Daily security scan
Date · 2026-09-14 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report0
critical
3
high
28
medium
51
low
9 of 82 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallback1
critical
1
high
29
medium
51
low
Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no execution0
critical
3
high
6
medium
0
low
Tier = highest finding. Of 82 new entries: 9 with a conclusion, 19 queued, 3 failed (no conclusion), 51 low-risk not queued.
Data file updated 2026-10-30 07:30 (UTC+8); latest conclusion audited 2026-10-20 00:53 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| dsh-imgnav Click-to-zoom lightbox with arrow-key paging for DSH conversation images: ← prev / → next / Esc close, edge hints | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-wide-conversation DSH web client plugin: pins the conversation column to a configurable percentage of its width (default full width) instead of the built-in 680-920px reading measure. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-better-display DSH 沉浸式阅读视图（fork）：执行步骤自动折叠 + MCP-App 交互沙箱，深度适配 dsh-retrace 撤回/重发节点展示 | highD↑ | medium | high | 0/6/1 | 0/0 | 2026-09-14 00:13 |
| subscription-logins dsh plugin: store and switch ChatGPT/Claude OAuth and Z.AI Coding Plan credentials in a Logins settings page | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| herdr-themes dsh plugin: the 18 herdr themes as Settings > Themes with live swatch cards and persistent selection | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| skill-mcp-manager dsh plugin: manage dsh skills and MCP servers from Settings > Skills & MCP, hot-reloaded without restarting the GUI | medium | medium | queued | 0/2/7 | 0/0 | 2026-09-14 00:13 |
| configurable-subagents dsh plugin: default sub-agent provider, model, and reasoning effort plus per-delegation overrides | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| web-search-searxng dsh plugin: SEARXNG-backed web search provider for the dsh web_search tool (host-only, no Settings UI) | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 00:13 |
| context-before-user dsh plugin: keep injected runtime context and skill context as user-role turns before the human request | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-hyper-tools DSH plugin: keeps Charm Hyper model requests under the gateway's 10 MiB body cap by replacing the oldest images (newest survive) and retrying when the gateway rejects the body. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| system-prompt-editor dsh plugin: edit the assembled system prompt of every new session (custom text, persona, tool guidance) with live preview | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| dsh-model-orchestrator Model routing for DSH, with a standing capability-to-model assignment table, per-route reasoning levels, and a user-triggered sync that researches public model prices. 为 DSH 提供模型路由：可持久化的「能力→模型」分工表、按路由的推理档位，以及手动触发、由模型联网核对公开价格的同步。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-14 00:13 |
| clear-session-history dsh plugin: clear session history from disk (workspace/all/session) with scoped, confirmed deletes | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-14 00:13 |
| dsh-code-poem dsh 插件 · 代码如诗：4598 条古诗词/成语/龙文鞭影典故随机成笺，随会话事件自动浮现 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| yammory-system Cross-session user-profile memory for DSH: remembers who you are and how much you know, so the agent speaks at your level. Approval-gated, auditable, local SQLite. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 02:16 |
| dsh-better-uiux Better UIUX for DSH: one Settings section with switches for live terminal output streaming and custom CSS injection | highD↑ | medium | high | 0/4/12 | 0/0 | 2026-09-14 02:16 |
| dsh-multi-end | medium | medium | queued | 0/2/8 | 0/0 | 2026-09-14 02:16 |
| dsh-deepseek-web DSH 插件：侧边栏内嵌[chat.deepseek.com](https://chat.deepseek.com)网页版对话，无需 API Key，不消耗 DSH 会话 Token，支持 Web 与 Electron 桌面端。 | mediumD | medium | medium | 0/4/14 | 0/0 | 2026-09-14 02:16 |
| dsh-plugin-bootreport DSH 启动自报账本：web 启动时落一行「本进程加载了哪些插件构建」，判据 lib mtime vs 进程起点，一条命令答全生态「构建是否生效 / 谁需重启」 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-14 02:16 |
