Daily security scan
Date · 2026-09-15 (UTC — plugins first indexed that day)
67
added
2
critical
32
medium
33
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| dsh-plugin-youcom You.com search + fetch provider plugin for DSH, plus a research-focused agent preset | low | pass | 0/0/3 | 0/0 | 2026-09-15 00:13 |
| dsh-novel-launcher 在 DSH 界面放一个悬浮球：点开本地书单，用你自己的阅读器打开，窗口自动归位。 | medium | warn | 0/4/3 | 0/0 | 2026-09-15 02:13 |
| DSHSwitch DSH 插件 — 在 DSH Web GUI 聊天输入框左侧添加可自定义的 switch 快捷按钮。 | medium | warn | 0/1/6 | 0/0 | 2026-09-15 02:13 |
| DSH_Launch_Console DSH 的桌面外壳：静默启动 DSH 服务，并用锁定式窗口承载其 Web UI。 | medium | warn | 0/3/4 | 0/0 | 2026-09-15 02:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | low | pass | 0/0/7 | 0/0 | 2026-09-15 02:13 |
| deepseek-harness-enterprise Enterprise deployment template for DSH | medium | warn | 0/16/10 | 0/0 | 2026-09-15 02:13 |
| dsh-memory-core DSH 记忆插件：四通道检索 + 演化闭环 + 分层治理；SQLite 单一事实源，替代 dsh-memory-evolve 的记忆/待办/技能三域 | low | pass | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-fishpai 公众号排版工作台，长在 DSH 的右侧栏里。人在侧栏改字、加批注与占位；模型用块级 diff 看懂你改了什么、想要什么；成品仍由你复制粘贴进公众号编辑器。 | medium | warn | 0/1/4 | 0/0 | 2026-09-15 02:13 |
| dsh-reasoning-merge | low | pass | 0/0/0 | 0/0 | 2026-09-15 02:13 |
| dsh-wsl-im dsh plugin: Feishu / WeCom aibot / DingTalk Stream / QQ Gateway bridge into dsh agents (WSL) | medium | warn | 0/1/13 | 0/0 | 2026-09-15 02:13 |
| dsh-community-plugins Unofficial DSH context guard and SearXNG search adapter maintained by xoykor | medium | warn | 0/1/2 | 0/0 | 2026-09-15 02:13 |
| dsh-plugin-devkit DevKit for DSH plugins — runtime inspector (/debug), isolated debug-boot, host contract tests without a browser, and client slot preview. | low | pass | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-model-search dsh-plugin | medium | warn | 0/4/21 | 0/0 | 2026-09-15 04:13 |
| dsh-model-picker-plus | low | pass | 0/0/3 | 0/0 | 2026-09-15 04:13 |
| dsh-tavily-web DSH Tavily plugin: key-pooled web search (tavily_search) + page fetch (web_fetch) | low | pass | 0/0/1 | 0/0 | 2026-09-15 04:13 |
| dsh-strata-custom A customized dsh-strata for the DSH Web GUI: the transcript's scrollbar becomes a to-scale, colour-coded map of the whole session. Derivative work of jsdvjx/dsh-strata (MIT). | low | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-find-plugins Find DSH plugins across several community catalogs, ranked by relevance × trust × freshness instead of stars alone. 跨多个社区目录查找 DSH 插件，按相关度 × 可信度 × 新鲜度排序，而不是只看 star。 | low | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-web-search-nokey 给 DSH 的免 key 搜索插件，也可以修复接 Trae / WorkBuddy 积分时 web_search 恒 401。 | low | pass | 0/0/2 | 0/0 | 2026-09-15 04:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | low | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-qboson-ising-solver A DSH Agent Tool for solving Ising problems with QBoson Kaiwu/SPQC. | medium | warn | 0/1/10 | 0/0 | 2026-09-15 04:13 |
| dsh-cust-search Custom Web Search plugin for DSH, replacing web-search-deepseek with multi-engine sequential fallback. | low | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-sidebar-ratio DSH plugin: sidebar widths as a window ratio, plus one shared right-side panel across a parent session group (parent -> subagents) | low | pass | 0/0/3 | 0/0 | 2026-09-15 06:13 |
| dsh-theme-newsprint 报纸衬线 · Newsprint Serif — DSH 主题插件：暖白报纸 + 纯黑中性灰 + 衬线正文 + 报纸排版笔画 | low | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-wechat | low | pass | 0/0/2 | 0/0 | 2026-09-15 06:13 |
| dsh-compact-agents | medium | warn | 0/2/11 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-tofu-box | medium | warn | 0/3/17 | 0/0 | 2026-09-15 06:13 |
