Daily security scan
Date · 2026-09-22 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report7 of 59 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 59 new entries: 7 with a conclusion, 12 queued, 0 failed (no conclusion), 40 low-risk not queued.
Data file updated 2026-11-06 07:30 (UTC+8); latest conclusion audited 2026-10-23 07:38 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @fatefgo2050/dsh-mcp-scanner 在 DSH 设置页扫描并管理本地 MCP 服务器与工具 | medium | medium | queued | 0/1/4 | 0/0 | 2026-09-22 00:13 |
| @MiRHaDi/dsh-persian-rtl Community Persian language pack and RTL support for DSH Web, with lifecycle and browser tests | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 00:13 |
| @onepayzk-glitch/dsh-typesafe-ask Ask TypeSafe (Jev) for structured decisions from inside DSH: typed questions in, calibrated probabilities out. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 02:14 |
| @zhy5/dsh-wx-bridge DSH plugin: connect WeChat (official iLink/ClawBot) to DSH — live status settings panel + bundled bridge/keeper kernel | mediumD | medium | medium | 0/12/27 | 0/0 | 2026-09-22 02:14 |
| @ThinkofRain1213/deepseek-harness-wallet-patched Patched fork of the DSH wallet/control center: peak-clock and billing for the renamed deepseek-flash model, model-pool-driven pricing sync, and a persisted synced table. | lowD↓ | medium | low | 0/4/4 | 0/0 | 2026-09-22 02:14 |
| @syyr1987/dsh-linghun 灵魂（Linghun）— 给 DSH 装一个会思考的自我：灵魂卡四字段（姓名/性格/沟通风格/其他）+ 认知循环 + 海马体记忆沉淀。收口者身份锚点 + 边界判断纪律。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 02:14 |
| @FunctionHookTJU/dsh-work-done-bell DSH plugin: ring a Windows system sound when a DSH session is truly done | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-22 02:14 |
| @Tomcat099/dsh-sidebar DSH 左侧三段式导航（功能菜单 / 项目对话树 / 最近对话）+ 工具箱：可视化配置 MCP、跨会话记忆，让项目与会话一目了然。 | lowD↓ | high | low | 1/0/6 | 0/0 | 2026-09-22 02:14 |
| @kira905/dsh-firstaid Zero-dependency incident toolkit for long-running agent hosts: one entry point for stuck services, frozen UIs, rollbacks and data loss; emits a hand-off-ready on-site report. Read-only by default. | 零依赖急救台：起不来 / 假死 / 要撤销改动 / 数据被删四类现场压成一个入口，产出可整段交出去的体检报告 | mediumD↓ | high | medium | 1/13/9 | 0/0 | 2026-09-22 02:14 |
| @lurejewel/dsh-desktop-notifier | medium | medium | queued | 0/1/4 | 0/0 | 2026-09-22 04:13 |
| @173787247/dsh-wsl-obsidian DSH WSL bridge to a Windows Obsidian vault (status/open/read/write/search). | medium | medium | queued | 0/1/8 | 0/0 | 2026-09-22 04:13 |
| @xueccci/dsh-prompt-lab Agent-structured prompt optimizer for DSH. Modes: normal/slim/expand. Engines: local, hybrid, DSH, cloud API. Modal confirm with score and continue-optimize. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-22 04:13 |
| @1283011852/dsh-plugin-deep-paper-reading DSH plugin: ships the Deep Paper Reading agent preset for figure-by-figure, experiment-by-experiment close reading of a single biomedical paper. | medium | medium | queued | 0/3/0 | 0/3 | 2026-09-22 04:13 |
| @leolee9086/dsh-tool-gateway 把 DSH 的工具目录收成 find_tools + call_tool 两个元工具；其余工具仍可调用，只是入口变成这两个 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 04:13 |
| @skyzhao1223/dsh-agent-token-stats Cross-agent token usage dashboard for DSH: aggregates local logs of Claude Code, OpenCode, Cursor, DSH and more into a persistent ledger, with cache-hit, cost and drill-down analytics in a sidebar panel. / 跨 Agent 的本地 token 用量看板。 | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-22 04:13 |
| @jackchen13755/dsh-jev-lens Jev quality bench for DSH: shadow-accounted dangerous-command judging, injection screening, canary A/B drills, optional gate mode. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 04:13 |
| @dymzz/lgtm-dsh lgtm-dsh is a DSH plugin that automatically installs lgtm, reuses the Jev already configured in DSH, and lets the agent automatically call lgtm during the testing phase. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 04:13 |
