Daily security scan
Date · 2026-09-21 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report10 of 65 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 65 new entries: 10 with a conclusion, 11 queued, 3 failed (no conclusion), 41 low-risk not queued.
Data file updated 2026-11-06 07:30 (UTC+8); latest conclusion audited 2026-10-20 00:21 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @yueyexiayu/dsh-shengcheng DSH desktop plugin: generate images with logged-in Grok/GPT accounts, and videos with Grok | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 02:13 |
| @corlinniu/dsh-daily-chat 给DSH增加日常聊天功能 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-21 02:13 |
| @hi-wenw/dsh-csv-viewer DSH Web CSV and TSV table viewer with search, sorting, raw mode, and virtualized rows | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 02:13 |
| @awol2005ex3/dsh-cas DSH 插件: 用于实现CAS SSO单点登录 | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @shenbimicro233/dsh-reasoning-effort-inject | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-ecosystem-panel DSH plugin: read-only ecosystem health panel - bundle / patch / skill / upgrade / decoupling diagnosis in one view | DSH 插件：只读生态健康面板，六类体检一屏看完 | medium | medium | queued | 0/3/15 | 0/0 | 2026-09-21 04:14 |
| @zhy5/wxbridge DSH plugin: connect WeChat (official iLink/ClawBot) to DSH — live status settings panel + bundled bridge/keeper kernel | mediumD | medium | medium | 0/10/26 | 0/0 | 2026-09-21 04:14 |
| @hoyyang/dsh-best-ponytail Ponytail lazy-senior-dev ruleset for DSH: 7-rung minimal-code ladder, six skills (review/audit/debt/gain/help), /ponytail session command, optional always-on injection. MIT, upstream unmodified. | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @arrow1031/dsh-qq-bot DSH plugin for QQ-Bot adataper | medium | medium | audit failed | 0/3/14 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-session-title-live DSH plugin: live session titles with state prefixes (running/done), pin-safe and fully configurable | DSH 插件：会话标题实时刷新 + 状态前缀，pin 安全、可配置 | medium | medium | queued | 0/1/11 | 0/0 | 2026-09-21 04:14 |
| @121212165/dsh-plugin-price-aware Make your coding agent know what it costs: live credits, per-model price, task pre-estimates, budget gate | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-21 04:14 |
| @haiting202-web/jiufeng-invest | medium | medium | audit failed | 0/1/5 | 0/0 | 2026-09-21 04:14 |
| @deanzhang2026-max/dsh-lived-pet | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-diagnostic-tools DSH diagnostic tools: dependency-closure & decoupling checks + chat image attachment reconciliation. Zero deps, read-only, reproducible | DSH 诊断取证工具组：依赖闭包/解耦体检 + 会话图片附件对账，零依赖只读 | mediumD | medium | medium | 0/7/21 | 0/0 | 2026-09-21 04:14 |
| @HoodyHuo/dsh-plugin-glm-balance DSH Web GUI 插件：在输入框旁显示智谱 GLM（bigmodel.cn）套餐额度条 —— 小时/周额度、点击刷新、右键菜单，并自带「GLM 余额」设置分区（authorization、供应商 ID、自动刷新间隔，默认 30 分钟）。GLM coding-plan quota indicator for the DSH web GUI. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Mirfakk/dsh-plugin-usage DSH 额度面板：输入框下方实时显示本会话消费金额（官方峰谷分时计价）、token 用量与 DeepSeek 账户余额。 | medium | medium | queued | 0/3/5 | 0/0 | 2026-09-21 06:13 |
| @liuyuguo99/dsh-task-todo Todo & task manager for DSH: list / board / calendar / gantt, subtasks, recurrence; the same data is exposed to the agent as tools and a slash command. | lowD↓ | medium | low | 0/6/22 | 0/0 | 2026-09-21 06:13 |
| @KyattoCat/dsh-skills-mcp-panel Skills & MCP panel for the DSH Web GUI: grouped by origin, searchable, hot-toggleable. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-21 06:13 |
| @why-did/dsh-tailscale-access Remote access for the DSH Web GUI via Tailscale or cloudflared — early-stage, read the notice first. | mediumD↓ | high | medium | 3/6/21 | 0/0 | 2026-09-21 06:13 |
| @mikugui/dsh-session-eater 会话清理（喂鱼）：把不要的会话拖到余额挂件的小胖鱼身上「吃掉」（移入回收站，可撤销）——DSH Web 插件 | low | low | not queued (low risk) | 0/0/18 | 0/0 | 2026-09-21 06:13 |
| @HoodyHuo/dsh-plugin-dracula-color-theme DSH Web GUI 主题插件：官方 Dracula 配色，覆盖 alias + specific 两层 design token 与 shiki 语法高亮，并可接管系统主题偏好。Official Dracula theme (draculatheme.com) for the DSH web GUI. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 06:13 |
