Daily security scan
Date · 2026-09-19 (UTC — plugins first indexed that day)
81
added
0
critical
36
medium
45
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @tynr426/dsh-relationship | medium | warn | 0/6/8 | 0/3 | 2026-09-19 02:13 |
| @appthin/dsh-skills-manager-plus 在 DSH 设置界面的左侧边栏新增「技能与命令」页面， 可直接查看、启用/停用、编辑、删除与添加技能，还能把常用的提示词保存为命令， 在输入框输入 `/` 即可快速调用。Adds a *Skills & Commands* page to the left sidebar of the Settings screen, where you can view, enable/disable, edit, delete and add skills, and save frequent prompts as `/commands` that you invoke by typing `/`. | medium | warn | 0/1/9 | 0/0 | 2026-09-19 02:13 |
| @buberlo/dsh-jev Jev-powered decision layer for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-19 02:13 |
| @wild-River2016/dsh-canvas-xiaohe DSH 插件 - 小禾画布 AI 创作助手 | medium | warn | 0/2/4 | 0/0 | 2026-09-19 04:13 |
| @HaydenSmith1121/dsh-wallpaper-engine Wallpaper Engine Steam Workshop browser for DSH: anonymous search & browse the workshop from a sidebar panel, steam:// subscribe deep-links, Steam login detection. | low | pass | 0/0/7 | 0/0 | 2026-09-19 04:13 |
| @Stellight/dsh-chat-rail DSH 中文插件：对话区右缘的网页版风格导航竖线——每条人类消息一根短横线，靠近展开可跳转的消息列表，并支持回溯更早的历史 | low | pass | 0/0/2 | 0/0 | 2026-09-19 04:13 |
| @iimaguest/dsh-sandbox-escalation-guard DSH plugin: stops the sandbox escalation fields being advertised to a model when the calling session cannot grant them, fixing the retry loop known models fall into at danger-full-access. | low | pass | 0/0/1 | 0/0 | 2026-09-19 04:13 |
| @shkzhang/dsh-appearance DSH外观设置 | low | pass | 0/0/8 | 0/0 | 2026-09-19 04:13 |
| @jianjianzhu/dsh-model-switcher Visual custom-provider presets and model switching for DSH Web. | medium | warn | 0/6/6 | 0/0 | 2026-09-19 06:13 |
| @CharlesXu-HQ/dsh-dream-rsi Experimental replay-based exploration-policy plugin for DSH | medium | warn | 0/1/0 | 0/0 | 2026-09-19 06:13 |
| @meihaoyidian/life-workbench dsh插件：个人工作台插件 | medium | warn | 0/1/2 | 0/0 | 2026-09-19 06:13 |
| @isayrhythm/dsh-plugin-repo-snapshot DSH plugin: encrypted workspace repo snapshots (including .git) backed up to your own local folder or Aliyun OSS, with a built-in settings page. | medium | warn | 1/0/8 | 0/0 | 2026-09-19 06:13 |
| @wupup/dsh-custom-style dsh web custom style plugin | low | pass | 0/0/13 | 0/0 | 2026-09-19 06:13 |
| @BaiZhi967/dsh-plugin-zcode-import DSH 会话导入插件：按工作区浏览本地 ZCode 的会话，勾选或整工作区导入 DSH · Import local ZCode conversations into DSH | medium | warn | 0/1/9 | 0/0 | 2026-09-19 06:13 |
| @BotHarness/dsh-skill Full-stack DSH plugin development skill — generated mirror of BotHarness/BotHarness. Install: npx skills add BotHarness/dsh-skill | low | pass | 0/0/0 | 0/0 | 2026-09-19 06:13 |
| @syx2bzd/dsh-ricewhale DSH Web 界面的「鲸鱼女仆」物理挂件：拖拽投掷、撞边回弹、撒币吃分连击，每吃满 500 个 token 冒一碗白饭。 | medium | warn | 1/7/11 | 0/0 | 2026-09-19 06:13 |
| @Hotsteel2901/dsh-frutiger-aero 🫧 Frutiger Aero skin for DSH: glass over a living sky-and-water wallpaper, aqua gloss, light + dark. Rebuilds the phone layout too — drawer, dock, edge swipes, keyboard-aware composer. 玻璃质感皮肤，电脑端与手机端都适配。 | medium | warn | 0/1/7 | 0/0 | 2026-09-19 06:13 |