| @konglong87/dsh-skills-input Choose user-invocable DSH skills from the composer and insert their slash command into the draft. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 06:13 |
| @linbin-mk/dsh-notify deepseek-harness macos 通知插件 | medium | medium | queued | 0/2/2 | 0/0 | 2026-09-22 06:13 |
| @cup113/dsh-effort-memory Host-only DSH bundle: remembers the reasoning effort last in effect per (provider, model) and restores it when a session switches back. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 06:13 |
| @ThinkofRain1213/dsh-smooth-cursor-patched Patched fork of dsh-smooth-cursor: smooth comet-mode animated caret for the DSH Web composer, extended to question-card inputs and fixing the empty-input caret, forward selection tracking, soft-break line positioning, and scroll-overflow cases. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 06:13 |
| @exynos967/dsh-request-error-dump DSH 插件：模型请求报错时，把完整请求体 raw JSON 与上游错误响应 raw JSON 一起落盘 | DSH plugin: dump the exact raw request body and the raw upstream error response when a model request fails | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 06:13 |
| @miseryrua/dsh-wb-cron DSH 无人值守定时任务调度器：cron/固定间隔/一次性三种调度，到点在 web profile 进程内拉起全新 root agent 执行任务指令，每任务可钉模型与 Agent 预设（预设被删/损坏时三级降级跑完并留痕）。零 npm 运行时依赖、零遥测。 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-22 06:13 |
| @idoall/dsh-session-colors | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 06:13 |
| @imiss1314520/dsh-greet-plugin A minimal DSH plugin that registers a greet tool. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 06:13 |
| @webkubor/dsh-env-inspector DSH 环境自检：让读者看到自己电脑装了什么 —— 系统/CLI/DSH 插件/秘钥是否存在 | mediumD | medium | medium | 0/2/11 | 0/0 | 2026-09-22 08:13 |
| @dgagf111/dsh-hydrasearch TinyFish + AnySearch web search and fetch provider for DSH: one failover-chain provider with an operator-controlled backend priority and a settings card. | lowD↓ | critical | low | 3/3/33 | 0/0 | 2026-09-22 08:13 |
| @bvcvb/dsh-baize-session Pick messages out of dsh sessions and relocate them into another conversation — a new one in any workspace, or an existing open one. Baize. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 08:13 |
| @nabin-qq273274877/dsh-database-manager DSH Web GUI 数据库管理面板：统一管理 SQLite / MySQL / Redis，并提供受审批保护的 agent 工具。 | Database management panel for the DSH Web GUI: SQLite / MySQL / Redis with approval-guarded agent tools. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 08:13 |
| @RaulLazaro/dsh-jev Ask Jev (TypeSafe System One) typed questions from DSH: batch judgements with probabilities, configured per user in Settings. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-22 08:13 |
| @ShawnOY/dsh-tavily-keyless Tavily-backed web search for the DSH web seam (ctx.web): keyless first, with a visible fallback to your API key. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 08:13 |
| @chiikin/dsh-glm-quota GLM Coding Plan quota display plugin for the DSH web UI | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-22 08:13 |
| @lsl1931/dsh-resource-bar DSH Web 插件：在左侧边栏底部（设置按钮上方）常驻一枚 CPU / 内存占用药丸，点击展开逐核占用、时间片构成、内存细分、交换分区、系统负载与进程 Top5 详情。 | medium | medium | queued | 0/3/11 | 0/0 | 2026-09-22 08:13 |
| @979569650/dsh-typesafe TypeSafe Jev (System One decision model) as a decision layer for DSH: typed decisions, confidence-gated routing, a cost meter, and an automatic prompt-injection guard over untrusted tool results. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 08:13 |
| @zanechen6/dsh-assistant-skin | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 08:13 |
| @bruc3van/bruce-md2word 面向 AI Agent 的 Markdown 转 Word 工具：中文排版、Mermaid 图表、可编辑数学公式，提供 Skill、独立 CLI 和 DSH 插件。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 10:13 |
| @Mo3ter/dsh-top-drag DSH Desktop (Windows): keeps the top of the window draggable and clickable at the same time. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 10:13 |
