Daily security scan
Date · 2026-09-20 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report0
critical
0
high
31
medium
73
low
11 of 104 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallback1
critical
3
high
31
medium
69
low
Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no execution0
critical
0
high
7
medium
4
low
Tier = highest finding. Of 104 new entries: 11 with a conclusion, 23 queued, 1 failed (no conclusion), 69 low-risk not queued.
Data file updated 2026-11-06 07:30 (UTC+8); latest conclusion audited 2026-10-23 07:31 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @Fishsb/dsh-plugin-roundtable 圆桌会议 RoundTable — DSH 插件：把一次会话变成可视化、可辩论、可拍板的专家圆桌会议；含三种协作模式、调度面、红队评审与 28 席专家团 | 需 DSH 0.1.5-rc.1+ · MIT License | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 00:13 |
| @juzikexue/dsh-paper-digest | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-20 02:13 |
| @MYCF711/dsh-qoder-cli Qoder models in DSH — three-tier model catalog, credential failover, OpenAI-compatible shim, settings card | low | low | not queued (low risk) | 0/0/10 | 0/0 | 2026-09-20 02:13 |
| @EIGHTfs/dsh-session-migrate | medium | medium | queued | 0/2/9 | 0/0 | 2026-09-20 02:13 |
| @Gavin237/dsh-capability-hint DSH plugin: inject a one-line hint naming skills that match the current turn, so installed-but-forgotten methodology skills actually get used. Deterministic matching, no LLM calls, fail-open. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 02:13 |
| @DobroGnom/dsh-tab-title Keep the DSH browser tab title pinned and surface completion or attention alerts. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 02:13 |
| @LonelyHerbivore/dsh-image-question DSH Web plugin: ask the user a question with an image, annotate in the browser, get back structured annotations in source-image pixel coordinates. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-20 02:13 |
| @mrbeandev/dsh-reconnect English DSH retry plugin with exponential backoff and gateway recovery | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 04:13 |
| @lukepoo101/dsh-trusted-proxy-auth DSH plugin that trusts authentication already performed by a reverse proxy (Traefik + Keycloak OIDC) while keeping native DSH browser authentication as a fallback. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 04:13 |
| @dingchenhui0618-arch/dsh-taskwatch Read-only task monitor for DSH: sessions, background jobs, subagents, goals, workflows and pending approvals, as a phone-friendly page and a GUI sidebar panel. | medium | medium | queued | 0/2/5 | 0/0 | 2026-09-20 04:13 |
| @liuhao11223/dsh-oneclick-restart dsh重启按钮插件 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 04:13 |
| @x102201/dsh-helper-plugin-command-ask DSH的 /ask 模式插件：对标 Cursor Ask 的「只读问答一轮」。/ask <问题> 只回答、只引用实读内容、不改动任何东西，模式随该轮结束自动释放，之后普通消息照常执行；内置工具守卫强制只读，支持 link: 与 github: 两种安装。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 04:13 |
| @vanddccd/dsh-todo-dock DSH Web 任务面板重制：三段式进度条 + 已完成折叠 + transitions.dev 动效 | Rebuilt todo dock for DSH | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 04:13 |
| @mrbeandev/dsh-short-tool-ids DSH plugin that shortens tool-call IDs over 64 characters for OpenAI-compatible Chat Completions providers, with a per-provider toggle | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 06:13 |
| @mpetruc/dsh-model-sync Auto-populate and auto-update the list of llm-pi-ai providers' models. No more hand-typing and manually keeping up-to-date with your inference server. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-20 06:13 |
| @localSummer/dsh-group-chat DSH 模型群聊：多模型角色群组对话面板。角色绑定不同 provider/model，群内共享对话记录；设置页支持启用/停用。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 06:13 |
| @LoveIrishCoffee/dsh-effort-ultra DSH composer 的原生推理档位控件：蓝紫渐变 + 星点 + 流光的档位条，档位由每个模型自己的 reasoning 声明决定 / A native reasoning-effort control for the DSH composer | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-20 06:13 |
| @LoveIrishCoffee/dsh-effort-ultra-skin DSH 推理档位皮肤：把推理等级控件重绘成蓝紫渐变、带星点与流光的档位条 / Blue-violet Ultra skin for the DSH reasoning-tier control | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-20 06:13 |
| @MYCF711/dsh-plugin-forge dsh 插件锻造工坊：一支专家 Agent 团队，从零把 dsh 插件锻造到可发布版本 | An expert agent team that forges DSH plugins from zero to release | mediumD | medium | medium | 0/10/5 | 0/9 | 2026-09-20 06:13 |