| @hj01857655/dsh-theme-studio dsh plugin: customize UI theme with presets, accent colors, density, radius, fonts, and custom CSS | low | pass | 0/0/3 | 0/0 | 2026-09-19 08:13 |
| @Hwayn-pixel/dsh-image-skin Universal image skin for the DSH web UI - replace large UI regions and corner stickers with your own images, GIFs, or videos, from a settings submenu. | medium | warn | 0/1/10 | 0/0 | 2026-09-19 08:13 |
| @bigscientist/LLM-for-novel-with-history-and-superheroines | medium | warn | 0/3/3 | 0/3 | 2026-09-19 08:13 |
| @hdhgsysh/dsh-connect-qoder Bridge local Qoder / Qoder CN models into DSH | medium | warn | 0/5/15 | 0/0 | 2026-09-19 08:13 |
| @IvenKooLab/loci-dsh 🧠 loci second brain as a DSH web plugin — search / ask / remember your local knowledge base from the sidebar | medium | warn | 0/2/17 | 0/0 | 2026-09-19 10:13 |
| @masknull/dsh-qoder-connect 将 Qoder（国内版 / 国际版）的模型以个人访问令牌（PAT）接入 DSH —— 双变体独立配置、侧栏额度展示、上下文窗口一键切换。|Qoder CN & international models for DSH via PAT. 支持 DSH 0.1.5-rc.1+。 | medium | warn | 0/3/12 | 0/0 | 2026-09-19 10:13 |
| @jianjianzhu/dsh-harness-ui Full-page Harness console for the DSH Web GUI: sessions, plugins, market, MCP, skills and usage in one shell. | low | pass | 0/0/12 | 0/0 | 2026-09-19 10:13 |
| @YerenChina/dsh-memory-webdav-sync 把 DSH 的记忆文件双向同步到任意 WebDAV 服务器（带设置界面） | medium | warn | 0/4/16 | 0/0 | 2026-09-19 10:13 |
| @AbsoluteMikhail/dsh-locale-ru Полная русская локализация веб-интерфейса DSH | low | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @YUsaltyfish/dsh-fish-sound-notify DSH bundle: a Windows system sound when the agent asks a question /a turn ends/a permission request | medium | warn | 0/1/0 | 0/0 | 2026-09-19 10:13 |
| @2404723600/dsh-router-loomy DSH plugin: Loomy (iFlyTek) OpenAI-compatible supplier for dsh-router | low | pass | 0/0/2 | 0/0 | 2026-09-19 10:13 |
| @AloneFu/dsh-calendar-plugin | medium | warn | 0/3/15 | 0/0 | 2026-09-19 10:13 |
| @Qulierm/orbital-agents Paired Endeavour and Challenger agents for DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @HFUT-zhengjiahao/dsh-balance DeepSeek API balance, conversation token usage, and CNY cost estimation for DSH | low | pass | 0/0/7 | 0/0 | 2026-09-19 10:13 |
| @ZZJQ678/dsh-model-picker 按渠道商（Provider）分组、可折叠的 DSH 模型选择器：替换聊天输入框右下角原生选择器。仅在 DSH 桌面版实测通过，Web 版未测试。 | low | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @HFUT-zhengjiahao/dsh-process-control Local-only stop and restart controls for DSH — a sidebar plugin with loopback-only process routes | medium | warn | 0/2/6 | 0/0 | 2026-09-19 10:13 |
| @hfdsdfgr/dsh-balance-bar DSH Web plugin: live account balance as a colour-banded vertical progress bar on the right edge of the GUI, with an animated wave above the threshold. | medium | warn | 0/1/11 | 0/0 | 2026-09-19 10:13 |
