Daily security scan
Date · 2026-09-18 (UTC — plugins first indexed that day)
72
added
0
critical
14
medium
58
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @KSF1216/chinese-script-policy Harness-neutral Traditional Chinese enforcer and offline converter (skill / DSH bundle / CLI). Checks one script axis one way at a time plus two filter axes: Cantonese colloquialisms and Japanese-only kanji and words. Converts 繁↔簡, 粵語→書面語, 日文→中文, each opt-in, plus an optional wording preference. Single-file offline HTML, no runtime deps. | medium | warn | 0/1/7 | 0/0 | 2026-09-18 00:13 |
| @anthonyyu-verkada/dsh-mcp-client-plus DSH MCP client bridge with OAuth 2.1, bounded connect/discovery timeouts, environment-indirected secrets, optional indefinite reconnection, and a mcp_status diagnostic tool | medium | warn | 0/3/8 | 0/0 | 2026-09-18 00:13 |
| @YJLTF/dsh-vision-tool 一个 DSH 插件：为纯文本主模型补上识图能力。它把图片理解委托给你配置的一个小参数多模态模型，再把结果以文本形式交还给主模型；当活跃模型自身支持图片输入时，插件完全退避，原生多模态体验不受任何影响。 | low | pass | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @dingchenhui0618-arch/dsh-imagegen-skill Bundled imagegen skill for DSH: generate or edit raster images from the agent through any OpenAI-compatible GPT Image endpoint. | low | pass | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @maxesisnclaw/dsh-download-button Download button for delivered-file cards in DSH / 给交付物文件卡片加下载按钮 | low | pass | 0/0/1 | 0/0 | 2026-09-18 02:14 |
| @VDERR/echocat-skill-panel-3.0 DSH 技能调用审计 + 应用内 skill 管理器 | medium | warn | 0/2/10 | 0/0 | 2026-09-18 02:14 |
| @tianyaojiudi-prog/dsh-djy-xttsc DSH 插件：把一段可在设置页随时改写的文字，作为全局系统提示词段注入到所有会话，含子代理与工作流内部子代理；文本与开关即时生效，无需重启。 | low | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @LLYlab/DBS DBS (DSH BGM service) — 独立于 DET 的 DSH 音乐播放器插件：本地音乐库 + 浮动播放器 + AI 依任务控制播放。A standalone DSH BGM player plugin: local music library, floating player, AI-driven playback. | low | pass | 0/0/3 | 0/0 | 2026-09-18 04:13 |
| @jackchen13755/dsh-source-control VS Code 式源代码管理面板（DSH 原生右侧栏标签）：改动/暂存/提交/diff/分支切换与合并/抓取拉取推送/冲突清单/Git worktree，适配 DSH 0.1.6 | low | pass | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @shkzhang/dsh-file-link-menu | low | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @HaydenSmith1121/dsh-connect-trae-plus dsh-connect-trae 加固分支（基于上游 dingminhua/dsh-connect-trae v2.0.4）：插件自身启动失败时不再牵连整个 Harness。源码仓。 | low | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @jerry-l3/dsh-plugin-skill-picker DSH 编辑器插件：在「+」按钮右侧新增 Skill 选择按钮，为下一条消息选择 Skill（不选/单选/多选），并支持把本地 md/txt 文件注册为仅当前会话可用的临时 Skill | low | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @camplus360/agent-memory-bridge | medium | warn | 0/2/22 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-session-ctxmenu DSH plugin: right-click a session/project row in the sidebar to open its Rename/Fork/Archive menu | low | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-conn-dot DSH plugin: green/red connection dot beside the sidebar brand showing WebSocket + liveness-probe health of dsh web | low | pass | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @DWJZ/dsh-allow DSH 权限记忆插件：把某类命令加进允许列表，之后同类命令不再询问。 / Remember sandbox-escalation approvals so the same command prefix stops asking. | medium | warn | 0/1/5 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-restart | medium | warn | 0/3/4 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-session-cleanup Archived-session cleanup for the dsh web client: per-row delete and delete-all over the real session logs | medium | warn | 0/10/53 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-excel-viewer Spreadsheet preview for the DSH web client: xlsx / xlsm / xls / csv / tsv open as a read-only grid | low | pass | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-ark-plans Volcengine Ark Agent Plan and Coding Plan model routes for DSH, with a session-header quota pill | low | pass | 0/0/3 | 0/0 | 2026-09-18 06:13 |
| @qilin-zhu/dsh-model-relay 把DSH里已经配好的模型中转出去，让其他项目可以使用。 | low | pass | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @The-five-stooges/dsh-deepseek-usage DSH plugin: DeepSeek balance row in the sidebar footer plus a popover with locally estimated usage charts and a per-model cost table | medium | warn | 0/1/9 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-balance DSH 余额查询插件：用 /balance 命令在会话里查看 DeepSeek 账户余额。 / DeepSeek account balance as the /balance command. | low | pass | 0/0/2 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-opencode-go-plus OpenCode Go model provider for DSH - a maintained fork that keeps the model catalog reachable and configures itself from Settings > Models | low | pass | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-memory Session-end memory for DSH: distils each turn into durable notes and recalls them per workspace | medium | warn | 0/2/3 | 0/0 | 2026-09-18 06:13 |