| @Nwflower/dsh-claude-style Claude Code Desktop theme for DSH｜ 为 DSH 网页 GUI 打造的 Claude Code 桌面主题 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 06:13 |
| @gaoqiaoliangjie666/dsh-qwen-connect 将 QwenWork 桌面 App 包含的模型自动接入 DSH，零配置使用。Bring the models in the QwenWork desktop app into DSH with zero configuration. | lowD↓ | medium | low | 0/12/0 | 0/9 | 2026-09-20 06:13 |
| @MYCF711/dsh-websearch-direct 免 API Key 的 dsh 联网搜索 / 网页抓取插件：引擎=逻辑源、入口=直连/镜像/加速路由自动回退，不消耗任何模型 token | medium | medium | queued | 0/3/5 | 0/0 | 2026-09-20 06:13 |
| @Devin-AXIS/jev-dsh-decision Jev DSH 决策引擎｜面向 Agent Harness 的结构化决策插件。原生支持 DSH，通过 iPolloWork 支持 OpenCode、Codex Harness。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 06:13 |
| @DWJZ/dsh-mail-reader DSH 只读邮件插件：一个 email_read 工具读取 Gmail 与 Outlook，完全不实现发送、回复、删除、移动、标记或归档。 / Read-only mail for DSH: one email_read tool over Gmail and Outlook, with no send, reply, delete, move, mark, or archive capability. | medium | medium | queued | 0/3/4 | 0/0 | 2026-09-20 08:13 |
| @wjackiedev/dsh-session-manager Archived-session manager for the DSH Web GUI — restore and permanently delete session logs. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-20 08:13 |
| @x102201/dsh-helper-plugin-notify-away dsh-helper plugin: Cursor-style system notifications for DSH — silent while you watch the finishing session, toast when you have switched away. ｜ 中文：dsh-helper 插件——为 DSH 提供离开才通知的系统提醒，正在看这场会话时保持安静。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @olimc2016/dsh-token-meter-panel DSHToken 用量与花费面板插件：今日消费、预算进度、成本构成、缓存命中省下的钱。社区插件，非官方。 | medium | medium | queued | 0/1/15 | 0/0 | 2026-09-20 08:13 |
| @Exynos671/dsh-windows-notify Windows toast notifications for DSH: permission requests, branch/option choices and turn completion, plus a Settings -> General switch panel. | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-20 08:13 |
| @Ryuu-64/dsh-find-all DSH web plugin: a Cmd/Ctrl+F find bar for the DSH desktop shell that searches the WHOLE conversation, not just the rendered tail. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @KKKKeybird/dsh-turn-rail-persistent DSH plugin: keep the built-in conversation turn rail visible at every transcript width (un-hides the host rail on narrow transcripts). | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @LX2000WASD/dsh-plugin-manager-companion Companion to the official DSH plugin manager: pre-install quality gate, environment diagnostics, marketplace, and upgrades. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @Fnckerpoi/dsh-plugin-sirchmunk DSH集成sirchmunk插件管理。 | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-20 08:13 |
| @RrcoVer0/dsh-webnovel-writer Chinese web-fiction workflow skills for DSH: planning, file-backed memory, consistency review, rollback, and style profiling. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @SunlitCrack/dsh-skills-mcp-manager DSH 插件：设置页统一管理技能 / MCP 服务器 / 指令文件（AGENTS.md 家族） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @KKKKeybird/dsh-tool-bash-stream Streaming bash tools for DSH: read command output and react while it is still running | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 08:13 |
| @Yuuyuko-uu/dsh-tts-bridge DSH 朗读桥：会话里的话自动交给 DeepSeek 网页端朗读，声音从你自己的电脑里出来 | medium | medium | audit failed | 0/1/18 | 0/0 | 2026-09-20 08:13 |
| @Awoodwhale/dsh-agent-persona Workspace personas for DSH: many system-prompt personas, each scoped by workspace path or session id, managed from the Web settings page (Apache-2.0) | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 10:13 |
| @yueyexiayu/dsh-zhanshi DSH desktop plugin: show this-turn images and videos inline in the conversation | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 10:13 |
| @hzhgino/dsh-caonima 核动力草泥马 - DSH Web GUI desktop pet plugin for DSH | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 10:13 |
| @HandsYe/dsh-input-history 为 DSH 提供持久化输入历史，支持使用键盘上下方向键切换历史记录并恢复未发送草稿。Persistent input history for DSH with Arrow Up and Arrow Down navigation, draft recovery, deduplication, and local storage. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-20 10:13 |