| dsh-animation-studio 给 DSH做的教学动画制作工作台插件：一套内置在教学会话里的"教学视频 agent"。 | low | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| computer-use DSH computer-use 插件：让 agent 自己看屏幕、自己操作鼠标键盘（截屏/窗口/鼠标/键盘 6 工具），用于自主开发-验证-迭代闭环 | medium | warn | 0/2/0 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-workbuddy-gateway Use a WorkBuddy subscription as a model provider in DSH: supervises the local OpenAI-compatible gateway and manages it from the settings page. | medium | warn | 0/9/24 | 0/0 | 2026-09-15 08:13 |
| dsh-custom-headers Per-model custom request headers for DSH: define named header profiles in Settings → Plugins → Plugin configuration, pick one per model in the provider's model catalog, and every call to that model carries those headers. | low | pass | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-port-manager Native DSH sidebar app: every listening port on this machine, the app behind it, and one-click port actions. | medium | warn | 0/2/12 | 0/0 | 2026-09-15 08:13 |
| dsh-llm-provider dsh LLM provider plugin: self-maintained pi-ai bridge, model selector, provider quota/billing and settings UI for DSH | low | pass | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-memory Layered memory plugin for DSH: strictly separated project/global memory, host-driven recall before tasks and continuous learning after them. | critical | fail | 1/1/0 | 0/0 | 2026-09-15 08:13 |
| visualize | low | pass | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-sidebar-plus 基于 DSH 官方侧边栏的文件视图增强插件，提供源码视图、就地编辑、行号切换、搜索和字体缩放功能。A file-view enhancement plugin that extends the official DSH sidebar, providing source view, in-place editing, line-number toggle, search, and font zoom. | medium | warn | 2/1/10 | 0/0 | 2026-09-15 08:13 |
| dsh-computer-use_codex-style Codex-style Computer Use for DSH: the official window2 13-method desktop surface plus Chromium automation, a visible overlay with Esc interrupt, per-app approvals and bundled skills. Windows, MIT, no Codex required. | low | pass | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-left-panel Git worktree-aware workspace browser for the DSH Web sidebar: repositories group their worktrees, and worktree workspaces are registered and unregistered automatically. | medium | warn | 0/1/2 | 0/0 | 2026-09-15 08:13 |
| dsh-agent-mailbox DSH 跨 agent 信箱插件：mailbox_send/check/reply/list/done/broadcast + task_create/list，桥接 agent-mailbox，零依赖 Node 22 | medium | warn | 0/2/0 | 0/0 | 2026-09-15 08:13 |
| dsh-skin-xuyuanwu | low | pass | 0/0/3 | 0/0 | 2026-09-15 08:13 |
| dsh-plugin-usage DSHWeb 用量与费用看板插件：余额、今日/本周/本月/累计消费、API 请求次数、token 明细与趋势图，按 DeepSeek 官方峰谷价估算，数据从本地会话日志全量重建 | medium | warn | 0/6/17 | 0/0 | 2026-09-15 10:13 |
| dsh-git-vcs DSH Web GUI 的 Git 版本管理插件：右侧栏新增「版本管理」页，功能与界面参照 IntelliJ IDEA 的 Version Control 工具窗（本地变更 / 提交 / 历史 / 分支 / 命令 / 贮藏）。 | low | pass | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-mobile-keys DSH 移动端热键模式插件：自动检测移动端，Ctrl+Enter 发送 / Enter 换行；设置面板开关。Mobile hotkey mode plugin for DSH. | medium | warn | 0/5/4 | 0/0 | 2026-09-15 10:13 |
| dsh-snippets | medium | warn | 0/1/5 | 0/0 | 2026-09-15 10:13 |
| dsh-deepseek-cost-watch DeepSeek off-peak alert, account balance and live Session cost estimate for the DSH Web UI | low | pass | 0/0/5 | 0/0 | 2026-09-15 10:13 |
| dsh-model-metadata DSH plugin: match custom-gateway models to the model metadata they should have (context window, output cap, reasoning levels, vision) by bare model name — nothing written to your settings | medium | warn | 0/5/18 | 0/0 | 2026-09-15 10:13 |
| dsh-yoimiya-theme | medium | warn | 0/3/9 | 0/0 | 2026-09-15 10:13 |