| @huxin7735-collab/dsh-maintainer-doc-guard Keeps a long agent turn answerable to the user's actual request: a standing maintainer-document reminder, two pre-execute gates, an objective anchor quoting your latest instruction, and a nudge stage that corrects before it blocks. | medium | warn | 0/2/5 | 0/0 | 2026-09-19 10:13 |
| @1622352030/ansys-agent-bridge MCP server driving Ansys SpaceClaim headlessly through PyAnsys Geometry, plus a DSH plugin bundle. Guards the operations that report success without changing geometry. | medium | warn | 0/2/0 | 0/0 | 2026-09-19 10:13 |
| @yq1930/dsh-skin-asuka-p01 | low | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @ubik-dsh/deepseek-mods DSH mods: an editable system prompt in the chat header, a Russian language pack, and a mod manager in Settings. Bilingual docs, one-command install. | medium | warn | 0/2/20 | 0/0 | 2026-09-19 10:13 |
| @rezon-aki/dsh-memory-steward 记忆管家：为 dsh-memory-evolve 补上记忆入库之后的生命周期闭环——预算看门狗、整理到期提醒、待审批队列与审批 Tab、带备份执行。只读观测记忆文件，写入一律回调上游官方 HTTP API。 | medium | warn | 0/4/15 | 0/0 | 2026-09-19 12:13 |
| @wwwort/dsh-win-computer-use Windows-native computer use for DSH: one batch tool runs a whole find/click/type/wait/screenshot sequence in a single model round trip, and drives windows without taking your focus or pointer. | medium | warn | 0/5/4 | 0/0 | 2026-09-19 12:13 |
| @tcgbp/dock-flash Extensible quick-control panel for DSH Web — switch registry, skin manager, standalone or with dock-base. | medium | warn | 0/2/7 | 0/0 | 2026-09-19 12:13 |
| @Furdavus/dsh-uyghurche-ui DSH Web 界面维吾尔语（UEY）语言包：官方 locale API 注册 ئۇيغۇرچە，1,069 条界面文案（逐 key 英文回退）+ 全界面 RTL 镜像 + Intl 本地化 | low | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @shenA2024/whale-persona 多宿主人设引擎：一份 config.json 让 DSH 与 ZCode 共用同一套人设、工作契约、思维链语言与长期记忆；记忆由 AI 提议、人工确认后才生效（代码强制）。A persona engine for AI coding harnesses (DSH + ZCode). | low | pass | 0/0/6 | 0/0 | 2026-09-19 12:13 |
| @Shadoso-w/dsh-cli-mode Command-line mode for the DSH web GUI: a composer line starting with ！ or ! runs as a real command in the session workspace instead of being sent to the model. | medium | warn | 2/1/8 | 0/0 | 2026-09-19 12:13 |
| @happyDABAI7/JiaFangTool OCR，语音识别，ai问答 | low | pass | 0/0/9 | 0/0 | 2026-09-19 12:13 |
| @ewoowe/dsh-plugin-graph-plugin Plugin dependency graph for DSH: which plugin provides the services every other plugin injects, read from the live Cordis runtime. | low | pass | 0/0/5 | 0/0 | 2026-09-19 12:13 |
| @john-walks-slow/dsh-wait-subagent wait_subagent tool for DSH: block until a background continuable subagent settles and return its stop reason and closing message — event-driven, zero polling. | low | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @dhdbvcg/opencodeAI | low | pending | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @wywincl/data-analysis-agent data analysis agent for everyone | low | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @Jaylor-Wang/dsh-tool-antigravity | low | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @EPCN-fla/dsh-vscode-bridge Cordis plugin bridging the dsh-vscode extension to native DSH services (workspace grouping, session titles, archive, agent presets, permission presets) over a token-authenticated local JSON-RPC socket. | low | pass | 0/0/2 | 0/0 | 2026-09-19 12:13 |