| @zhangnan/dsh-chatgpt-oauth ChatGPT OAuth login and Codex usage for DSH | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Marquez807/dsh-experience-memory Cross-session experience memory for DSH: a lesson reaches the model only with a verifiable source, relevant ones are injected each turn, and what nobody uses is retired. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 06:13 |
| @wangxuewangxue98/dsh-motor-ai-l0 | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-21 06:13 |
| @ct-jaryn/dsh-plugin-baizhi-agent-toolkit Optional community BaizhiCloud Agent Toolkit MCP configuration bundle for DSH | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @mia-wong1016/dsh-codex-plus Codex (ChatGPT Plus/Pro) subscription for DSH: quota panel with one-click reset, subscription model routing, token upkeep. | mediumD | medium | medium | 0/2/6 | 0/0 | 2026-09-21 08:13 |
| @nightosong/gord-dsh-worktree | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-21 08:13 |
| @YLL-KB/dsh-video-to-notes Opt-in DSH skill bundle that turns course, lecture, tutorial, documentary, meeting, and talk videos into structured study notes. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @SugarFatFree/dsh-agent-extension DSH plugin for workspace commands, skills, and path-scoped rules. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 08:13 |
| @wanghuiym123/dsh-cherry-kb Knowledge-base and memory switch for dsh web — two composer controls and two settings pages, backed by 22 /dsh/kb/* routes. Requires the local 我的知识库 toolchain (记忆开关 / idx / cherry). | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @nengong-ai/dsh-keychain-credentials Pure JavaScript macOS Keychain provider for DSH ctx.credentials, supporting both refs and records without plaintext credential storage on disk. | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-21 08:13 |
| @kenz1117/dsh-ui-composer-rainbow Rainbow marquee border for the DSH chat composer | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @1207627875/dsh-update-lens Read-only update checker for DSH: version comparison across npm and GitHub, in-app update notification, and breaking-change annotations on release notes. 只读更新检查 + 破坏性变更标注。 | lowD↓ | high | low | 1/4/15 | 0/0 | 2026-09-21 08:13 |
| @MrWeiCodes/dsh-loop-guard 为 DSH提供的思考循环守护插件：模型陷入「只想不做」的退化循环时自动打断，不必再手动中止 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @xydijkkk/dsh-voredteam dsh-voredteam｜DSH 插件形态的单模式安全作战系统：黑板（Fact/Intent/Hint）+ 六阶段六矩阵作业法 + 总控与 12 个专业子 agent + 作战面板（八泳道实时图 / 覆盖矩阵 / 按会话分类）。唯一门禁：禁 DDoS、禁爆破、模糊测试低频化。 | lowD↓ | medium | low | 0/13/10 | 0/3 | 2026-09-21 08:13 |
| @sqzssg12138/dsh-service-runner 为 DSH 加上 IDEA 风格的工作区服务启停面板：多工作区隔离、Node/Java/Python/Docker 自动探测、实时日志与端口占用者处置。 | mediumD | medium | medium | 0/5/10 | 0/0 | 2026-09-21 08:13 |
| @wpeng77/dsh-llm-trace Wire-level LLM inspector for DSH: capture the raw HTTP request and response bodies of every model provider call, attributed per session, in a Conversation View tab and a loopback viewer page. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-21 08:13 |
| @Smallballoons01/retirement-calc 中国法定退休年龄与养老金测算：2025 渐进式延迟退休、退休倒计时、预计月养老金 —— 单文件网页计算器 + DSH 插件 + 跨工具 Agent Skill | medium | medium | queued | 0/1/9 | 0/0 | 2026-09-21 08:13 |
| @wjw99830/dsh-plugin-noema Focus code review on complexity changes after each coding task. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @TheYoungChen/dsh-annotate Annotate any web element — local or online — with DOM facts and your comments, straight into your DSH chat. Built-in sidebar browser, Codex-style review, no X-Frame-Options pain. / 直接在DSH中用“标记DOM”和你的“评论”来标注任何网页元素——无论是本地的还是在线的。内置侧边栏浏览器，无需担心X-Frame-Options | mediumD↑ | low | medium | 0/0/4 | 0/0 | 2026-09-21 08:13 |
| @jack1545/dsh-weixin-reader WeChat Official Account article reader for DSH: parses mp.weixin.qq.com article bodies into clean Markdown | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 10:13 |
| @dreammaker2016/dsh-file-menu | medium | medium | queued | 0/3/2 | 0/0 | 2026-09-21 10:13 |