| @HyperForce/dsh-workspace-lock Per-workspace password locks for the DSH web UI: right-click to lock, lock screen, admin master password. UI-level lock. | mediumD↓ | high | medium | 1/0/6 | 0/0 | 2026-09-20 10:13 |
| @YUYUY9527/dsh-plugin-management 外部插件管理器 for DSH: inventory + one-click update for a profile's third-party plugin packages. Settings -> Plugins UI + agent-facing tool. | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-20 10:13 |
| @yunxiyang/dsh-stepwise-distill Solidify DSH session history step by step: rewrite tool results in place to the facts the model actually kept, so long conversations stop re-sending noise every turn. Costs tokens and time: a ~770-character contract in every request, plus one extra full-context request and round-trip per step when stepSummary is on. | medium | medium | queued | 0/2/0 | 0/0 | 2026-09-20 10:13 |
| @SoyBeanMilkx/CompFlow Organize DSH sessions into nested, collapsible compositions. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 10:13 |
| @lanyunshijian/dsh-file-download 插件 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 10:13 |
| @7starsseeker/dsh-jev-guard DSH 执行前安全阀门:bash/pwsh 真正执行前先经静态规则 + TypeSafe Jev 语义判定,破坏性操作按 允许/修正/拦截/上报人工 四态处置,含额度降级与审计日志。 | mediumD↓ | critical | medium | 10/0/16 | 0/0 | 2026-09-20 10:13 |
| @PangXitong/dsh-restart-button 在DSH的设置中新增一个关闭/重启按钮 | mediumD | medium | medium | 0/8/6 | 0/0 | 2026-09-20 10:13 |
| @Bay-Zeddie/dsh-agent-instructions 在 dsh Web 设置页里编辑原生 AGENTS.md 的面板：链上每层可点选编辑，三种生效范围，并可视化官方指令预算。 | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-20 10:13 |
| @goodddGrades/dsh-behuman Long-term memory and self-evolving skills for the DSH · DSH 的长期记忆与自我演进能力 —— Plain Markdown on disk, no vector store | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 10:13 |
| @CLOUDinDREAM/dsh-cj2099-plugin 2099年的她 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 10:13 |
| @chen8923/dsh-task-progress Live progress for long-running DSH tasks: scripts report structured progress, the Web UI shows it in a floating overlay, a sidebar tab, and a settings page. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 12:14 |
| @jolaaa999/dsh-section-nav DSH plugin: section navigation rail and local chapter bookmarks for DSH chat answers | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @konglong87/dsh-input-list dsh 常用内容插件：保存、编辑提示词，点击回填输入框，不自动发送。 | lowD↓ | high | low | 1/0/0 | 0/0 | 2026-09-20 12:14 |
| @Chance722/dsh-inbox dsh 插件：把复制粘贴的链接、图片、文本、账密收进本地仓库，自动分类，能在对话里检索取回 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @zhangyy0423/veripipe An anti-false-positive verification pipeline for AI agents that test web/HTTP products. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @cup113/personal-track DSH插件：右侧栏每日习惯看板 + 主区域统计页。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @pioneer666-user/dsh-archify-manage DSH流程图管理插件：浏览 Archify 业务流程图目录、按 Git 附注标签阅读历史版本、保存版本。A workflow-diagram manager plugin for DSH. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @hawkongz/dsh-chat-locator Turn-rail settings for DSH Web: tick thickness, rail side, a curved length gradient anchored on the hovered tick, and a plain-text hover preview with adjustable lines, font size, and width. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 12:14 |
| @doremifaso12345/dsh-token-ledger a dsh plugin for token surveillance | medium | medium | queued | 0/2/4 | 0/0 | 2026-09-20 12:14 |
| @donghangxunlang-cmd/dsh-attention-health DSH上下文健康监测 + 内容退化守卫 + 零模型交接文档 | medium | medium | queued | 0/2/5 | 0/0 | 2026-09-20 14:13 |
| @xbzbing/dsh-openviking-manager OpenViking 的配置工具 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 14:13 |
| @Rice00/dsh-job-progress Live progress for long-running background jobs in DSH — a draggable floating ball with a per-session task panel showing done/total, speed and ETA. | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-20 14:13 |
| @Towzai/dsh-memory-jev Memory plugin for DSH: every memory read/write is a typed judgement by TypeSafe Jev (choice/noul). | mediumD | medium | medium | 0/5/8 | 0/0 | 2026-09-20 14:13 |
| @yuyuyyyyyyyyyyyy/dsh-project-memory Cross-session engineering memory for coding agents on DSH: durable per-project records of root causes, failed attempts and constraints, recalled into the prompt before the agent plans. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 14:13 |