| dsh-engineer-tools Engineering work-tools for DSH: a scoped git runner and a package-manager (npm/pnpm/yarn/bun) runner with structured output, plus an easy template to add more tools. | low | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-workspace-promote DSH host plugin: promote the workspace you just submitted a task in to the top of the sidebar — once per submission, never during task execution. | 提交任务时把该工作区置顶，任务执行期间不重排。 | low | pass | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-chicken-pet 🐔 A pixel chicken desktop pet for DSH — naps, paces, pecks and spins a basketball on its own, and reacts to your agent's work. Original procedurally-generated pixel art, no third-party assets. | low | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-audio-read 让 AI Agent 听懂音频：转写、鸟种识别、语音情感、环境声与音乐分析。全部本地运行，不用大模型。DSH 技能。 | medium | warn | 0/3/18 | 0/0 | 2026-09-15 10:13 |
| dsh-anchor ⚓ 定锚 · Anchor — DSH 会话指令定锚插件：为会话注入可自由组合的指令，并在压缩或长会话后自动重锚同一段原文 | medium | warn | 1/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-plugin-followup 划词追问：选中回答文字右键追问，问答留在按会话独立的右侧面板，并从主对话隐藏该轮（DSH 插件） | low | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-task-engine Engineering workflow plugin for DSH: task stages, verification records, commit checks, and skill and rule management. | low | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| open-source-first-skill Pragmatic Anti-Wheel-Reinvention Protocol for AI Coding Agents: Research First, Open-Source Ethics, and Tokenomics Advantage. | low | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-clinepass-deepseekv4.1 Cline Pass for DSH: one pi-ai provider route pinned to the DeepSeek upstream channel, key entered on Settings → Models. Share-only snapshot — 分享性质，非长期维护。 | medium | warn | 0/5/4 | 0/0 | 2026-09-15 12:13 |
| dsh-lan 把只监听 127.0.0.1 的 dsh web 暴露到局域网，并带上移动端适配 —— 一个包，手机连上就能用（DSH 插件） | medium | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-simple-restart | medium | warn | 0/4/6 | 0/0 | 2026-09-15 12:13 |
| dsh-tool-guard Preset-agnostic global tool masking for DSH — presentation-layer filtering, execution-layer guard veto, self-protection gate and a WebUI editor. | low | pass | 0/0/1 | 0/0 | 2026-09-15 12:13 |
| self-evolving-router-dsh Self-evolving deterministic rule objects before DSH model calls | low | pass | 0/0/6 | 0/0 | 2026-09-15 12:13 |
| dsh-session-colorful-unread-pin-jobs Colors every session title in the DSH sidebar by state — unread (blue running / green done), pinned (yellow), live background shell jobs (purple) — composed into one gradient; plus a "Model updated" sort mode and an unread settings section. | low | pass | 0/0/4 | 0/0 | 2026-09-15 12:13 |
| dsh-compose-panel | medium | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-ds-tts 用 DeepSeek 官方朗读音色朗读 / 导出 / 接口化 | medium | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-attention-beep DSH 插件：任务结束或命令卡死时用本机人声提醒，自动中断卡住的 pwsh 调用并把「怎么继续」写回工具结果，并在 spawn 之前拦掉已知的性能陷阱写法。仅 Windows。 / Beeps + stuck-command watchdog + command guard for DSH. Windows only. | medium | warn | 0/2/4 | 0/0 | 2026-09-15 12:13 |
| dsh-security 在 DSH 内等价重建 OpenAI codex-security 安全审计能力的原生插件 | critical | fail | 1/1/0 | 0/0 | 2026-09-15 12:13 |
| dsh-delete-session DSH 插件：在侧栏会话行的 ⋯ 菜单中增加「删除会话」（永久删除，不可恢复），不接管也不禁用任何官方插件行。 | DSH plugin: add a permanent "delete session" action to the sidebar session row menu, with zero official-row takeover. | medium | warn | 0/2/6 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-audit Agent Skill for DSH：装第三方插件前的静态安全审计 —— 扫出 eval、patch 层 !!js、安装期脚本、开机自启、凭据复制、出网域名与提示词注入面。Audit third-party DSH plugins before installing. Works with DSH, Claude Code, Codex, Cursor & any Agent Skills compatible agent. | low | pass | 0/0/0 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-doctor Zero-dependency static + sandbox smoke detector for DSH plugins (R/K/D/CC layers) | medium | warn | 0/1/1 | 0/0 | 2026-09-15 13:52 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
31 reports2026-09-15current67 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-15. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published