| @danbao/dsh-jev | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @chenjingchun/dsh-deepseek-balance-badge DeepSeek account balance badge for the DSH sidebar footer, with a settings card for the refresh period. The API key never reaches the browser. | low | low | not queued (low risk) | 0/0/11 | 0/0 | 2026-09-21 10:13 |
| @perdakovich/dsh-plugin-prompt-edit click the pencil, edit your text, enjoy | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @elanski/dsh-failover-continue Unified auto-continue + model failover plugin for DSH (RU/EN settings card) | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @argszero/cordis-plugin-tool-deadline-guard Deployment-level deadlines for dsh tool calls that declare none: mounted on the tools/execute waterfall, it turns a silently wedged tool call into a model-visible TOOL_DEADLINE_EXCEEDED. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @hirohana77/dsh-plugin-trajectory-tracker 让你更清楚地了解究竟是什么占据了你的等待耗时 ⏱️ DSH 实时时序轨迹与执行过程追踪插件 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @kenz1117/dsh-ui-rainbowspeak Rainbow marquee border for the DSH chat composer | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @vlln/evo-engineering 让 agent 把任意产物（文档、代码、skill）一轮轮改得更好：先定标准，再自动改进与独立评审，人类随时能看、能喊停、能回滚（DSH 插件） | medium | medium | audit failed | 0/4/3 | 0/0 | 2026-09-21 10:13 |
| @GJayun/dsh-goal-zcode-like | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-21 10:13 |
| @hgp005/dsh-winterskin 雪岭皮肤 — 把一张照片变成整个 DSH GUI 的底色，并把面板调成配套的玻璃质感主题。A photo skin for the DSH web GUI. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @Grant-Felix/dev-rules DSH个人插件：把你的项目开发规则交给 agent —— 右侧栏面板可视化维护（全局 + 按项目），并自动注入每个会话的系统提示。 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-21 12:13 |
| @WONGIII/dsh-effort-dial A reasoning-effort dial for the DSH composer: a violet particle field with meteors, magnetic level anchors and an eased circular thumb. | lowD↓ | medium | low | 0/12/11 | 0/0 | 2026-09-21 12:13 |
| @donyue7/dsh-aoci-panel DSH插件：在会话视图标签中展示项目的 AOCI 认知索引、治理状态与条目浏览 | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-opencode-go-path DSH plugin: declares the OpenCode Go route wire protocol, auto-adds DeepSeek V4.1 models, and attaches the x-opencode-session header | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-model-usage DSH plugin: model usage & account balance in the session header (OpenCode Go plan usage + DeepSeek account balance) | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @Gdenich/dsh-ru-ui Russian interface translation for DSH: 2581 strings across 49 namespaces, adds Русский to the language picker, activates on first run. Translation only. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kingzhz/dsh-global-rules Global AGENTS-style rules as many independent markdown files, with a settings GUI — fills the gap left by DSH's single hard-coded global AGENTS.md. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-composer-keys-setting DSH plugin: choose whether Enter / Shift+Enter / Ctrl/Cmd+Enter sends the message or inserts a line break | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-gui-last-session DSH plugin: reopen the conversation you were last in after a restart, without patching engine files | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @wowyuarm/dsh-context-continuity The context-continuity engine for DSH: a subject's context lived as one continuous timeline across many physical Sessions — rollover, checkpoints, and lineage. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kai-GitHubaccount/dsh-usage-panel DeepSeek 余额 + Token 用量面板（DSH Web）：三级预警、自定义阈值、一键充值、缓存命中率 ｜ Balance & usage panel for DSH | medium | medium | queued | 0/1/13 | 0/0 | 2026-09-21 12:13 |
| @vianvio/dsh-plugin-drop-path DSH 客户端插件：把一个文件夹拖进 DSH，输入框里出现的是它的本机绝对路径（引用块），而不是一条传不上去的附件。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @PerryLink/dsh-laya Laya decision engine as a first-class Cordis service and model-visible tools for DSH. | medium | medium | queued | 0/3/8 | 0/0 | 2026-09-21 12:13 |
Dynamic audit results · new today (10 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Dev scripts (not loaded at runtime) plus a shipped config that enables serving local files outside the workspace through the plugin's loopback HTTP route.