| @sunwindy91/spa-api-extract Agent Skill: extract data from JS single-page apps via curl+grep+python when WebFetch fails (timeout / obfuscated JS). Read-only, desensitized, MIT. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 10:13 |
| @maxesisnclaw/dsh-force-motion Keep DSH UI animations running despite prefers-reduced-motion / 强制开启 dsh 界面动效 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 10:13 |
| @1jiegejiayouxuewangan1/dsh-desktop-uia Windows desktop control for DSH through UI Automation: read a window's control tree instead of screenshots, drive elements by stable id, approve every write, audit every action. | 让 AI 安全地操作 Windows 桌面软件 | medium | medium | queued | 0/2/6 | 0/0 | 2026-09-22 10:13 |
| @Mo3ter/dsh-model-latency-test DSH plugin: adds a 模型测试 (Model Test) settings page that measures first-token latency (TTFT) for every configured model. Works in the DSH Web GUI and DSH Desktop. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 10:13 |
| @Tonited/dsh-stealth-reader 在 DSH 会话界面里伪装成日志流读小说：导入 txt/epub，只覆盖右侧消息区，鼠标一动即回到工作界面。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 10:13 |
| @DDDMUC/dsh-edit-turn Edit any user turn in DSH and re-run it: an inline editor rolls the conversation back through the official surface-replace contract, then re-prompts the agent with the revised text. The append-only session log is never rewritten. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-22 10:13 |
| @DDDMUC/dsh-chat-export DSH 会话可读导出：把 DSH 会话导出成可读的 Markdown / HTML / 纯文本 / ZIP 文字稿（思考块、工具调用与结果、代码块、图片、时间戳、标题与用量） | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 10:13 |
| @gordan-code/dsh-jev-advisor Jev (TypeSafe System One) gives the human a second opinion, not the agent. When DSH's model asks you a multiple-choice question, dsh-jev builds a structured Jev request and floats the recommendation, probability spread and confidence beside the options - one click to adopt. API key lives in Settings. No prompt changes. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 10:13 |
| @ShawnOY/dsh-tavily Tavily-backed web search for the DSH web seam (ctx.web): keyless first, with a visible fallback to your API key. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-22 12:13 |
| @Excalibur9527/dsh-jev DSH Plugin（DSH 插件）：每轮对话调用 typesafe.ai systemone(jev) 判定用户情绪/意图，结果注入模型上下文；API Key 与全部参数在 GUI 设置页配置 | low | low | not queued (low risk) | 0/0/7 | 0/0 | 2026-09-22 12:13 |
| @jackchen13755/dsh-jev-kit Jev decision toolkit for DSH: 22 named typed judgments (privacy scan, change-scope, memory triage, batch triage) on one hardened, budgeted, ledger-backed transport. Advisory only. | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-22 12:13 |
| @AskTheWay/dsh-auto-memory Claude Code-style auto-memory plugin for DSH: typed memory files + MEMORY.md index auto-injected into the system prompt. File-only, no external services. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 12:13 |
| @qcsjjjjj/dsh-hero-rightbar Restores the right sidebar's expand trigger on pages with no conversation (DSH plugin). | lowD↓ | medium | low | 0/5/9 | 0/0 | 2026-09-22 12:13 |
| @linbin-mk/dsh-workspace-prompt deepseek-harness 工作区自定义提示词 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 12:13 |
| @FranzLi347/dsh-workspace-colors Workspace color labels for DSH: six colors, browser-local persistence, Chinese/English UI. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 12:13 |
| @liujianqiao701/dsh-ask-notify DSH web GUI plugin: a bottom-right reminder card when the agent is blocked waiting for your answer, plus a desktop notification and a flashing tab title when you are on another tab. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-22 12:13 |
| @Zh0uHX/dsh-skills 在 DSH 设置中搜索、安装和管理 Skills.sh 技能 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-22 12:13 |
| @Edge-Echo/dsh-driftwatch Behavior-drift reports for DSH: compare two session logs and see exactly how behavior changed. Zero dependencies, CI-ready. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-22 12:13 |