| yanxu-dsh-plugin | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-browser-panel A shared browser inside the DSH host: the AI drives it with browser_panel_* tools, and you watch or take over the same tab in the DSH Web UI — logins, 2FA, QR codes included. | mediumD | medium | medium | 0/4/11 | 0/0 | 2026-09-14 04:13 |
| dsh-solpi Four harness efficiency mechanisms (Action Fusion, ObservationPack, Evidence-Preserving Reducer, Online Context Compact) as a DSH bundle | medium | medium | queued | 0/2/1 | 0/0 | 2026-09-14 04:13 |
| compliance-skills Mechanical-check AI agent skills for contracts, invoices, tender/bidding documents and ad copy: every finding is recomputable evidence, fully offline, no model, no network. 合同、票据、招投标与广告文案的机械核对型 AI 技能（免费版源码）。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-approval-ai-review AI-reviewed auto-approval for DSH: safe tool asks granted automatically, risky ones escalated with the review attached | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-web-fetch-moli | medium | medium | queued | 0/4/11 | 0/0 | 2026-09-14 04:13 |
| dsh-geometry-knowledge 几何论（共扼谱几何 CSG）知识库插件 for DSH：纯离线 BM25 检索 251 篇文章 + 869 条真理，31 个 geo_* 工具，开箱即用。Conjugate Spectral Geometry knowledge base plugin for DSH. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-session-reattach DSH 宿主插件：把游离（未分组）会话按 cwd 归位到匹配的工作区 —— 只改工作区归属记录，不碰会话文件；支持拖拽与 /reattach 命令（默认 dry-run）｜ DSH host plugin: re-attach ungrouped sessions to their matching workspace by cwd — ownership bookkeeping only, never rewriting session logs | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 04:13 |
| dsh-web-companion Chrome side panel that puts the DSH agent next to the page you are reading — read it, or let the agent work it. Built on DSH; not affiliated with or endorsed by DeepSeek. | mediumD | medium | medium | 0/7/12 | 0/0 | 2026-09-14 04:13 |
| dsh-weixin-channel 微信通道插件 for DSH：把微信消息接成 DSH 会话（文本/图片/文件/语音/视频双向，出站可推文档） | mediumD | medium | medium | 0/6/21 | 0/0 | 2026-09-14 04:13 |
| dsh-ide-git DSH plugin: an IDE-grade Git tool window as a native dsh-better-sidebar tab — branch tree, commit graph, changes, commit details, JetBrains-style actions, in the right sidebar and the bottom panel. | DSH 插件:IDE 级 Git 工具窗口,以 dsh-better-sidebar 原生 Tab 挂载——分支树 / 提交图谱 / 变更与提交详情 / JetBrains 风格操作,右侧栏与底部面板双布局自适应。 | medium | medium | queued | 0/1/21 | 0/0 | 2026-09-14 04:13 |
| dsh-plugins 自研 dsh 插件合集 · dsh-btw: 划选引用 / btw 临时会话 / 新上下文 / Provider 高级配置 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-14 04:13 |
| dsh-memory-md 简单的纯依赖MD文件的记忆插件，实现思路参考CodeBuddy和WorkBuddy的实现 | medium | medium | queued | 0/1/4 | 0/0 | 2026-09-14 04:13 |
| dsh-fight-scene-director DSH ??:? Codex ?? fight-scene-director(??? AI ????????????)??? DSH ????,???? Seedance 2.0 / 2.5?MiniMax H3 ?????????? | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-improve-prompt 输入框一键增强提示词：直接替换 + 一键撤回，带保真闸（硬事实零丢失）与长度闸（防膨胀）。DSH plugin. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-farm-dispatch 子代理派发规范（吝啬农场主模式）全局化插件 for DSH — syncs cordis-async preset + AGENTS.md dispatch rules. dsh plugin add ready. | medium | medium | queued | 0/3/0 | 0/3 | 2026-09-14 06:13 |
| dsh-asset-library DSH 素材库插件：会话内容一键保存 + 自动采集，按时间/类型/会话/项目四轴归纳，本地 Markdown 存储，零运行时依赖。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 06:13 |
| dsh-caps-beacon Caps Lock LED status beacon for DSH — solid while agents work, blinking when your approval or answer is needed | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-14 06:13 |
| Arknights-flavor-theme Arknights theme skin for DSH. 适用于 DSH 的明日方舟主题皮肤。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-noname-kit DSH无名杀插件 无名杀扩展开发工坊:AI 按规范写武将技能与卡牌(确认协议/校验门禁/区块化写入) | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-14 06:13 |
| dsh-prompt-only-forge dsh-prompt-only-forge — 点输入框右座 ✨ 把「打磨提示词」写进输入栏（当前草稿自动嵌进 <内容> 位置），不发送、不联网、不调模型 | medium | medium | audit failed | 0/4/10 | 0/0 | 2026-09-14 06:13 |
