Daily security scan
Date · 2026-09-15 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report10 of 67 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 67 new entries: 10 with a conclusion, 21 queued, 3 failed (no conclusion), 33 low-risk not queued.
Data file updated 2026-10-31 07:30 (UTC+8); latest conclusion audited 2026-10-23 08:10 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| dsh-plugin-youcom You.com search + fetch provider plugin for DSH, plus a research-focused agent preset | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-15 00:13 |
| dsh-novel-launcher 在 DSH 界面放一个悬浮球：点开本地书单，用你自己的阅读器打开，窗口自动归位。 | medium | medium | audit failed | 0/4/3 | 0/0 | 2026-09-15 02:13 |
| DSHSwitch DSH 插件 — 在 DSH Web GUI 聊天输入框左侧添加可自定义的 switch 快捷按钮。 | medium | medium | queued | 0/1/6 | 0/0 | 2026-09-15 02:13 |
| DSH_Launch_Console DSH 的桌面外壳：静默启动 DSH 服务，并用锁定式窗口承载其 Web UI。 | mediumD | medium | medium | 0/3/4 | 0/0 | 2026-09-15 02:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | low | low | not queued (low risk) | 0/0/7 | 0/0 | 2026-09-15 02:13 |
| deepseek-harness-enterprise Enterprise deployment template for DSH | lowD↓ | medium | low | 0/16/10 | 0/0 | 2026-09-15 02:13 |
| dsh-memory-core DSH 记忆插件：四通道检索 + 演化闭环 + 分层治理；SQLite 单一事实源，替代 dsh-memory-evolve 的记忆/待办/技能三域 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-fishpai 公众号排版工作台，长在 DSH 的右侧栏里。人在侧栏改字、加批注与占位；模型用块级 diff 看懂你改了什么、想要什么；成品仍由你复制粘贴进公众号编辑器。 | lowD↓ | medium | low | 0/1/4 | 0/0 | 2026-09-15 02:13 |
| dsh-reasoning-merge | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 02:13 |
| dsh-wsl-im dsh plugin: Feishu / WeCom aibot / DingTalk Stream / QQ Gateway bridge into dsh agents (WSL) | medium | medium | queued | 0/1/13 | 0/0 | 2026-09-15 02:13 |
| dsh-community-plugins Unofficial DSH context guard and SearXNG search adapter maintained by xoykor | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-15 02:13 |
| dsh-plugin-devkit DevKit for DSH plugins — runtime inspector (/debug), isolated debug-boot, host contract tests without a browser, and client slot preview. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-model-search dsh-plugin | medium | medium | audit failed | 0/4/21 | 0/0 | 2026-09-15 04:13 |
| dsh-model-picker-plus | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-15 04:13 |
| dsh-tavily-web DSH Tavily plugin: key-pooled web search (tavily_search) + page fetch (web_fetch) | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 04:13 |
| dsh-strata-custom A customized dsh-strata for the DSH Web GUI: the transcript's scrollbar becomes a to-scale, colour-coded map of the whole session. Derivative work of jsdvjx/dsh-strata (MIT). | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-find-plugins Find DSH plugins across several community catalogs, ranked by relevance × trust × freshness instead of stars alone. 跨多个社区目录查找 DSH 插件，按相关度 × 可信度 × 新鲜度排序，而不是只看 star。 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-web-search-nokey 给 DSH 的免 key 搜索插件，也可以修复接 Trae / WorkBuddy 积分时 web_search 恒 401。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-15 04:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-qboson-ising-solver A DSH Agent Tool for solving Ising problems with QBoson Kaiwu/SPQC. | medium | medium | queued | 0/1/10 | 0/0 | 2026-09-15 04:13 |
| dsh-cust-search Custom Web Search plugin for DSH, replacing web-search-deepseek with multi-engine sequential fallback. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-sidebar-ratio DSH plugin: sidebar widths as a window ratio, plus one shared right-side panel across a parent session group (parent -> subagents) | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-15 06:13 |
| dsh-theme-newsprint 报纸衬线 · Newsprint Serif — DSH 主题插件：暖白报纸 + 纯黑中性灰 + 衬线正文 + 报纸排版笔画 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-wechat | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-15 06:13 |
| dsh-compact-agents | medium | medium | queued | 0/2/11 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-tofu-box | medium | medium | queued | 0/3/17 | 0/0 | 2026-09-15 06:13 |