| @AristotleAsborg/repo-autopilot-plugin 把 repo-autopilot 的只读检查注册成 DSH 工具｜doctor / drill / acceptance / compare｜只读、零凭证、零写入 | low | pass | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @cccc12138/dsh-read-aloud A speaker button beside the Like button: read any DSH reply aloud with the browser's own speech engine. · 在点赞旁加一个小喇叭，朗读 DSH 的回复。 | low | pass | 0/0/3 | 0/0 | 2026-09-18 08:13 |
| @jackchen13755/dsh-file-tree DSH 原生右侧栏文件面板：工作区文件树 + 官方预览（着色）+ 一键 @文件 引用到输入框，适配 DSH 0.1.6 | low | pass | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @weifa860504-droid/dsh-greet-signoff 开场语与收尾语：每次回复固定开场/收尾，并在上下文接近上限时提示换新会话（DSH Web 插件） | low | pass | 0/0/9 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-devspace DevSpace nodes and remote-directory mirror Workspaces for the DSH: manage N MCP endpoints, adopt a remote directory as a local Workspace, and move files both ways | medium | warn | 0/4/6 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-mcp-manager MCP server management for the DSH: register, edit, enable, disable and hot-mount MCP servers, with global defaults and per-project overrides | low | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-agents-md-manager AGENTS.md management for the DSH: every instruction level a Session loads in precedence order (user-global first, then project root to cwd), editable in place from a Settings page or from the model | low | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-auto-archive Auto-archive for DSH: archive sessions idle beyond a threshold, with full archived-session management UI · DSH 自动归档插件 | low | pass | 0/0/2 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-skill-manager Skill management for the DSH: browse, author, toggle and delete skills across project and user roots, from a Settings page or from the model | low | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @usssserd/my-dsh-plugin DSH插件test | low | pass | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-secrets-manager Project secret management for the DSH: monorepo .env discovery, comment-preserving edits, and a DSH_ENV_FILES pointer your shell commands can source | low | pass | 0/0/4 | 0/0 | 2026-09-18 08:13 |
| @hoyyang/dsh-glm-mode GLM Mode: fully tuned coding agent preset for zhipuai/glm-5.3-flash in DSH — PTC presentation, guard family, isolated compaction | low | pass | 0/0/8 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-task-capsule DSH cockpit duo: session-header task capsule + task notification card (sound/system notify) · DSH 任务胶囊与通知插件 | low | pass | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @cn-scuo-oo/dsh-session-auto-title DSH plugin: re-title a session after every turn in the MMDD｜类型｜主题 convention | low | pass | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @kovey/dsh-engineering-suite Engineering suite for DSH: seven plugins covering roles, specifications, test design, quality gates, evidence, audit trail and pipeline orchestration | medium | warn | 0/2/0 | 0/0 | 2026-09-18 08:13 |
| @Cumeskey/dsh-ssh-remote-tunnel | medium | warn | 0/3/7 | 0/0 | 2026-09-18 08:13 |
| @Qihang-He/dsh-nyanko-sensei Nyanko-sensei desktop pet plugin for DSH Web: a round calico cat that idles, naps, wanders, reacts to clicks with a voice line, and follows agent activity. DSH 桌宠插件：娘口三三／猫咪老师。 | low | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @mingzhicode/dsh-interactive-terminal Persistent Bash terminals for DSH, letting humans take over and continue model-started sessions through an xterm.js UI. | low | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @curtainsmall/dsh-reckoner Electrical & electronics calculation plugin for the DSH. 面向 DSH 的电气电子计算插件。 | low | pending | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/wechat-agent-router | low | pass | 0/0/3 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/agent-manager | low | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-codex-provider Codex (ChatGPT) model provider for DSH - serves the ChatGPT subscription models the Codex CLI uses, over OAuth session credentials instead of an API key | low | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @jiawei322/dsh-pi-catalog-sync Sync the pi.dev model catalog into DSH llm-pi-ai provider routes through the official settings seam — no source patch — including mixed-protocol routes like OpenRouter, where new models land on a companion route while the built-in route stays untouched. | low | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @xmzd-S/dsh-youdaonote dsh plugin about youdaonote | medium | warn | 2/2/2 | 0/0 | 2026-09-18 10:13 |