| @Fishquito7/dsh-gitbash Give DSH a real bash tool on Windows: call bash directly, with no pwsh escaping and no quoting hell. | medium | medium | queued | 0/1/1 | 0/1 | 2026-09-20 14:13 |
| @SPX43JL/dsh-safekeep Unofficial Windows file-recovery guard for unattended DSH workflows | lowD↓ | high | low | 1/5/5 | 0/0 | 2026-09-20 14:13 |
| @Love-JourneY/dsh-search-plus 中文友好的 DSH 会话全文搜索 + 精确跳转定位（CJK-friendly session full-text search with precise jump-to-hit for DSH） | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 14:13 |
| @Yochor-Debug/dsh-float | mediumD | medium | medium | 0/13/48 | 0/0 | 2026-09-20 14:13 |
| @bbaz123/dsh-confirmation-resolution Post-task confirmation decision guard for DSH — balance output quality with real user impact. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 14:13 |
| @harmless0819-dev/dsh-agent-chat Turn-injection message channel between DSH agents on two machines: messages land in a log and are injected as context at the next agent step. | medium | medium | queued | 0/2/2 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-power-controls Close / restart DSH buttons in Settings > General, plus an opt-out auto-close that waits until every browser page has stopped beaconing. | medium | medium | queued | 0/3/3 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-whale-live2d Replace the whale widget static image with a Live2D model, stacked at identical geometry. Degrades to the static widget without Cubism Core. | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-20 16:13 |
| @Voellin/dsh-deephub-share DeepHub 的开放部分：零知识云端协议客户端，以及基于它的 DSH 插件 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-whale-emote Make the whale widget perform emotions: stickers pop out beside it, with sound and a speech bubble. Agent-triggered over local HTTP. | medium | medium | queued | 0/2/6 | 0/0 | 2026-09-20 16:13 |
| @kolawong/fast-compaction-dsh Verdict-based context compaction for DSH — replaces lossy LLM summaries with fast keep/truncate/drop decisions from jev-latest; everything kept stays verbatim. Port of tamaratran/fast-jev-compaction. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 16:13 |
| @elk-9527/dsh-vscode | low | low | not queued (low risk) | 0/0/10 | 0/0 | 2026-09-20 16:13 |
| @Ryuu-64/dsh-session-tools Let the agent start a new session, or send a message to another one. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @dashitongzhi/dsh-config-webdav-sync DSH plugin: bidirectional WebDAV sync for DSH configuration (providers, plugins, prompts, skills). Excludes sessions and credentials. Design inspired by farion1231/cc-switch sync protocol. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-codex-micro Turn a Vaydeer 9-key keypad into a DSH Codex Micro: the keypad sends unique combinations, the plugin maps them to DSH actions. | medium | medium | queued | 0/3/3 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-self-built-plugins Index of self-built DSH plugins, grouped by purpose: appearance, control, collaboration. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @YEJASONJIEXIN/dsh-whale-girl-pet 🐋 DSH 桌宠（胡桃语音 fork）：大小可调 + 16 角色语音播报 + 天气/余额宿主直连。基于 yanzwzz/dsh-whale-girl-pet 0.3.2。 | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-20 16:13 |
| @EdwardXiao-bit/dsh-run-button Adds a Run button to shell code blocks in DSH replies, executing the command on the host and streaming its output to a dock or a bottom-panel tab. 给 DSH 回复里的命令行代码框加一个「运行」按钮：在宿主机上执行该命令，输出显示在右下角浮动面板或底部面板标签页。 | medium | medium | queued | 0/3/7 | 0/0 | 2026-09-20 16:13 |
| @DDDMUC/dsh-delete-turn Per-message delete for DSH: remove a user message, one reply step, or a whole assistant reply from the derived model context via the official surface-replace contract, and hide it from the visible transcript without rewriting the append-only log. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 16:13 |
