Daily security scan
Date · 2026-09-18 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report5 of 72 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 72 new entries: 5 with a conclusion, 10 queued, 0 failed (no conclusion), 57 low-risk not queued.
Data file updated 2026-11-04 07:30 (UTC+8); latest conclusion audited 2026-10-23 08:53 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @KSF1216/chinese-script-policy Harness-neutral Traditional Chinese enforcer and offline converter (skill / DSH bundle / CLI). Checks one script axis one way at a time plus two filter axes: Cantonese colloquialisms and Japanese-only kanji and words. Converts 繁↔簡, 粵語→書面語, 日文→中文, each opt-in, plus an optional wording preference. Single-file offline HTML, no runtime deps. | lowD↓ | medium | low | 0/1/7 | 0/0 | 2026-09-18 00:13 |
| @anthonyyu-verkada/dsh-mcp-client-plus DSH MCP client bridge with OAuth 2.1, bounded connect/discovery timeouts, environment-indirected secrets, optional indefinite reconnection, and a mcp_status diagnostic tool | medium | medium | queued | 0/3/8 | 0/0 | 2026-09-18 00:13 |
| @YJLTF/dsh-vision-tool 一个 DSH 插件：为纯文本主模型补上识图能力。它把图片理解委托给你配置的一个小参数多模态模型，再把结果以文本形式交还给主模型；当活跃模型自身支持图片输入时，插件完全退避，原生多模态体验不受任何影响。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @dingchenhui0618-arch/dsh-imagegen-skill Bundled imagegen skill for DSH: generate or edit raster images from the agent through any OpenAI-compatible GPT Image endpoint. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @maxesisnclaw/dsh-download-button Download button for delivered-file cards in DSH / 给交付物文件卡片加下载按钮 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 02:14 |
| @VDERR/echocat-skill-panel-3.0 DSH 技能调用审计 + 应用内 skill 管理器 | medium | medium | queued | 0/2/10 | 0/0 | 2026-09-18 02:14 |
| @tianyaojiudi-prog/dsh-djy-xttsc DSH 插件：把一段可在设置页随时改写的文字，作为全局系统提示词段注入到所有会话，含子代理与工作流内部子代理；文本与开关即时生效，无需重启。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @LLYlab/DBS DBS (DSH BGM service) — 独立于 DET 的 DSH 音乐播放器插件：本地音乐库 + 浮动播放器 + AI 依任务控制播放。A standalone DSH BGM player plugin: local music library, floating player, AI-driven playback. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 04:13 |
| @jackchen13755/dsh-source-control VS Code 式源代码管理面板（DSH 原生右侧栏标签）：改动/暂存/提交/diff/分支切换与合并/抓取拉取推送/冲突清单/Git worktree，适配 DSH 0.1.6 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @shkzhang/dsh-file-link-menu | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @HaydenSmith1121/dsh-connect-trae-plus dsh-connect-trae 加固分支（基于上游 dingminhua/dsh-connect-trae v2.0.4）：插件自身启动失败时不再牵连整个 Harness。源码仓。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @jerry-l3/dsh-plugin-skill-picker DSH 编辑器插件：在「+」按钮右侧新增 Skill 选择按钮，为下一条消息选择 Skill（不选/单选/多选），并支持把本地 md/txt 文件注册为仅当前会话可用的临时 Skill | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @camplus360/agent-memory-bridge | medium | medium | queued | 0/2/22 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-session-ctxmenu DSH plugin: right-click a session/project row in the sidebar to open its Rename/Fork/Archive menu | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-conn-dot DSH plugin: green/red connection dot beside the sidebar brand showing WebSocket + liveness-probe health of dsh web | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @DWJZ/dsh-allow DSH 权限记忆插件：把某类命令加进允许列表，之后同类命令不再询问。 / Remember sandbox-escalation approvals so the same command prefix stops asking. | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-restart | medium | medium | queued | 0/3/4 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-session-cleanup Archived-session cleanup for the dsh web client: per-row delete and delete-all over the real session logs | lowD↓ | medium | low | 0/10/53 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-excel-viewer Spreadsheet preview for the DSH web client: xlsx / xlsm / xls / csv / tsv open as a read-only grid | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-ark-plans Volcengine Ark Agent Plan and Coding Plan model routes for DSH, with a session-header quota pill | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 06:13 |