| @Yazzyk/dsh-file-shield DSH 插件：在 Web GUI 里点选文件或目录，屏蔽 agent 对它们的读取、搜索、写入与编辑，使机密内容与敏感词不进入对话（含敏感词导致请求 400 的场景）。Blocks an agent from reading/searching/writing/editing chosen files, keeping their contents out of the conversation. | low | pass | 0/0/1 | 0/0 | 2026-09-19 14:13 |
| @Archer76/dsh-memory-evolve-suite DSH 长期记忆插件（dsh-memory-evolve 的再分发构建）：分层记忆・待办・技能自进化・外部 CLI 调度，另内置 3 份记忆运维技能与 14 个配套脚本 | low | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @Meowrium/dsh-copy-file-path dsh plugin: adds 复制相对路径 / 复制绝对路径 (copy relative / absolute path) to the delivered-file card menu of the DSH web UI. / dsh Web 交付文件卡片菜单增加复制相对路径与复制绝对路径。 | low | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @YouHui1/dsh-sessions-diagnosis Diagnose and repair DSH sessions that stopped opening after a harness upgrade — from the CLI, from an agent tool, or from a dashboard in the DSH web UI. | low | pass | 0/0/6 | 0/0 | 2026-09-19 14:13 |
| @karottc/dsh-plugin-workspace-sorted 让 DSH 的 **工作区（Workspace）** 按「最近使用」排序的宿主（Host）插件。 侧边栏自带的「排序方式：手动排序 / 最近更新」只作用于**会话**；工作区分组的顺序永远是 Host 注册表的持久顺序。本插件让最近有活动的那个工作区排到最前面。 | low | pass | 0/0/1 | 0/0 | 2026-09-19 14:13 |
| @Voyage-He/dsh-novel-studio | low | pass | 0/0/3 | 0/0 | 2026-09-19 14:13 |
| @yaodongH/dsh-better-summary DSH Web 插件：Codex 风格的改动汇总卡片，替换对话末尾的产出 chip 行。 | low | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @ewoowe/dsh-plugin-dependency-graph-plugin Plugin dependency graph for DSH: which plugin provides the services every other plugin injects, read from the live Cordis runtime. | low | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @senyayume/dsh-edit-diff DSH 插件：在文件变更工具卡片上重绘行级 diff（相同行只渲染一次 + 行内字符高亮），覆盖 run_code(PTC) 与 str_replace_editor，轮末给出改动汇总卡，并可在资源管理器中定位或复制路径。 | medium | warn | 0/1/0 | 0/0 | 2026-09-19 14:13 |
| @MoseeVision/dsh-quick-archive DSH plugin: one-click archive button on every sidebar session row, beside the session menu / 侧边栏会话行的一键归档按钮 | low | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @YuMS/dsh-duet | low | pass | 0/0/8 | 0/0 | 2026-09-19 14:13 |
| @mustakimabdullah25-tech/dsh-screen-translator Universal on-screen translator for DSH Web UI: translates UI text, attributes, Shadow DOM, and iframes across 45+ languages. | low | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @Pingze-github/dsh-cost-audit | medium | warn | 0/5/19 | 0/0 | 2026-09-19 14:13 |
| @TaoYe599/dsh-notify Task completion and needs-you notifications for DSH — web notification while the page is open, native Windows toast when the browser is closed. · DSH 任务完成/待回复通知：页面开着弹网页通知，浏览器关掉由 Host 弹原生通知。 | medium | warn | 0/3/4 | 0/0 | 2026-09-19 16:13 |
| @rsdgnchen/dsh-bottom-dock DSH Web 插件：把官方右侧栏 dock（终端/文件树/文档预览）整体搬到底部，仿 iOS 上滑横杠唤出、可拖拽调高。不改官方代码，只用官方 data-* 钩子重定位；探测不到官方结构时完全惰性。 | medium | warn | 0/1/2 | 0/0 | 2026-09-19 16:13 |