| agent-skills-cn Bilingual (EN/CN) agent skills: email deliverability audit, competitor recon, resume localization CN→EN, delivery checklist — battle-tested domain workflows as open SKILL.md files. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-outbound-proxy DSH plugin: set a global outbound proxy from Settings | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-14 06:13 |
| dsh-drawio Standalone DSH plugin: preview .drawio (mxGraph XML) diagrams in the Web Sidebar. Does not bundle @deepseek-ai/* and does not use the harness build scripts. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-rewind Undo what an agent did to a directory: content-addressed snapshots, one-command rewind, and an undo you can undo. Works in any folder — git or not. DSH plugin + skill, zero dependencies. | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-14 06:13 |
| dsh-schedule-panel DSH ????:????? + schedule ??,???????;???????????(?? Typert Remote ?? + ??? ctx.remote) | medium | medium | audit failed | 0/4/16 | 0/0 | 2026-09-14 06:13 |
| competitor-recon Competitor research skill: complaint-driven recon with cited evidence from reviews, forums, and issue trackers — comparison table plus copy-worthy and skip lists. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-optimize Long-session resource control for DSH: measures the context every request carries, warns at configurable thresholds, can run the harness compaction engine over budget, and contains offscreen chat rows behind a toggle. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-14 08:15 |
| resume-localize-cn2en Resume localization skill (CN to EN): demographic fields stripped, duties become quantified outcomes, one spelling variant, ATS-parsable, full change log. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-lan-link Persistent token-gated LAN access for DSH Web | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-14 08:15 |
| dsh-courseware create pptx file based on template.pptx and a outline file | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-vision-3090-fix DSH LLM adapter that caps images per request to 1, for self-hosted vLLM backends that reject prompts with more than one image | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 08:15 |
| email-deliverability-audit Email deliverability audit skill: four sequential DNS gates classify addresses as sendable/risky/dead — every verdict traces to a query run that session. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-runninghub-api A plugin that integrates runninghub cloud ComfyUI workflows: a settings card for your API key and workflow library, seven `runninghub_*` tools for agents, a sha256 media upload cache, a local concurrency gate with FIFO queueing and timeouts, background tasks with completion notifications, and a durable task ledger with automatic restart recovery. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-14 08:15 |
| dsh-default-prompt | highD↑ | medium | high | 0/5/4 | 0/0 | 2026-09-14 08:15 |
| dsh-cliproxyapi Native Codex and Antigravity subscription accounts inside DSH, based on CLIProxyAPI | medium | medium | queued | 0/2/9 | 0/0 | 2026-09-14 08:15 |
| delivery-checklist Delivery checklist skill: verify deliverables by opening the real file — row/dedup counts, placeholder scan, baseline diff — and log every batch. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| self-evolving-router-dsh Self-evolving deterministic rule objects before DSH model calls | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-14 08:15 |
| dsh-gme-workflow GME Test Agent workflow tools for DSH: pick interfaces, generate and repair tests autonomously in a local Python backend, poll until review, decide with consent. | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-14 08:15 |
| mcp-cap What can this MCP server actually do — and has it changed since you trusted it? Inspect its declared capabilities, seal them in a lock file, and get told when a later version can do more. Never invokes a tool; gives the server a minimal environment. | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-14 08:15 |
| banbo-dsh | medium | medium | queued | 0/2/1 | 0/2 | 2026-09-14 08:15 |
| dsh-storyboard Doubao-style end-of-chat storyboard card for DSH: lightweight, zero-dependency HTML/SVG visual summary at the end of substantive chats | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-14 08:15 |
