Daily security scan
Date · 2026-09-21 (UTC — plugins first indexed that day)
65
added
0
critical
23
medium
42
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @yueyexiayu/dsh-shengcheng DSH desktop plugin: generate images with logged-in Grok/GPT accounts, and videos with Grok | low | pass | 0/0/2 | 0/0 | 2026-09-21 02:13 |
| @corlinniu/dsh-daily-chat 给DSH增加日常聊天功能 | low | pass | 0/0/5 | 0/0 | 2026-09-21 02:13 |
| @hi-wenw/dsh-csv-viewer DSH Web CSV and TSV table viewer with search, sorting, raw mode, and virtualized rows | low | pass | 0/0/0 | 0/0 | 2026-09-21 02:13 |
| @awol2005ex3/dsh-cas DSH 插件: 用于实现CAS SSO单点登录 | low | pass | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @shenbimicro233/dsh-reasoning-effort-inject | low | pass | 0/0/0 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-ecosystem-panel DSH plugin: read-only ecosystem health panel - bundle / patch / skill / upgrade / decoupling diagnosis in one view | DSH 插件：只读生态健康面板，六类体检一屏看完 | medium | warn | 0/3/15 | 0/0 | 2026-09-21 04:14 |
| @zhy5/wxbridge DSH plugin: connect WeChat (official iLink/ClawBot) to DSH — live status settings panel + bundled bridge/keeper kernel | medium | warn | 0/10/26 | 0/0 | 2026-09-21 04:14 |
| @hoyyang/dsh-best-ponytail Ponytail lazy-senior-dev ruleset for DSH: 7-rung minimal-code ladder, six skills (review/audit/debt/gain/help), /ponytail session command, optional always-on injection. MIT, upstream unmodified. | low | pass | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @arrow1031/dsh-qq-bot DSH plugin for QQ-Bot adataper | medium | warn | 0/3/14 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-session-title-live DSH plugin: live session titles with state prefixes (running/done), pin-safe and fully configurable | DSH 插件：会话标题实时刷新 + 状态前缀，pin 安全、可配置 | medium | warn | 0/1/11 | 0/0 | 2026-09-21 04:14 |
| @121212165/dsh-plugin-price-aware Make your coding agent know what it costs: live credits, per-model price, task pre-estimates, budget gate | low | pass | 0/0/4 | 0/0 | 2026-09-21 04:14 |
| @haiting202-web/jiufeng-invest | medium | warn | 0/1/5 | 0/0 | 2026-09-21 04:14 |
| @deanzhang2026-max/dsh-lived-pet | low | pass | 0/0/3 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-diagnostic-tools DSH diagnostic tools: dependency-closure & decoupling checks + chat image attachment reconciliation. Zero deps, read-only, reproducible | DSH 诊断取证工具组：依赖闭包/解耦体检 + 会话图片附件对账，零依赖只读 | medium | warn | 0/7/21 | 0/0 | 2026-09-21 04:14 |
| @HoodyHuo/dsh-plugin-glm-balance DSH Web GUI 插件：在输入框旁显示智谱 GLM（bigmodel.cn）套餐额度条 —— 小时/周额度、点击刷新、右键菜单，并自带「GLM 余额」设置分区（authorization、供应商 ID、自动刷新间隔，默认 30 分钟）。GLM coding-plan quota indicator for the DSH web GUI. | low | pass | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Mirfakk/dsh-plugin-usage DSH 额度面板：输入框下方实时显示本会话消费金额（官方峰谷分时计价）、token 用量与 DeepSeek 账户余额。 | medium | warn | 0/3/5 | 0/0 | 2026-09-21 06:13 |
| @liuyuguo99/dsh-task-todo Todo & task manager for DSH: list / board / calendar / gantt, subtasks, recurrence; the same data is exposed to the agent as tools and a slash command. | medium | warn | 0/6/22 | 0/0 | 2026-09-21 06:13 |
| @KyattoCat/dsh-skills-mcp-panel Skills & MCP panel for the DSH Web GUI: grouped by origin, searchable, hot-toggleable. | low | pass | 0/0/4 | 0/0 | 2026-09-21 06:13 |
| @why-did/dsh-tailscale-access Remote access for the DSH Web GUI via Tailscale or cloudflared — early-stage, read the notice first. | medium | warn | 3/6/21 | 0/0 | 2026-09-21 06:13 |
| @mikugui/dsh-session-eater 会话清理（喂鱼）：把不要的会话拖到余额挂件的小胖鱼身上「吃掉」（移入回收站，可撤销）——DSH Web 插件 | low | pass | 0/0/18 | 0/0 | 2026-09-21 06:13 |
| @HoodyHuo/dsh-plugin-dracula-color-theme DSH Web GUI 主题插件：官方 Dracula 配色，覆盖 alias + specific 两层 design token 与 shiki 语法高亮，并可接管系统主题偏好。Official Dracula theme (draculatheme.com) for the DSH web GUI. | low | pass | 0/0/2 | 0/0 | 2026-09-21 06:13 |