| @qilin-zhu/dsh-model-relay 把DSH里已经配好的模型中转出去，让其他项目可以使用。 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @The-five-stooges/dsh-deepseek-usage DSH plugin: DeepSeek balance row in the sidebar footer plus a popover with locally estimated usage charts and a per-model cost table | medium | medium | queued | 0/1/9 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-balance DSH 余额查询插件：用 /balance 命令在会话里查看 DeepSeek 账户余额。 / DeepSeek account balance as the /balance command. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-opencode-go-plus OpenCode Go model provider for DSH - a maintained fork that keeps the model catalog reachable and configures itself from Settings > Models | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-memory Session-end memory for DSH: distils each turn into durable notes and recalls them per workspace | medium | medium | queued | 0/2/3 | 0/0 | 2026-09-18 06:13 |
| @AristotleAsborg/repo-autopilot-plugin 把 repo-autopilot 的只读检查注册成 DSH 工具｜doctor / drill / acceptance / compare｜只读、零凭证、零写入 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @cccc12138/dsh-read-aloud A speaker button beside the Like button: read any DSH reply aloud with the browser's own speech engine. · 在点赞旁加一个小喇叭，朗读 DSH 的回复。 | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 08:13 |
| @jackchen13755/dsh-file-tree DSH 原生右侧栏文件面板：工作区文件树 + 官方预览（着色）+ 一键 @文件 引用到输入框，适配 DSH 0.1.6 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @weifa860504-droid/dsh-greet-signoff 开场语与收尾语：每次回复固定开场/收尾，并在上下文接近上限时提示换新会话（DSH Web 插件） | low | low | not queued (low risk) | 0/0/9 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-devspace DevSpace nodes and remote-directory mirror Workspaces for the DSH: manage N MCP endpoints, adopt a remote directory as a local Workspace, and move files both ways | mediumD | medium | medium | 0/4/6 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-mcp-manager MCP server management for the DSH: register, edit, enable, disable and hot-mount MCP servers, with global defaults and per-project overrides | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-agents-md-manager AGENTS.md management for the DSH: every instruction level a Session loads in precedence order (user-global first, then project root to cwd), editable in place from a Settings page or from the model | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-auto-archive Auto-archive for DSH: archive sessions idle beyond a threshold, with full archived-session management UI · DSH 自动归档插件 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-skill-manager Skill management for the DSH: browse, author, toggle and delete skills across project and user roots, from a Settings page or from the model | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @usssserd/my-dsh-plugin DSH插件test | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-secrets-manager Project secret management for the DSH: monorepo .env discovery, comment-preserving edits, and a DSH_ENV_FILES pointer your shell commands can source | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-18 08:13 |
| @hoyyang/dsh-glm-mode GLM Mode: fully tuned coding agent preset for zhipuai/glm-5.3-flash in DSH — PTC presentation, guard family, isolated compaction | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-task-capsule DSH cockpit duo: session-header task capsule + task notification card (sound/system notify) · DSH 任务胶囊与通知插件 | lowD | low | low | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @cn-scuo-oo/dsh-session-auto-title DSH plugin: re-title a session after every turn in the MMDD｜类型｜主题 convention | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @kovey/dsh-engineering-suite Engineering suite for DSH: seven plugins covering roles, specifications, test design, quality gates, evidence, audit trail and pipeline orchestration | medium | medium | queued | 0/2/0 | 0/0 | 2026-09-18 08:13 |
| @Cumeskey/dsh-ssh-remote-tunnel | medium | medium | queued | 0/3/7 | 0/0 | 2026-09-18 08:13 |