| @rinttt233/dsh-peak-brief DSH峰谷调度插件：高峰前 N 分钟自动生成仅供 AI 恢复用的简报并停自动续跑，高峰硬挡模型请求（带一键逃生），闲时自动注入简报继续任务。 | low | pass | 0/0/6 | 0/0 | 2026-09-19 16:13 |
| @WoodSettler/dsh-local-proxy DSH plugin: discover this machine's HTTP proxy (explicit .env value, else the Windows system proxy) and make DSH use it - for the agent's in-process fetches and for every child process it spawns. | medium | warn | 0/2/4 | 0/0 | 2026-09-19 16:13 |
| @PerryLink/dsh-plugin-upgrade-016 Corridor folded into dsh-plugin-upgrade 2.0.0 (never published under this name): its 0.1.5-rc.2 -> 0.1.6-alpha.2 card and E1-E5 scanner live in that package now. | low | pass | 0/0/0 | 0/0 | 2026-09-19 16:13 |
| @OzzyDeng-JunDeng/dsh-keyless-search Keyless web search for the DSH web_search tool — Tavily and Firecrawl no-key access, no account or configuration. | low | pass | 0/0/5 | 0/0 | 2026-09-19 16:13 |
| @imtokenxinluo/dsh-contract-check Zero-token contract check for DSH plugins — verifies output.render() / session-event vocabulary, warn-only. 无耗检查：DSH 插件契约体检，零 token 成本，只告警不拦截。 | low | pass | 0/0/2 | 0/0 | 2026-09-19 18:13 |
| @xiazhi88/dsh-onecompany 一人公司 · DSH 多 agent 公司编排插件（CEO/项目群/大厅/@派活/审批/排班/工作日志） | low | pass | 0/0/1 | 0/0 | 2026-09-19 18:13 |
| @JRJRJPRO/dsh-tree 把 对话分支 画成 可点击的树 | low | pass | 0/0/4 | 0/0 | 2026-09-19 18:13 |
| @reisen-ww/dsh-bonk-pet 敲盆宠物 · DSH 悬浮小鲸鱼插件：出错掉钢管、敲铁盆、讨白饭 | medium | warn | 0/3/13 | 0/0 | 2026-09-19 18:13 |
| @lucagiftzek/dsh-mail DSH plugin for agent email tools: send, mass send (CSV-personalised), scheduled queue, inbox read, domains. Multi-provider: Lettermint, AgentMail, Resend, OVH SMTP, manual SMTP, local self-host. | low | pass | 0/0/14 | 0/0 | 2026-09-19 20:13 |
| @ufiredong/dsh-interviewer DSH 模拟面试面板 + 技能：真实模型当面试官，读简历层层追问、按证据打分并推导薪资区间。面试官是考官，不是助教。 | medium | warn | 0/7/14 | 0/0 | 2026-09-19 20:13 |
| @ireza7/dsh-persian-rtl Persian (Farsi) RTL fix for DSH: automatic per-paragraph direction for assistant answers, thinking cells, tool cells and question boxes | low | pass | 0/0/0 | 0/0 | 2026-09-19 20:13 |
| @zhuchuovo/dsh-swarm-orchestrator DSH 插件：并行子代理集群 —— 母代理把目标拆成切片，并发驱动多个独立子代理写代码，输入框上方实时显示每个子代理此刻在做什么，并发数与各切片模型可在设置页配置。 | low | pass | 0/0/3 | 0/0 | 2026-09-19 20:13 |
| @yangdongzhen590/dsh-knj-version-control KNJ version-control workbench for DSH: local changes, per-file and multi-file staging, confirmed commit/update/push, and readable Git failure output. | medium | warn | 0/1/1 | 0/0 | 2026-09-19 20:13 |
| @lldois/dsh-jev TypeSafe Jev System One semantic tool routing and typed decisions for DSH | medium | warn | 2/0/4 | 0/0 | 2026-09-19 22:13 |
| @libre-webui/dsh-native-provider Use DSH providers in Libre WebUI over a private local connection. | low | pass | 0/0/2 | 0/0 | 2026-09-19 22:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
36 reports2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-19current81 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-19. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published