| @zhangnan/dsh-chatgpt-oauth ChatGPT OAuth login and Codex usage for DSH | low | pass | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Marquez807/dsh-experience-memory Cross-session experience memory for DSH: a lesson reaches the model only with a verifiable source, relevant ones are injected each turn, and what nobody uses is retired. | low | pass | 0/0/0 | 0/0 | 2026-09-21 06:13 |
| @wangxuewangxue98/dsh-motor-ai-l0 | low | pass | 0/0/6 | 0/0 | 2026-09-21 06:13 |
| @ct-jaryn/dsh-plugin-baizhi-agent-toolkit Optional community BaizhiCloud Agent Toolkit MCP configuration bundle for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @mia-wong1016/dsh-codex-plus Codex (ChatGPT Plus/Pro) subscription for DSH: quota panel with one-click reset, subscription model routing, token upkeep. | medium | warn | 0/2/6 | 0/0 | 2026-09-21 08:13 |
| @nightosong/gord-dsh-worktree | medium | warn | 0/1/5 | 0/0 | 2026-09-21 08:13 |
| @YLL-KB/dsh-video-to-notes Opt-in DSH skill bundle that turns course, lecture, tutorial, documentary, meeting, and talk videos into structured study notes. | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @SugarFatFree/dsh-agent-extension DSH plugin for workspace commands, skills, and path-scoped rules. | low | pass | 0/0/2 | 0/0 | 2026-09-21 08:13 |
| @wanghuiym123/dsh-cherry-kb Knowledge-base and memory switch for dsh web — two composer controls and two settings pages, backed by 22 /dsh/kb/* routes. Requires the local 我的知识库 toolchain (记忆开关 / idx / cherry). | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @nengong-ai/dsh-keychain-credentials Pure JavaScript macOS Keychain provider for DSH ctx.credentials, supporting both refs and records without plaintext credential storage on disk. | medium | warn | 0/1/0 | 0/0 | 2026-09-21 08:13 |
| @kenz1117/dsh-ui-composer-rainbow Rainbow marquee border for the DSH chat composer | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @1207627875/dsh-update-lens Read-only update checker for DSH: version comparison across npm and GitHub, in-app update notification, and breaking-change annotations on release notes. 只读更新检查 + 破坏性变更标注。 | medium | warn | 1/4/15 | 0/0 | 2026-09-21 08:13 |
| @MrWeiCodes/dsh-loop-guard 为 DSH提供的思考循环守护插件：模型陷入「只想不做」的退化循环时自动打断，不必再手动中止 | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @xydijkkk/dsh-voredteam dsh-voredteam｜DSH 插件形态的单模式安全作战系统：黑板（Fact/Intent/Hint）+ 六阶段六矩阵作业法 + 总控与 12 个专业子 agent + 作战面板（八泳道实时图 / 覆盖矩阵 / 按会话分类）。唯一门禁：禁 DDoS、禁爆破、模糊测试低频化。 | medium | warn | 0/13/10 | 0/3 | 2026-09-21 08:13 |
| @sqzssg12138/dsh-service-runner 为 DSH 加上 IDEA 风格的工作区服务启停面板：多工作区隔离、Node/Java/Python/Docker 自动探测、实时日志与端口占用者处置。 | medium | warn | 0/5/10 | 0/0 | 2026-09-21 08:13 |
| @wpeng77/dsh-llm-trace Wire-level LLM inspector for DSH: capture the raw HTTP request and response bodies of every model provider call, attributed per session, in a Conversation View tab and a loopback viewer page. | low | pass | 0/0/1 | 0/0 | 2026-09-21 08:13 |
| @Smallballoons01/retirement-calc 中国法定退休年龄与养老金测算：2025 渐进式延迟退休、退休倒计时、预计月养老金 —— 单文件网页计算器 + DSH 插件 + 跨工具 Agent Skill | medium | warn | 0/1/9 | 0/0 | 2026-09-21 08:13 |
| @wjw99830/dsh-plugin-noema Focus code review on complexity changes after each coding task. | low | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @TheYoungChen/dsh-annotate Annotate any web element — local or online — with DOM facts and your comments, straight into your DSH chat. Built-in sidebar browser, Codex-style review, no X-Frame-Options pain. / 直接在DSH中用“标记DOM”和你的“评论”来标注任何网页元素——无论是本地的还是在线的。内置侧边栏浏览器，无需担心X-Frame-Options | low | pass | 0/0/4 | 0/0 | 2026-09-21 08:13 |
| @jack1545/dsh-weixin-reader WeChat Official Account article reader for DSH: parses mp.weixin.qq.com article bodies into clean Markdown | low | pass | 0/0/2 | 0/0 | 2026-09-21 10:13 |
| @dreammaker2016/dsh-file-menu | medium | warn | 0/3/2 | 0/0 | 2026-09-21 10:13 |
| @danbao/dsh-jev | low | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @chenjingchun/dsh-deepseek-balance-badge DeepSeek account balance badge for the DSH sidebar footer, with a settings card for the refresh period. The API key never reaches the browser. | low | pass | 0/0/11 | 0/0 | 2026-09-21 10:13 |