| @birew83538-oss/dsh-chat-thinking-editor DSH 插件：直接在 DSH 对话里编辑任意 AI 消息的正文与思维链（thinking）。保留 AI 的聪明，让 AI 完全符合你的心意。🐛 修复选中删除联动清空问题。| DSH plugin to edit any assistant reply + reasoning/thinking chain. Make the AI output truly yours. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @harmless0819-dev/dsh-persona-anchor Pin the persona into a system-prompt section so it never competes for the AGENTS.md 65536-byte instruction budget. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @xuzhougeng/ScientificFigureLibrary Local-first MCP App for scientific figures. Import, review, and publish a global library on disk; reuse exact templates in Pi, DSH, Claude, Codex, Cursor, and Wisp. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @gluztm/DSHGuard DSH守护壳：DSH的一键救援式启动器：改动快找存档、问题整组回滚、本地管理插件、诊断日志导出 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 16:13 |
| @PerryLink/jevcore TypeSafe Jev for DSH, the Model Context Protocol, and plain Node: typed judgments instead of prose, offline by default. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 16:13 |
| @gorban/dsh-job-stop DSH plugin: stop a running background job from the session-header job list, behind a confirmation dialog. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-20 18:13 |
| @GooDAnDReaDY/dsh-web-gateway Resilient web search and page extract tools for DSH with provider fallback and SSRF-safe extract | medium | medium | queued | 0/2/7 | 0/0 | 2026-09-20 18:13 |
| @GooDAnDReaDY/dsh-github-ops GitHub operations for DSH: releases, tags, a guarded API pass-through, sanitized mirror publication, workflow runs and repository settings. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-20 18:13 |
| @HorusJiang/dsh-jev-tools Jev judgment, not generation: prune long tool output, screen fetched pages for injected instructions, and gate completion claims inside DSH. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 18:13 |
| @MosesCharm/dsh-sidebar-stack Stack DSH sidebar footer actions vertically — no more cramped single row for cost-meter / context plugins | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 18:13 |
| @mengge237/dsh-model-priority DSH 插件：自定义模型/提供方顺序——侧边栏拖拽排序，宿主的模型列表按这份顺序返回；顺序写进 settings.yaml 前自动备份 | lowD↓ | medium | low | 0/7/10 | 0/0 | 2026-09-20 18:13 |
| @AMC-tp/dsh-work-buddy Pixel desk buddy for the DSH Web GUI: slacks off when idle, thinks and types while a turn runs, throws confetti when it finishes, and tallies completed turns. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 18:13 |
| @shenA2024/whale-persona-presets whale-persona 的人设内容包：现成的预设 JSON（一句立场 + 逐条可勾选的工作契约）。引擎在本体仓，出厂空白。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 18:13 |
| @A8Chann/dsh-pet-live2d DSH Web GUI 的 Live2D 桌宠插件：可拖动、跟随鼠标、跟着会话状态换动作与表情，右键面板可换装 | low | low | not queued (low risk) | 0/0/9 | 0/0 | 2026-09-20 18:13 |
| @dsh-so/dsh-plugin-finder Natural-language plugin search for DSH - ask what you need, get matching dsh.so plugins with install commands. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 19:20 |
| @mrbeandev/dsh-flowglass English-only Flowglass plugin for DSH, based on Iwctwbh/dsh-flowglass | medium | medium | queued | 0/3/2 | 0/0 | 2026-09-20 20:13 |
| @Saretheya/dsh-tick Session-local scheduled tasks for DSH: inject a prompt into the current session after a delay, at a fixed time, or on a repeating interval — with a Web management panel, a /schedule command, and model-facing management tools. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-20 20:13 |
| @Underwater008/deepshell A native macOS shell for the official DSH. No Electron, no telemetry, no vendor gateway — ~150 lines of Swift + one bash script. | mediumD | medium | medium | 0/15/20 | 0/0 | 2026-09-20 20:13 |
| @lijiawei255/dsh-status-chime Spoken status alerts for DSH where clip LENGTH encodes urgency: a 2s approval chime vs an 8s failure announcement. Eight scenes, zero third-party dependencies on Windows 10/11. · DSH 语音状态提示：用时长编码紧急度，零第三方依赖。 | medium | medium | queued | 0/2/14 | 0/0 | 2026-09-20 22:13 |
| @Aliww2468/dsh-client-ui-aqua-patched Unofficial patched fork of the Aqua glassmorphism theme for the DSH web UI, repaired for DSH 0.1.2-rc.1 (upstream 1.3.1 crashes there) | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-20 22:13 |
| @rbviz/dsh-plugin-jules | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-20 22:13 |
Dynamic audit results · new today (11 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
User-driven, cookie-authenticated harness plugin; its OS/network powers are mostly guarded, but enabling Remote publishes the loopback harness publicly via Tailscale Funnel.