| dsh-animation-studio 给 DSH做的教学动画制作工作台插件：一套内置在教学会话里的"教学视频 agent"。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| computer-use DSH computer-use 插件：让 agent 自己看屏幕、自己操作鼠标键盘（截屏/窗口/鼠标/键盘 6 工具），用于自主开发-验证-迭代闭环 | medium | medium | queued | 0/2/0 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-workbuddy-gateway Use a WorkBuddy subscription as a model provider in DSH: supervises the local OpenAI-compatible gateway and manages it from the settings page. | mediumD | medium | medium | 0/9/24 | 0/0 | 2026-09-15 08:13 |
| dsh-custom-headers Per-model custom request headers for DSH: define named header profiles in Settings → Plugins → Plugin configuration, pick one per model in the provider's model catalog, and every call to that model carries those headers. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-port-manager Native DSH sidebar app: every listening port on this machine, the app behind it, and one-click port actions. | medium | medium | queued | 0/2/12 | 0/0 | 2026-09-15 08:13 |
| dsh-llm-provider dsh LLM provider plugin: self-maintained pi-ai bridge, model selector, provider quota/billing and settings UI for DSH | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-memory Layered memory plugin for DSH: strictly separated project/global memory, host-driven recall before tasks and continuous learning after them. | critical | critical | queued | 1/1/0 | 0/0 | 2026-09-15 08:13 |
| visualize | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-sidebar-plus 基于 DSH 官方侧边栏的文件视图增强插件，提供源码视图、就地编辑、行号切换、搜索和字体缩放功能。A file-view enhancement plugin that extends the official DSH sidebar, providing source view, in-place editing, line-number toggle, search, and font zoom. | highD | high | high | 2/1/10 | 0/0 | 2026-09-15 08:13 |
| dsh-computer-use_codex-style Codex-style Computer Use for DSH: the official window2 13-method desktop surface plus Chromium automation, a visible overlay with Esc interrupt, per-app approvals and bundled skills. Windows, MIT, no Codex required. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-left-panel Git worktree-aware workspace browser for the DSH Web sidebar: repositories group their worktrees, and worktree workspaces are registered and unregistered automatically. | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-15 08:13 |
| dsh-agent-mailbox DSH 跨 agent 信箱插件：mailbox_send/check/reply/list/done/broadcast + task_create/list，桥接 agent-mailbox，零依赖 Node 22 | medium | medium | queued | 0/2/0 | 0/0 | 2026-09-15 08:13 |
| dsh-skin-xuyuanwu | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-15 08:13 |
| dsh-plugin-usage DSHWeb 用量与费用看板插件：余额、今日/本周/本月/累计消费、API 请求次数、token 明细与趋势图，按 DeepSeek 官方峰谷价估算，数据从本地会话日志全量重建 | lowD↓ | medium | low | 0/6/17 | 0/0 | 2026-09-15 10:13 |
| dsh-git-vcs DSH Web GUI 的 Git 版本管理插件：右侧栏新增「版本管理」页，功能与界面参照 IntelliJ IDEA 的 Version Control 工具窗（本地变更 / 提交 / 历史 / 分支 / 命令 / 贮藏）。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-mobile-keys DSH 移动端热键模式插件：自动检测移动端，Ctrl+Enter 发送 / Enter 换行；设置面板开关。Mobile hotkey mode plugin for DSH. | lowD↓ | medium | low | 0/5/4 | 0/0 | 2026-09-15 10:13 |
| dsh-snippets | mediumD | medium | medium | 0/1/5 | 0/0 | 2026-09-15 10:13 |
| dsh-deepseek-cost-watch DeepSeek off-peak alert, account balance and live Session cost estimate for the DSH Web UI | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-15 10:13 |
| dsh-model-metadata DSH plugin: match custom-gateway models to the model metadata they should have (context window, output cap, reasoning levels, vision) by bare model name — nothing written to your settings | medium | medium | queued | 0/5/18 | 0/0 | 2026-09-15 10:13 |
| dsh-yoimiya-theme | medium | medium | queued | 0/3/9 | 0/0 | 2026-09-15 10:13 |