| @winston-hoo/dsh-spec-ponytail DietrichGebert/ponytail — 懒惰 senior 模式，hook注入,迁移成dsh | low | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @fu827707013/dsh-model-health-probe DSH 模型健康检查：会话视图页签，选定供应商/协议/模型/路由后手动发真实裸 HTTP 请求，一屏看耗时、TTFT、状态、token 与三层诊断链。 | low | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @wmw343/dsh-resume-expert 引导式简历生成插件：对话式四阶段 + A4 PDF 直出，双宿主验证 | low | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-wallhaven-wallpaper DSH 插件：从 wallhaven.cc 搜图并铺成 GUI 背景，图片全由宿主端取回（支持代理，浏览器无需能访问 wallhaven），可一键下载原图。零运行时依赖。 | medium | warn | 0/2/10 | 0/0 | 2026-09-18 10:13 |
| @ajceee/dsh-subscription-overlay | low | pass | 0/0/16 | 0/0 | 2026-09-18 10:13 |
| @asxiuxiu/dsh-quick-open DSH Web GUI plugin: VSCode-style Ctrl+P quick open — indexed workspace file search, sidebar editor open, conversation reference insert | low | pass | 0/0/5 | 0/0 | 2026-09-18 10:13 |
| @Noob-stupid/dsh-plugin-gating-hub DSH 插件管理面板：一键启用/停用插件 + GitHub dsh-plugin 插件市场+自定义插件索引/市场，带插件详情与一键安装，一键框架升级自动回滚,插件升级门控 | Plugin manager & marketplace for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @rebornace/dsh-tracescope 基于 Git 代码差异智能缩减手工测试范围，支持 Web / 移动端操作录制与崩溃日志采集，依托 DSH AI 自动生成可复现缺陷流程，实现变更驱动的手工测试闭环提效插件。A DSH native test assistant plugin. It intelligently narrows manual test scope via Git diff, records web & mobile operation tracks and crash logs, and generates reproducible bug steps through AI analysis to close manual testing workflow efficiently. | low | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @yumusb/dsh-opencode-go-plus | low | pass | 0/0/4 | 0/0 | 2026-09-18 12:13 |
| @GooDAnDReaDY/dsh-session-search DSH agent tool (session_search) for full-text search across historical sessions | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @neufagents/dsh-healthcheck Runtime health check for DSH: session-library scan + crash-tail inspection. Read-only. | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @Lukeknow0/dsh-markdown-link-preview Preview DSH Markdown output links inside Better Sidebar instead of an external app. | low | pass | 0/0/2 | 0/0 | 2026-09-18 12:13 |
| @Arcadia822/dsh-tmp-hook One-time ephemeral webhook plugin for DSH sessions: mint a single-use callback URL, then wake the requesting agent session with the delivered payload. | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @NEVSTOP-LAB/dsh-import-vscode-ai-files Load VSCode/Copilot AI configuration (.github/copilot-instructions.md, .github/instructions, .github/skills) into DSH sessions. | low | pass | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @athif23/dsh-shell-select DSH plugin: one model-facing shell tool whose shell (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish, sh) is a user setting, with a Web settings card and a fail-closed refusal when the sandbox cannot confine it. | low | pass | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @elmersky/dsh-plugin-trellis-workflow Trellis workflow enforcement for the DSH: per-turn workflow state injection and a trellis-start entry gate, replacing the session-start and user-prompt hooks dsh does not ship. | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @yukitakasama/dsh-context-lens Single-session context anatomy for the DSH Web GUI: attribution, headroom planning, and a context x trajectory timeline — not another usage ledger. | low | pass | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @KylinQ01/dsh-startup-animation 🌸 给 DSH 的开机动画 + 主界面壁纸：多层动效 + 鼠标视差，两张图可在设置里自由更换并实时预览 | low | pass | 0/0/6 | 0/0 | 2026-09-18 12:13 |
| @leolee9086/dsh-tool-cordis-local DSH 独立创造模式工具集：不注册进程级 inspect provider，让创造模式预设可以被复制 | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @OnTheWay111/dsh-plugin-path-completion DSH path completion（DSH @文件名自动补齐和发现） | low | pass | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @wuuuuu123-32/physics-lab-report | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @frederico-kluser/dsh-worktree-jump DSH plugin: a web-UI button that creates a git worktree and moves the conversation into it (session fork with the worktree as cwd) | low | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @whyself/Amadeus Amadeus: a web workspace for DSH with cloud and web agents, online code editing, PDF/Office/Markdown/LaTeX previews, TeX compilation, file management, and an integrated terminal. | low | pass | 0/0/2 | 0/0 | 2026-09-18 12:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
33 reports2026-09-18current72 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-18. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published