- mediumEnabling Remote publishes the loopback harness to the public internet via Tailscale Funnel · packages/dsh-phone-connect/lib/tailscale.js:105
- lowConfig 'label' is unvalidated and used to build a file path and launchctl arguments · packages/dsh-phone-connect/index.js:169
- lowvideo_qa reads a model-chosen absolute path and uploads the file to a remote endpoint · packages/dsh-video-qa-moonshot/index.js:74
Audited files are dev-only tooling excluded from the npm package; the shipped runtime lib/index.js and lib/client.js are missing from the corpus and could not be verified.
- mediumShipped runtime code (lib/index.js, lib/client.js) is absent from the audited corpus · package.json:6
- lowDev scripts take the token-bearing GUI URL as a command-line argument · tools/market-check.mjs:19
Scanner criticals are unreachable probe fixtures; the real residual risk is that every gated command and script body is sent unmasked to api.typesafe.ai.
- mediumGated command text and enriched script bodies leave the machine unmasked to api.typesafe.ai · tools/probe-scripts.mjs:92
- lowAudit log persists full commands with prefix-only masking and default file permissions · lib/audit.js:95
- lowOffline harvester reads the user's full bash history and DSH session command logs · tools/extract-commands.mjs:92
Memory plugin's design is mostly sound (fixed-arg shell, escaped injection), but entries the plugin itself flags as secret still have their titles shipped to the remote Jev endpoint.
- mediumTitles of entries the plugin itself flagged as sensitive are still sent to the remote Jev endpoint · lib/index.js:1242
- lowEgress guard is disabled in the shipped default config, so secret-bearing queries reach OpenRouter · lib/index.js:53
- lowStored memory text is re-injected as a user message with only '<' escaped, so embedded instructions survive · lib/index.js:219
Runtime entry lib/index.js only injects a system-prompt section, but that text steers the agent to install an unpinned third-party GitHub package; build/install scripts hardcode machine paths.
- mediumInjected system prompt tells the agent to install an unpinned third-party GitHub package · lib/index.js:30
- lowPreset generator hardcodes machine-specific absolute paths into generated personas · scripts/make-forge-presets.mjs:7
- lowInstall script overwrites skills/presets under a user-supplied DSH_HOME and appends to AGENTS.md · scripts/install-assets.mjs:22
Host half exposes unauthenticated POST /close and /restart routes that exit or relaunch the DSH process; command building itself is correctly quoted (no injection).
- mediumUnauthenticated POST /dsh-restart-button/close|restart can terminate or relaunch the DSH process · lib/index.js:138
- lowFull process environment (incl. tokens) persisted to a predictable temp PowerShell file on Windows · lib/index.js:51
Host routes leak salted password hashes, allow unauthenticated first-time admin-set and unauthenticated lock overwrite; the static critical was an eval in a non-shipped smoke harness.
- mediumLock list endpoint returns salts and password hashes to any admitted client · lib/index.js:201
- mediumFirst-time admin-set requires no authentication and mints a master password · lib/index.js:304
- mediumPOST /set overwrites an existing workspace lock without verifying the current password · lib/index.js:214
Snippet-saving host+client plugin with no network, shell or filesystem use; the only eval-like code is an unreachable path inside the bundled schemastery library.
- lowBundled schemastery contains a new Function() path, but no schema in this plugin supplies a string callback · index.js:226
No exploitable path: state routes are Host/Origin/Sec-Fetch-Site fenced, the key proxy is token-gated, config rewrites are validated permutations; only low hardening gaps remain.