| dsh-engineer-tools Engineering work-tools for DSH: a scoped git runner and a package-manager (npm/pnpm/yarn/bun) runner with structured output, plus an easy template to add more tools. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-workspace-promote DSH host plugin: promote the workspace you just submitted a task in to the top of the sidebar — once per submission, never during task execution. | 提交任务时把该工作区置顶，任务执行期间不重排。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-chicken-pet 🐔 A pixel chicken desktop pet for DSH — naps, paces, pecks and spins a basketball on its own, and reacts to your agent's work. Original procedurally-generated pixel art, no third-party assets. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-audio-read 让 AI Agent 听懂音频：转写、鸟种识别、语音情感、环境声与音乐分析。全部本地运行，不用大模型。DSH 技能。 | medium | medium | queued | 0/3/18 | 0/0 | 2026-09-15 10:13 |
| dsh-anchor ⚓ 定锚 · Anchor — DSH 会话指令定锚插件：为会话注入可自由组合的指令，并在压缩或长会话后自动重锚同一段原文 | high | high | queued | 1/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-plugin-followup 划词追问：选中回答文字右键追问，问答留在按会话独立的右侧面板，并从主对话隐藏该轮（DSH 插件） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-task-engine Engineering workflow plugin for DSH: task stages, verification records, commit checks, and skill and rule management. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| open-source-first-skill Pragmatic Anti-Wheel-Reinvention Protocol for AI Coding Agents: Research First, Open-Source Ethics, and Tokenomics Advantage. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-clinepass-deepseekv4.1 Cline Pass for DSH: one pi-ai provider route pinned to the DeepSeek upstream channel, key entered on Settings → Models. Share-only snapshot — 分享性质，非长期维护。 | mediumD | medium | medium | 0/5/4 | 0/0 | 2026-09-15 12:13 |
| dsh-lan 把只监听 127.0.0.1 的 dsh web 暴露到局域网，并带上移动端适配 —— 一个包，手机连上就能用（DSH 插件） | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-simple-restart | medium | medium | audit failed | 0/4/6 | 0/0 | 2026-09-15 12:13 |
| dsh-tool-guard Preset-agnostic global tool masking for DSH — presentation-layer filtering, execution-layer guard veto, self-protection gate and a WebUI editor. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-15 12:13 |
| self-evolving-router-dsh Self-evolving deterministic rule objects before DSH model calls | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-15 12:13 |
| dsh-session-colorful-unread-pin-jobs Colors every session title in the DSH sidebar by state — unread (blue running / green done), pinned (yellow), live background shell jobs (purple) — composed into one gradient; plus a "Model updated" sort mode and an unread settings section. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-15 12:13 |
| dsh-compose-panel | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-ds-tts 用 DeepSeek 官方朗读音色朗读 / 导出 / 接口化 | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-attention-beep DSH 插件：任务结束或命令卡死时用本机人声提醒，自动中断卡住的 pwsh 调用并把「怎么继续」写回工具结果，并在 spawn 之前拦掉已知的性能陷阱写法。仅 Windows。 / Beeps + stuck-command watchdog + command guard for DSH. Windows only. | medium | medium | queued | 0/2/4 | 0/0 | 2026-09-15 12:13 |
| dsh-security 在 DSH 内等价重建 OpenAI codex-security 安全审计能力的原生插件 | lowD↓ | critical | low | 1/1/0 | 0/0 | 2026-09-15 12:13 |
| dsh-delete-session DSH 插件：在侧栏会话行的 ⋯ 菜单中增加「删除会话」（永久删除，不可恢复），不接管也不禁用任何官方插件行。 | DSH plugin: add a permanent "delete session" action to the sidebar session row menu, with zero official-row takeover. | medium | medium | queued | 0/2/6 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-audit Agent Skill for DSH：装第三方插件前的静态安全审计 —— 扫出 eval、patch 层 !!js、安装期脚本、开机自启、凭据复制、出网域名与提示词注入面。Audit third-party DSH plugins before installing. Works with DSH, Claude Code, Codex, Cursor & any Agent Skills compatible agent. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-doctor Zero-dependency static + sandbox smoke detector for DSH plugins (R/K/D/CC layers) | medium | medium | queued | 0/1/1 | 0/0 | 2026-09-15 13:52 |
Dynamic audit results · new today (10 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Verified: /dsh-sp/save overwrites any existing absolute path, and hot-host.cjs is re-executed via new Function every 2s, so a same-origin caller gains host file write and Node code execution.