| report-link-verification Link verification skill: fetch every URL in a deliverable for real, retry bot walls, fix or cut failures — links in file must equal links in table. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| project-handoff Project handoff skill: a dated handoff.md per project — current state, decisions with reasons, pitfalls as symptom/cause/fix — so any fresh session resumes without archaeology. CN/EN. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-missher-brain Shared, bounded recall coordination for DSH Memory and MSE providers. | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-14 10:13 |
| dsh-codex-adapter ChatGPT-powered coding, image generation and web search for DSH. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 10:13 |
| dsh-missher-enhance Independent enhancement bundle for DSH: usage, sessions, model helpers, documents and piano navigation. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-token-billing 给DSH Web GUI用的会话token计费插件：在会话标题栏显示本次会话的实时花费，点开可以看输入 / 缓存命中 / 缓存写入 / 输出 / 推理的分项、按模型的账单，以及当前用的是高峰还是空闲时段价。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-window-pin 一个小巧且轻量的置顶工具 | medium | medium | audit failed | 0/4/0 | 0/0 | 2026-09-14 10:13 |
| tirol-dsh-language-set [DSH] plugin, that separately controls the AI’s response language and thinking language through system prompt injection. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-labrador A Labrador | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-14 10:13 |
| dsh-llm-antigravity Antigravity route for DSH: local Antigravity CLI (agy) as an LLM provider | medium | medium | queued | 0/2/9 | 0/0 | 2026-09-14 10:13 |
| dsh-web-close DeepSeek-Harness插件，用于关闭dsh的web进程 | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-14 10:13 |
| dsh-reasoning-mode | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-lost-and-found DSH plugin: local file recall - watch the folders you choose, index what appeared (name/type/size/appeared-at/location/origin) into a local SQLite database, then search by keyword/time/type/folder with a live read-only fallback scan. 文件快速寻回:DSH 本地文件记忆索引,忘了文件放哪问一句就能找回;每个目录各有独立增量锚点,新加入的目录首扫回填历史;只读,绝不修改、移动或删除你的文件。 | medium | medium | queued | 0/2/2 | 0/0 | 2026-09-14 12:14 |
| dsh-fonttune DSH 字体插件：正文/代码字体族、全局字号偏移、字重，以及西文/中文分栏选择。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 12:14 |
| dsh-plugin-h3-hip DSH Host plugin for h3-hip.c (--serve, protocol v1alpha) | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-14 12:14 |
| dsh-just-chat One-click native conversations with independent workspaces for DSH | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 12:14 |
| ctx-budget What will your agent's context cost before it runs? Audit instruction files, skills, MCP tool schemas and memory per source — with duplication, always-on versus on-demand costs, and a budget you can enforce in CI. Reads files and nothing else. | mediumD↓ | critical | medium | 2/0/1 | 0/0 | 2026-09-14 12:14 |
| DLT DLT (DeepSeek Light Tool) - a permanent DSH plugin: per-turn CNY cost, DeepSeek account balance, native PDF/Word/Excel/CSV read-write tools and right-sidebar previews, a hardcoded compiler/runtime registry with direct run/build tools, and a runtime master switch (DLT manager). | medium | medium | queued | 0/2/7 | 0/0 | 2026-09-14 12:14 |
| dsh-momo-learning 墨墨背单词的 DSH 插件：本地学习镜像 MCP 工具 + 每日出题 Skill | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-14 12:14 |
| dsh-plugin-tic80 DSH plugin for TIC-80 fantasy console: full console capabilities, conversational code, music, map, and sprite generation by LLM, with native & live web execution. | mediumD↓ | high | medium | 1/5/0 | 0/0 | 2026-09-14 12:14 |
| OmaSeek OmaSeek: the Omarchy spirit and aesthetic. Now in DSH | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-14 12:14 |
Dynamic audit results · new today (9 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
The runtime entry registers an unauthenticated POST route that spawns the OS file-opener with a caller-supplied path, giving any local/CSRF caller an arbitrary open/reveal primitive.