| @perdakovich/dsh-plugin-prompt-edit click the pencil, edit your text, enjoy | low | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @elanski/dsh-failover-continue Unified auto-continue + model failover plugin for DSH (RU/EN settings card) | low | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @argszero/cordis-plugin-tool-deadline-guard Deployment-level deadlines for dsh tool calls that declare none: mounted on the tools/execute waterfall, it turns a silently wedged tool call into a model-visible TOOL_DEADLINE_EXCEEDED. | low | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @hirohana77/dsh-plugin-trajectory-tracker 让你更清楚地了解究竟是什么占据了你的等待耗时 ⏱️ DSH 实时时序轨迹与执行过程追踪插件 | low | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @kenz1117/dsh-ui-rainbowspeak Rainbow marquee border for the DSH chat composer | low | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @vlln/evo-engineering 让 agent 把任意产物（文档、代码、skill）一轮轮改得更好：先定标准，再自动改进与独立评审，人类随时能看、能喊停、能回滚（DSH 插件） | medium | warn | 0/4/3 | 0/0 | 2026-09-21 10:13 |
| @GJayun/dsh-goal-zcode-like | medium | warn | 0/1/7 | 0/0 | 2026-09-21 10:13 |
| @hgp005/dsh-winterskin 雪岭皮肤 — 把一张照片变成整个 DSH GUI 的底色，并把面板调成配套的玻璃质感主题。A photo skin for the DSH web GUI. | low | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @Grant-Felix/dev-rules DSH个人插件：把你的项目开发规则交给 agent —— 右侧栏面板可视化维护（全局 + 按项目），并自动注入每个会话的系统提示。 | low | pass | 0/0/5 | 0/0 | 2026-09-21 12:13 |
| @WONGIII/dsh-effort-dial A reasoning-effort dial for the DSH composer: a violet particle field with meteors, magnetic level anchors and an eased circular thumb. | medium | warn | 0/12/11 | 0/0 | 2026-09-21 12:13 |
| @donyue7/dsh-aoci-panel DSH插件：在会话视图标签中展示项目的 AOCI 认知索引、治理状态与条目浏览 | medium | warn | 0/1/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-opencode-go-path DSH plugin: declares the OpenCode Go route wire protocol, auto-adds DeepSeek V4.1 models, and attaches the x-opencode-session header | low | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-model-usage DSH plugin: model usage & account balance in the session header (OpenCode Go plan usage + DeepSeek account balance) | low | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @Gdenich/dsh-ru-ui Russian interface translation for DSH: 2581 strings across 49 namespaces, adds Русский to the language picker, activates on first run. Translation only. | low | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kingzhz/dsh-global-rules Global AGENTS-style rules as many independent markdown files, with a settings GUI — fills the gap left by DSH's single hard-coded global AGENTS.md. | low | pass | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-composer-keys-setting DSH plugin: choose whether Enter / Shift+Enter / Ctrl/Cmd+Enter sends the message or inserts a line break | low | pass | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-gui-last-session DSH plugin: reopen the conversation you were last in after a restart, without patching engine files | low | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @wowyuarm/dsh-context-continuity The context-continuity engine for DSH: a subject's context lived as one continuous timeline across many physical Sessions — rollover, checkpoints, and lineage. | low | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kai-GitHubaccount/dsh-usage-panel DeepSeek 余额 + Token 用量面板（DSH Web）：三级预警、自定义阈值、一键充值、缓存命中率 ｜ Balance & usage panel for DSH | medium | warn | 0/1/13 | 0/0 | 2026-09-21 12:13 |
| @vianvio/dsh-plugin-drop-path DSH 客户端插件：把一个文件夹拖进 DSH，输入框里出现的是它的本机绝对路径（引用块），而不是一条传不上去的附件。 | low | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @PerryLink/dsh-laya Laya decision engine as a first-class Cordis service and model-visible tools for DSH. | medium | warn | 0/3/8 | 0/0 | 2026-09-21 12:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
36 reports2026-09-21current65 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-21. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published