| @Qihang-He/dsh-nyanko-sensei Nyanko-sensei desktop pet plugin for DSH Web: a round calico cat that idles, naps, wanders, reacts to clicks with a voice line, and follows agent activity. DSH 桌宠插件：娘口三三／猫咪老师。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @mingzhicode/dsh-interactive-terminal Persistent Bash terminals for DSH, letting humans take over and continue model-started sessions through an xterm.js UI. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @curtainsmall/dsh-reckoner Electrical & electronics calculation plugin for the DSH. 面向 DSH 的电气电子计算插件。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/wechat-agent-router | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/agent-manager | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-codex-provider Codex (ChatGPT) model provider for DSH - serves the ChatGPT subscription models the Codex CLI uses, over OAuth session credentials instead of an API key | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @jiawei322/dsh-pi-catalog-sync Sync the pi.dev model catalog into DSH llm-pi-ai provider routes through the official settings seam — no source patch — including mixed-protocol routes like OpenRouter, where new models land on a companion route while the built-in route stays untouched. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @xmzd-S/dsh-youdaonote dsh plugin about youdaonote | highD | high | high | 2/2/2 | 0/0 | 2026-09-18 10:13 |
| @winston-hoo/dsh-spec-ponytail DietrichGebert/ponytail — 懒惰 senior 模式，hook注入,迁移成dsh | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @fu827707013/dsh-model-health-probe DSH 模型健康检查：会话视图页签，选定供应商/协议/模型/路由后手动发真实裸 HTTP 请求，一屏看耗时、TTFT、状态、token 与三层诊断链。 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @wmw343/dsh-resume-expert 引导式简历生成插件：对话式四阶段 + A4 PDF 直出，双宿主验证 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-wallhaven-wallpaper DSH 插件：从 wallhaven.cc 搜图并铺成 GUI 背景，图片全由宿主端取回（支持代理，浏览器无需能访问 wallhaven），可一键下载原图。零运行时依赖。 | medium | medium | queued | 0/2/10 | 0/0 | 2026-09-18 10:13 |
| @ajceee/dsh-subscription-overlay | low | low | not queued (low risk) | 0/0/16 | 0/0 | 2026-09-18 10:13 |
| @asxiuxiu/dsh-quick-open DSH Web GUI plugin: VSCode-style Ctrl+P quick open — indexed workspace file search, sidebar editor open, conversation reference insert | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-18 10:13 |
| @Noob-stupid/dsh-plugin-gating-hub DSH 插件管理面板：一键启用/停用插件 + GitHub dsh-plugin 插件市场+自定义插件索引/市场，带插件详情与一键安装，一键框架升级自动回滚,插件升级门控 | Plugin manager & marketplace for DSH | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @rebornace/dsh-tracescope 基于 Git 代码差异智能缩减手工测试范围，支持 Web / 移动端操作录制与崩溃日志采集，依托 DSH AI 自动生成可复现缺陷流程，实现变更驱动的手工测试闭环提效插件。A DSH native test assistant plugin. It intelligently narrows manual test scope via Git diff, records web & mobile operation tracks and crash logs, and generates reproducible bug steps through AI analysis to close manual testing workflow efficiently. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @yumusb/dsh-opencode-go-plus | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-18 12:13 |
| @GooDAnDReaDY/dsh-session-search DSH agent tool (session_search) for full-text search across historical sessions | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @neufagents/dsh-healthcheck Runtime health check for DSH: session-library scan + crash-tail inspection. Read-only. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @Lukeknow0/dsh-markdown-link-preview Preview DSH Markdown output links inside Better Sidebar instead of an external app. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-18 12:13 |
| @Arcadia822/dsh-tmp-hook One-time ephemeral webhook plugin for DSH sessions: mint a single-use callback URL, then wake the requesting agent session with the delivered payload. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @NEVSTOP-LAB/dsh-import-vscode-ai-files Load VSCode/Copilot AI configuration (.github/copilot-instructions.md, .github/instructions, .github/skills) into DSH sessions. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @athif23/dsh-shell-select DSH plugin: one model-facing shell tool whose shell (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish, sh) is a user setting, with a Web settings card and a fail-closed refusal when the sandbox cannot confine it. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @elmersky/dsh-plugin-trellis-workflow Trellis workflow enforcement for the DSH: per-turn workflow state injection and a trellis-start entry gate, replacing the session-start and user-prompt hooks dsh does not ship. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @yukitakasama/dsh-context-lens Single-session context anatomy for the DSH Web GUI: attribution, headroom planning, and a context x trajectory timeline — not another usage ledger. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @KylinQ01/dsh-startup-animation 🌸 给 DSH 的开机动画 + 主界面壁纸：多层动效 + 鼠标视差，两张图可在设置里自由更换并实时预览 | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-18 12:13 |
| @leolee9086/dsh-tool-cordis-local DSH 独立创造模式工具集：不注册进程级 inspect provider，让创造模式预设可以被复制 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @OnTheWay111/dsh-plugin-path-completion DSH path completion（DSH @文件名自动补齐和发现） | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @wuuuuu123-32/physics-lab-report | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @frederico-kluser/dsh-worktree-jump DSH plugin: a web-UI button that creates a git worktree and moves the conversation into it (session fork with the worktree as cwd) | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @whyself/Amadeus Amadeus: a web workspace for DSH with cloud and web agents, online code editing, PDF/Office/Markdown/LaTeX previews, TeX compilation, file management, and an integrated terminal. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-18 12:13 |
Dynamic audit results · new today (5 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Plugin auto-installs the youdaonote CLI by piping a remote script into bash with no integrity check, and interpolates config values into that shell string; tool args themselves use safe argv arrays.
- highAuto-install pipes a remotely fetched install script into bash without integrity verification · lib/index.js:118
- mediumConfig and env-derived values are interpolated into a bash -c string with non-shell-safe quoting · lib/index.js:118
- lowAPI key is passed on the command line and therefore visible in the process list · lib/index.js:250
Host+browser plugin for managing remote MCP 'DevSpace' nodes; shell/path handling is well-quoted, but the model-facing transfer tools read and write arbitrary local paths, enabling exfiltration / file overwrite via a mal…
- mediumdevspace_pull writes remote-controlled content to an arbitrary local path (mkdir -p + open 'w') · index.js
- mediumdevspace_push reads an arbitrary local file and uploads it to the node (local secret exfiltration) · index.js
- lowDevSpace routes fail open when the optional 'connection' service is absent · index.js
DSH runtime path (index.mjs + lib/client.js + cordis.patch.yml) is benign; static warnings come from dev/example scripts that DSH never loads (2 low findings).
- lowDev boot harness reads the DSH session secret and evaluates served bundles in-process · dev/dsh-boot-check.mjs:141
- lowWrite guard skips every line carrying a 'check-ok'/'no-check' marker, so content can opt out of the check · scripts/core.js:22
All risky constructs live in manually-run dev scripts (localhost-only, fixed commands); no runtime-reachable risk was found in the supplied source.
- lowDev script spawns pnpm through a shell with a command name taken from an environment variable · scripts/install-profile.mjs:48
- lowRuntime entry points lib/index.js and lib/client.js are absent from the audited source · package.json:13
Loopback-only HTTP routes are gated by Host/Origin/Sec-Fetch-Site checks; no shell, eval, dynamic import, or outbound network; the 5 static warnings are defensive fs and relative-path fetch calls.
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 25,403 in-scope entries (25,094 scanned + 309 pending).
Static scan for reference: low 24,913 · medium 0 · high 180 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
79 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-18. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2899 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published