026-09-13 08:13 |
| dsh-cache-safe-tool-result A DSH plugin that keeps tool results cache-prefix safe: truncate a result before it first enters the session surface, and never rewrite a tool result a provider request has already delivered. | low | pass | 0/0/6 | 0/0 | 2026-09-13 08:13 |
| dsh-session-rename DSH plugin: a model-facing rename_session tool, so the agent can retitle a session from inside the conversation. | low | pass | 0/0/0 | 0/0 | 2026-09-13 08:13 |
| dsh-fold-it-up DSH Web 插件：强制折叠每一轮的工作过程，答案照常显示，历史轮次与上下文注入行一并折叠。 | medium | warn | 0/8/39 | 0/0 | 2026-09-13 08:13 |
| dsh-feishu-auth Feishu (Lark) OAuth login gate for the DSH web GUI — a signed session cookie in front of every HTTP request. | low | pass | 0/0/4 | 0/0 | 2026-09-13 08:13 |
| dsh-orbit Installable GitHub release mirror for @kasenri/dsh-orbit. Canonical source: KasenRi/dsh-orbit-browser-plugins. | low | pass | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-usage-unified Machine-wide DSH token usage statistics — trends, a custom date range, per-model bucket splits, call details, CSV/JSON export. 全机 DSH 用量统计：趋势 / 自定义区间 / 模型四桶 / 调用明细 / 导出，中英双语、浅深色。 | low | pass | 0/0/10 | 0/0 | 2026-09-13 10:13 |
| dsh-browser Installable GitHub release mirror for @kasenri/dsh-browser. Canonical source: KasenRi/dsh-orbit-browser-plugins. | medium | warn | 0/1/3 | 0/0 | 2026-09-13 10:13 |
| dsh-autofork Agent 忙时自动分叉会话：你新发的指令立刻在新会话里得到响应，旧会话留在后台跑完并把结果回注（DSH 插件） | low | pass | 0/0/6 | 0/0 | 2026-09-13 10:13 |
| smart-session-title Automatic session titles for DSH, using the conversation model. English and Chinese documentation. | low | pass | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-kdocs-sidebar 金山文档 (WPS 云文档) 接入 DSH：侧边右栏面板 / 预览文件 / 引用文件和文件夹到对话 / 编辑器打开 | medium | warn | 0/1/3 | 0/0 | 2026-09-13 10:13 |
| dsh-character-presets DSH 角色预设集：10 个角色共用一套六层情感引擎——露娜 / 小喵 / 绯音 / 凛 / 芽衣 / 白夜 / 阿尔玛 / 小铃 / 三千代 / 灰 | medium | warn | 0/3/0 | 0/3 | 2026-09-13 10:13 |
| dsh-role-cards DSH Web 插件：新建会话界面上的角色卡 + 工作区卡选择器（毛玻璃卡片墙 / 横向滚动 / 角色主题色 / 入场动画） | low | pass | 0/0/4 | 0/0 | 2026-09-13 10:13 |
| pi-web-ui-plugins | low | pass | 0/0/3 | 0/0 | 2026-09-13 10:13 |
| dsh-session-title-pattern 自动管理 dsh 会话标题，统一成「日期｜类型｜主题」的格式：类型与主题由模型对整段对话总结。 | low | pass | 0/0/0 | 0/0 | 2026-09-13 10:13 |
| dsh-plugin-subagent-roles DSH - Subagent Roles Plugin | low | pass | 0/0/1 | 0/0 | 2026-09-13 12:13 |
| dsh-email-notify DSH 邮件通知插件：任务完成 / 工具等你授权 / 助手在等你回答时发邮件给你，配一个「离开模式」开关。设置全部集成在 harness 设置界面里。 | medium | warn | 0/4/18 | 0/0 | 2026-09-13 12:13 |
| dsh-llm-codex Codex route for DSH: local Codex CLI first, OpenAI-compatible API fallback | medium | warn | 0/2/10 | 0/0 | 2026-09-13 12:13 |
| dsh-client-ui-wallpaper Changes the wallpaper of the dsh Web GUI. | low | pass | 0/0/1 | 0/0 | 2026-09-13 12:13 |
| dsh-browser-annotate Browser tools, Chrome DevTools Protocol, and right-click annotation for the DSH agent — plus the desktop shell that owns the real Chromium beside your session | medium | warn | 0/2/6 | 0/0 | 2026-09-13 12:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
30 reports2026-09-1482 added1 crit30 medium2026-09-13current43 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-13. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published