- high/dsh-sp/save overwrites any existing absolute path on the host; no workspace confinement · hot-host.cjs:181
- highhot-host.cjs is re-read and executed via new Function every 2s, so a write to it becomes Node code execution · lib/index.js:77
- mediumClient compiles and executes JS fetched from /dsh-sp/pull with new Function, no integrity check · lib/client.js:43
Legitimate Cline Pass observer, but it monkey-patches globalThis.fetch process-wide and re-streams every matched chat response; config-driven outbound key handling and a local status log are minor concerns.
- mediumProcess-wide globalThis.fetch monkey-patch intercepts and re-streams matched chat responses · index.js
- lowStatus file written per observed request includes request URL, provider, model and session id · index.js
- lowAPI key is sent to a configurable upstream base URL · index.js
No command injection: processes are spawned with argv arrays and version/slug inputs are sanitized; residual risk is the DSH web token written into a predictable shared temp log.
- mediumDSH web auth token is written into a predictable world-readable temp log · src/webui.rs:16
- lowSettings and logs live in the shared temp dir under fixed names, enabling local pre-creation/symlink tampering · src/config.rs:190
- lowNetwork-derived URLs are handed to the OS protocol handler without scheme restrictions · src/webui.rs:22
Dev scripts are harmless, but the same-origin guard is defeated by DNS rebinding, and POST /config can set gatewayDir/pythonPath that are later spawned, giving a browser-reachable code-execution chain.
- mediumsameOrigin() treats 'Origin host == Host' as proof of local origin, so DNS rebinding bypasses every mutating route · src/http.js:52
- mediumPOST /config accepts arbitrary gatewayDir/pythonPath that are later spawned as a process · src/routes.js:233
- lowProcess supervisor and the vendored Python gateway it executes are outside the audited source · src/index.js:22
JS snippets run unsandboxed via new Function by documented design; imported/watched JS bypasses the confirm gate, and the host API trusts only the peer address. No backdoor found.
- mediumUnsandboxed new Function execution of snippet content inside the DSH page origin · src/client/apply.ts:90
- mediumJS-execution confirmation is bypassed for snippets arriving from Gist import or the watched folder · src/client/ui/shared.tsx:85
- lowLoopback host API authorizes on socket peer address only, without Host/Origin or content-type validation · src/host/http.ts:19
Enterprise LiteLLM/control-plane harness; the flagged shell/curl/docker patterns are operator-run acceptance tests, no reachable critical/high/medium risk found.
- lowLiteLLM master key passed as curl argument, exposing it in the process list · scripts/gateway-acceptance.sh:36
FishPai WeChat typesetting plugin: no critical/high/medium issue in reviewed code; path guard and HTML sanitizer are deliberate and defensively written.
- lowPublic render() validates fontSize but trusts opts.color, allowing CSS injection into generated HTML · plugin/core/render.mjs
Browser-only hotkey plugin: no network, eval, dynamic import or secret access; only a low, non-runtime shell-quoting gap in an unpublished dev restart helper.
- lowUnquoted DSH_WEB_LOG interpolated into bash -c in dev restart script · scripts/restart-dsh-web.sh:55
Host plugin only reads DSH_HOME session logs, writes an aggregated ledger and proxies balance with the host-held key; no critical/high issues found, test scripts are dev-only.
- lowSession log frames are decompressed without an output-size cap · 入口/日志重建.js:59
Static-scan 'fail' comes from an intentionally vulnerable example app that the plugin never loads; the shipped runtime (lib/index.js) is a benign skill provider.
- lowVulnerable example app ships in the package but is never loaded at runtime · examples/fixture/src/index.js:30
- lowfix.js inserts args into subagent prompts without the path sanity check used by scan.js · workflow/fix.js:4
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 24,152 in-scope entries (23,848 scanned + 304 pending).
Static scan for reference: low 23,677 · medium 0 · high 168 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
75 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-15. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2885 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published