- mediumShipped config enables serving local files outside the workspace via the preview HTTP route · cordis.patch.yml:16
- lowDiagnostic script decompresses and reads a personal DSH session transcript · scripts/diag-transcript.mjs:13
- lowSelf-modifying script rewrites every .mjs file in scripts/ in place · scripts/repoint-paths.mjs:50
Windows-only command injection via shell:true when spawning a codex .cmd shim with agent-supplied model/effort; token handling and HTTP routes otherwise stay local and same-origin.
- mediumWindows cmd.exe injection when spawning a .cmd codex shim with agent-controlled model/effort args · lib/bridge.js:103
Diagnostic CLI suite: mostly read-only checks, but it auto-imports and executes a verifier module found in the scanned directory and deletes paths listed in rollback JSON.
- mediumAdapter verifier auto-discovered in the scan root is dynamically imported and executed · closure/check-decoupling.mjs:659
- mediumRollback mode deletes any filesystem path listed in the supplied report JSON · attachments/attachments-fetch.mjs:255
- lowRollback restores links using unvalidated paths from the rollback JSON · closure/repair-closure-links.mjs:273
Origin fence ignores port, so any loopback-served page can reach the plugin's command-executing routes; host route code was not harvested.
- mediumOrigin fence compares hostname only, so any 127.0.0.1 page on any port passes it · src/host/trust.ts:59
- lowreleasePort re-probes then kills by pid; pid reuse in between can terminate an unrelated process · src/host/ports.ts:115
Heuristic criticals are mostly intended, sandboxed behavior; residual medium risks are an unverified cloudflared auto-download and a remotely writable non-loopback bind.
- mediumcloudflared is downloaded from a mutable 'latest' URL and executed without checksum or signature verification · lib/cloudflared.js:152
- mediumConfigurable `bind` can move the cookie-injecting front door off loopback, and it is writable through the settings/action API · lib/index.js:100
- lowAction endpoint gate is a static, non-secret header (`x-remote-access-action: 1`) · lib/client/client.js:88
No remote code-execution path: spawns use argv arrays, allowlist defaults to strict, approvals fail closed; main residual risk is the runtime write into the installed dsh-acp package.
- mediumAt runtime the plugin patches source inside the installed @deepseek-ai/dsh-acp package, outside its own directory · lib/kernel/acp-preset-shim.mjs:186
- lowAttachment download fetches a URL taken verbatim from the inbound message, without a host allow-list · lib/kernel/bridge.mjs
- lowWindows ACL command is built by string concatenation from env and path values · lib/kernel/bridge.mjs
Only author-side dev scripts were harvested; one env-var-to-shell interpolation in a non-runtime script is low risk, no critical or high issues found.
- lowDeveloper env var DSH_CLI interpolated into an execSync shell command in author-side preflight script · scripts/preflight.mjs:74
The only harvested runtime module persists tasks as JSON under DSH_HOME with atomic writes and no shell, network or eval; the remaining warnings are dev-only scripts.
- lowDev screenshot script exposes an unauthenticated CDP port while holding the logged-in dsh web URL · scripts/shot.mjs:59
Runtime halves only read public version data over HTTPS and write their own config; no shell/eval/auto-update, and the static scan's shell hits live in research tooling the runtime never loads.
- lowGET routes (/proxy-probe, /status) skip the same-origin guard applied to every mutating route; /proxy-probe sweeps local ports · index.js:1051
- lowsameOrigin compares the Origin host to the client-supplied Host header only, so it is not rebinding-proof · index.js:904
- lowResearch-only scripts run shell commands and execute a scanner downloaded from the network; never imported by the runtime · research/diagnose-github-access.mjs:13
Heuristic scan refuted: flagged patterns are a defensive command block-list, the loopback+CSRF panel route, and operator-run deploy writes; only two low-severity gaps remain.
- lowDeploy CLI derives delete/copy targets from unvalidated --mode/--home, allowing recursive deletion · deploy/deploy.mjs
- lowDefault settings ship a plaintext-HTTP third-party FOFA endpoint as raw IP in fofa.backupUrl · plugins/vore-settings/lib/pure.js:52
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 25,430 in-scope entries (25,102 scanned + 328 pending).
Static scan for reference: low 24,919 · medium 0 · high 181 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
81 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-21. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2899 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published