- highUnauthenticated local HTTP route spawns the OS file opener with an unvalidated attacker-supplied path · lib/dsh-better-display.js:33
- mediumWindows branch passes attacker path into explorer.exe /select, permitting UNC paths and argument splitting · lib/dsh-better-display.js:37
- lowRequest body is accumulated without any size or content-type limit · lib/dsh-better-display.js:19
Plugin behaves as documented, but its local HTTP routes expose live shell output and job control with `Access-Control-Allow-Origin: *` and no auth, so any web page can read output and kill jobs.
- highUnauthenticated live-terminal output endpoint is readable cross-origin (CORS *) · index.js:767
- medium/stop performs kills on GET with wildcard CORS — cross-site job termination (CSRF) · index.js:984
- mediumCross-origin POST can persistently inject arbitrary CSS into the Harness GUI · index.js:690
The plugin's HTTP API allows unauthenticated arbitrary file read/write via filePath, and workspace PROMPT.md files are injected into the system prompt by default.
- highHTTP saveFile writes an attacker-chosen path with arbitrary content, with no auth or path confinement · src/web.js:71
- mediumGET endpoint returns contents of any readable file chosen via the configurable filePath setting · src/web.js:23
- mediumWorkspace PROMPT.md from an untrusted repository is injected into the system prompt by default · src/promptManager.js:167
Static scan's two criticals are false positives; the visible code is strictly read-only, but the CLI entry point, dupes.js and the agent-facing SKILL.md are missing from the audited corpus.
- mediumExecutable entry point (src/cli.js), src/dupes.js and the agent-facing SKILL.md are absent from the audited source · package.json:8
- lowAudit objects retain raw file text; redaction happens only in the human-render path · src/sources.js:57
No critical issues: routes are auth-guarded and shell-free; risk sits in Chrome launch flags (--no-sandbox as root, --remote-allow-origins=*) plus unharvested ws/tools/screencast modules.
- mediumChrome runs with --no-sandbox when the DSH host runs as root, rendering untrusted web pages unsandboxed · lib/browser.js:406
- lowDevTools endpoint started with --remote-allow-origins=* on the port that drives the shared logged-in profile · lib/browser.js:394
- lowPersistent login profile created with default permissions and a basic password store · lib/browser.js:365
Loopback token-usage bridge answers with Access-Control-Allow-Origin: * so any website can read private usage stats; the DeepSeek proxy also writes the session cookie onto port-agnostic 127.0.0.1.
- mediumLoopback usage endpoint replies with Access-Control-Allow-Origin: * exposing private token stats to any website · plugin/token-usage/lib/index.js:228
- lowProxy rewrites upstream cookies onto loopback origin without Secure, exposing the session cookie to other 127.0.0.1 services · plugin/dsh-deepseek-web/lib/index.js:127
- lowProxy strips CSP/X-Frame-Options/COOP/COEP and rewrites Origin/Referer, weakening upstream protections · plugin/dsh-deepseek-web/lib/index.js:71
No critical/high issue in the reviewed files; medium risks are an unsanitised export filename (path traversal) and executing a planted tic80.exe found via CWD/hard-coded paths.
- mediumUnsanitised options.filename is used directly as the export file name, allowing path traversal · src/runner/exporter.ts:29
- mediumTIC-80 executable is auto-discovered from CWD and hard-coded user-writable paths, then spawned · src/runner/native-runner.ts:37
- lowCaller-supplied command strings are concatenated into the TIC-80 --cmd console line with ' & ' · src/runner/native-runner.ts:100
Bridge and MV3 extension are mostly guarded, but the unauthenticated WS echo route accepts cross-origin connections and dev spike scripts expose CDP with --no-sandbox.