| @qianyuan-ltd/dsh-qianyuan Connect DSH to the QianYuan MCP server — shared pitfall/result records and capability lookup for agents. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-22 12:13 |
| @MarchLiu/dsh-cf-sas | medium | medium | queued | 0/2/1 | 0/0 | 2026-09-22 12:13 |
| @173787247/dsh-wsl-jev DSH WSL plugin: TypeSafe Jev / OpenRouter System One (jev_ask / check / rank) | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-22 12:13 |
| @JoblessJoe/dsh-vitals Live btop-style hardware monitor (CPU/mem/temp/GPU) tab for the DSH web GUI | medium | medium | queued | 0/1/1 | 0/0 | 2026-09-22 12:13 |
Dynamic audit results · new today (7 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
No RCE and no secret values read; subprocesses use fixed args. But two unauthenticated localhost routes (env report, kill-port) rely on a fail-open Sec-Fetch-Site check.
- mediumkill-port route has no auth and fails open when Sec-Fetch-Site is absent, letting any caller SIGKILL a listening process · lib/index.js:685
- mediumUnauthenticated self-check route returns hostname, username, home path, LAN IPs and listening ports with PIDs · lib/index.js:610
- lowClient contacts third-party api.ipify.org to resolve public egress IP (user-initiated) · lib/client.js
Local incident-response CLI with no deps or network egress; the main residual risk is drill.mjs running operator-supplied shell/script strings and destructive live-mode file writes gated only by --yes.
- mediumdrill.mjs runs the --probe string through a shell without quoting · drill.mjs:294
- lowDrill executes an arbitrary/auto-detected restore script with node · drill.mjs:270
- lowLive drill overwrites the real target with DRILL-BROKEN before restoring from a temp snapshot · drill.mjs:259
Auth defaults and approval flow are fail-closed, but the plugin rewrites an installed dsh-acp package, shells out via cmd/PowerShell, and pulls message URLs post-auth.
- mediumStartup shim rewrites the installed @deepseek-ai/dsh-acp package inside node_modules · lib/kernel/acp-preset-shim.mjs:187
- lowPowerShell fallback reads the command line of every running process · lib/kernel/bridge.mjs:80
- lowcmd.exe /c command string assembled from data-dir path and USERNAME · lib/kernel/bridge.mjs:313
All four static warnings map to constant-driven or strictly validated constructs; only three low-severity hardening gaps remain and no reachable high-impact issue was found.
- lowWindows DPAPI helper spawns PowerShell with -ExecutionPolicy Bypass and PATH-resolved powershell.exe · index.js:1850
- lowOfficial pricing sync parses a remote HTML body with no size cap · index.js:469
- lowSubscription-plan credentials are sent as Authorization to endpoints defined in the non-audited lib/plans.js · index.js:1716
The 5 static warnings all come from repo-only verify/ scripts, which package.json excludes from the shipped tarball; the actual runtime is a no-op host module plus a DOM-only overlay button with no shell, network or file…
- lowDev-only script rewrites the installed plugin bundle inside the user profile · verify/prove-live-reload.mjs:120
Only manually-run dev verification scripts were harvested; they are off the runtime path and show no evidence-backed critical/high/medium issue.
Harvested modules show no exploitable flaw; the scanner's critical is likely a heuristic false positive. Only a low-severity path-join hardening note in project-scope config resolution.
- lowProject-scope MCP config path is joined from an unvalidated caller-supplied project root · src/mcp/paths.ts:49
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 25,430 in-scope entries (25,102 scanned + 328 pending).
Static scan for reference: low 24,919 · medium 0 · high 181 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
81 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-22. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2899 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published