- lowOrigin fence compares hostname only, so a page on another loopback port can blind-write config · lib/index.js:754
- lowQuota status is read from another local tool's state file outside DSH_HOME · lib/index.js:653
Only dev/research .mjs probes plus cordis config were visible; none is loaded by the dsh-qwen-connect runtime, so the 8 static warnings are refuted.
Refuted scan critical: pwsh is spawned via execFile with fixed args and command on stdin, no shell, so not injectable. Residual risk is low only.
- lowGuard resolves pwsh via env var / bare name instead of a pinned absolute path · lib/storage.mjs:11
- lowSecurity-critical guard modules and PowerShell helper scripts are absent from the reviewed source · lib/powershell.mjs:8
- lowPowerShell analyzer creates snapshots only for cmdlet writes; .NET member-call mutations get none · lib/powershell.mjs:9
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 25,430 in-scope entries (25,102 scanned + 328 pending).
18
critical
305
high
1,093
medium
23,686
low
Static scan for reference: low 24,919 · medium 0 · high 181 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
81 reports2026-11-050 added0 crit0 medium2026-11-044 added0 crit2 medium2026-11-030 added0 crit0 medium2026-11-02163 added2 crit5 high58 medium2026-11-010 added0 crit0 medium2026-10-310 added0 crit0 medium2026-10-30316 added2 crit4 high140 medium2026-10-29216 added2 crit8 high92 medium2026-10-28277 added2 crit6 high106 medium2026-10-270 added0 crit0 medium2026-10-2628 added0 crit10 medium2026-10-25200 added0 crit4 high80 medium2026-10-24166 added2 crit8 high73 medium2026-10-23218 added4 crit3 high87 medium2026-10-22193 added1 crit6 high49 medium2026-10-21220 added0 crit4 high65 medium2026-10-200 added0 crit0 medium2026-10-190 added0 crit0 medium2026-10-18609 added1 crit17 high204 medium2026-10-17306 added0 crit0 medium2026-10-160 added0 crit0 medium2026-10-15110 added1 crit5 high42 medium2026-10-1499 added1 crit33 medium2026-10-13102 added1 crit4 high32 medium2026-10-120 added0 crit0 medium2026-10-110 added0 crit0 medium2026-10-10104 added0 crit2 high38 medium2026-10-098 added0 crit1 high0 medium2026-10-08100 added0 crit39 medium2026-10-070 added0 crit0 medium2026-10-060 added0 crit0 medium2026-10-050 added0 crit0 medium2026-10-0472 added0 crit2 high28 medium2026-10-0388 added0 crit2 high34 medium2026-10-0299 added1 crit4 high43 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit6 high45 medium2026-09-2969 added0 crit5 high17 medium2026-09-2864 added0 crit2 high21 medium2026-09-2763 added0 crit3 high20 medium2026-09-2684 added0 crit3 high26 medium2026-09-2545 added1 crit4 high20 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit1 high28 medium2026-09-2259 added1 crit2 high16 medium2026-09-2165 added0 crit2 high21 medium2026-09-20current104 added1 crit3 high31 medium2026-09-1981 added0 crit4 high32 medium2026-09-1872 added0 crit1 high13 medium2026-09-1770 added1 crit4 high20 medium2026-09-1567 added2 crit2 high30 medium2026-09-1482 added1 crit1 high29 medium2026-09-1343 added0 crit1 high14 medium2026-09-1284 added0 crit2 high27 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit1 high16 medium2026-09-0948 added0 crit1 high14 medium2026-09-08922 added2 crit62 high239 medium2026-09-0743 added0 crit5 high10 medium2026-09-0614 added0 crit1 high2 medium2026-09-0565 added0 crit14 high6 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit15 high15 medium2026-09-0285 added0 crit11 high8 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit48 high39 medium2026-08-2733 added0 crit6 high9 medium2026-08-26253 added0 crit38 high36 medium2026-08-25336 added1 crit51 high55 medium2026-08-24327 added4 crit41 high38 medium2026-08-23370 added2 crit73 high46 medium2026-08-2212 added0 crit2 high4 medium2026-08-212656 added8 crit290 high219 medium2026-08-20597 added5 crit84 high76 medium2026-08-191301 added12 crit273 high129 medium2026-08-184003 added22 crit999 high353 medium2026-08-17142 added1 crit36 high13 medium2026-08-16189 added0 crit53 high27 medium2026-08-15348 added5 crit144 high22 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-20. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2899 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published