- mediumWS echo route performs no origin/auth check, so any website can open cross-origin sockets to the local bridge · dsh-plugin/src/host/routes/ws-echo.js:15
- lowDeveloper spike scripts launch Chrome with --no-sandbox and an unauthenticated CDP port · spike/run-spike.sh:30
WeChat long-poll bridge that stores bot tokens and drives a DSH agent; no RCE, but a detached watchdog rewrites host profile YAML and login artifacts land in world-readable logs.
- mediumDetached watchdog autonomously rewrites the host profile cordis.patch.yml and survives plugin unload · tools/watchdog.mjs:103
- mediumLogin QR URL (a bearer credential) is persisted in plaintext into world-readable log/state files · bin/weixin-login.mjs:124
- lowNon-interactive login accepts the phone verification code from an unauthenticated local file drop · bin/weixin-login.mjs:84
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 23,757 in-scope entries (23,469 scanned + 288 pending).
18
critical
288
high
1,097
medium
22,066
low
Static scan for reference: low 23,302 · medium 0 · high 166 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
74 reports2026-10-29216 added2 crit8 high92 medium2026-10-28277 added2 crit6 high106 medium2026-10-270 added0 crit0 medium2026-10-2628 added0 crit10 medium2026-10-25200 added0 crit4 high80 medium2026-10-24166 added2 crit8 high73 medium2026-10-23218 added4 crit3 high87 medium2026-10-22193 added1 crit6 high49 medium2026-10-21220 added0 crit4 high65 medium2026-10-200 added0 crit0 medium2026-10-190 added0 crit0 medium2026-10-18609 added1 crit17 high204 medium2026-10-17306 added0 crit0 medium2026-10-160 added0 crit0 medium2026-10-15110 added1 crit5 high42 medium2026-10-1499 added1 crit33 medium2026-10-13102 added1 crit4 high32 medium2026-10-120 added0 crit0 medium2026-10-110 added0 crit0 medium2026-10-10104 added0 crit2 high38 medium2026-10-098 added0 crit1 high0 medium2026-10-08100 added0 crit39 medium2026-10-070 added0 crit0 medium2026-10-060 added0 crit0 medium2026-10-050 added0 crit0 medium2026-10-0472 added0 crit2 high28 medium2026-10-0388 added0 crit2 high34 medium2026-10-0299 added1 crit4 high43 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit6 high45 medium2026-09-2969 added0 crit5 high17 medium2026-09-2864 added0 crit2 high21 medium2026-09-2763 added0 crit3 high20 medium2026-09-2684 added0 crit3 high26 medium2026-09-2545 added1 crit4 high20 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit1 high28 medium2026-09-2259 added1 crit2 high16 medium2026-09-2165 added0 crit2 high21 medium2026-09-20104 added1 crit3 high31 medium2026-09-1981 added0 crit4 high32 medium2026-09-1872 added0 crit1 high13 medium2026-09-1770 added1 crit4 high20 medium2026-09-1567 added2 crit2 high30 medium2026-09-14current82 added1 crit1 high29 medium2026-09-1343 added0 crit1 high14 medium2026-09-1284 added0 crit2 high27 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit1 high16 medium2026-09-0948 added0 crit1 high14 medium2026-09-08922 added2 crit62 high239 medium2026-09-0743 added0 crit5 high10 medium2026-09-0614 added0 crit1 high2 medium2026-09-0565 added0 crit14 high6 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit15 high15 medium2026-09-0285 added0 crit11 high8 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit48 high39 medium2026-08-2733 added0 crit6 high9 medium2026-08-26253 added0 crit38 high36 medium2026-08-25336 added1 crit51 high55 medium2026-08-24327 added4 crit41 high38 medium2026-08-23370 added2 crit73 high46 medium2026-08-2212 added0 crit2 high4 medium2026-08-212656 added8 crit290 high219 medium2026-08-20597 added5 crit84 high76 medium2026-08-191301 added12 crit273 high129 medium2026-08-184003 added22 crit999 high353 medium2026-08-17142 added1 crit36 high13 medium2026-08-16189 added0 crit53 high27 medium2026-08-15348 added5 crit144 high22 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-14. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2882 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published