Daily security scan
Date · 2026-09-23 (UTC — plugins first indexed that day)
79
added
0
critical
29
medium
50
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @AFAP/dsh-desktop-notify Desktop notifications for the DSH web GUI: a system toast when a tool needs authorization, a question or plan review is waiting, or a turn finishes. | low | pass | 0/0/2 | 0/0 | 2026-09-23 02:13 |
| @banana770/dsh-work-badge Tiny click-through badge for DSH: shows at a glance whether Beijing time (UTC+8) is inside the peak window - Mon-Fri 09:00-12:00 / 14:00-18:00 - or off-peak. Bilingual: Chinese and English UI text. | low | pass | 0/0/0 | 0/0 | 2026-09-23 02:13 |
| @hongxin/dsh-tvision Turbo Vision-style character-cell window manager for DSH agents | low | pass | 0/0/0 | 0/0 | 2026-09-23 02:13 |
| @njjpro/dsh-remote-workspace Device-workspace federation plugin for the dsh web GUI: pair into another DSH instance and browse its projects and sessions from the local sidebar, with each peer session opening in the local center column through a loopback embed proxy. | medium | warn | 0/7/8 | 0/0 | 2026-09-23 02:13 |
| @virzs/dsh-plugin-data-mask Paste-time data masking plugin for DSH: sensitive values are masked before they reach the composer | medium | warn | 0/10/40 | 0/0 | 2026-09-23 02:13 |
| @lycheelink/dsh-workbench Enterprise Agent Workbench for DSH | medium | warn | 0/2/0 | 0/0 | 2026-09-23 04:13 |
| @LovelyDazai/dsh-model-menu-search Allow user search model in the DSH model list. | low | pass | 0/0/0 | 0/0 | 2026-09-23 04:13 |
| @banana770/dsh-model-select-collapse DSH web UI plugin: collapsible per-provider groups in the model selector. English + Chinese docs. | low | pass | 0/0/2 | 0/0 | 2026-09-23 04:13 |
| @sweet-boby/dsh-session-isolation DSH plugin for per-session working directories: keep parallel agent sessions from overwriting each other. | low | pass | 0/0/2 | 0/0 | 2026-09-23 04:13 |
| @minivv/dsh-activity-bell DSH 侧边栏活动铃铛：会话完成给角标，一键切换最近活动列表 | low | pass | 0/0/0 | 0/0 | 2026-09-23 04:13 |
| @exoticknight/dsh-system1 System One foundation and Cordis plugin for DSH | DSH 的 System One 基础能力与 Cordis 插件 | low | pass | 0/0/1 | 0/0 | 2026-09-23 04:13 |
| @Juntiantan/dsh-permission-gate UI-level access gate + process-wide agent tool brake for DSH. Shared 60-min idle lock. NOT authentication — pair it with a real boundary. | low | pass | 0/0/5 | 0/0 | 2026-09-23 04:13 |
| @zdz6215591/dsh-theme-doubao 豆包主题 — DSH Web 客户端主题插件。 | medium | warn | 0/5/11 | 0/0 | 2026-09-23 04:13 |
| @xianyu9n/dsh-exp-ops Remote experiment operations for DSH: a credential-reference server registry, signal/GPU/rollout watchers that wake the agent instead of polling, box metrics, and one right-sidebar panel with live configuration. | low | pass | 0/0/1 | 0/0 | 2026-09-23 06:13 |
| @1959377950-dotcom/dsh-workspace-archive-all DSH Web plugin: Archive-All action on every workspace folder menu in the sidebar (Ungrouped included). Running / open / blank / subagent sessions are skipped. | low | pass | 0/0/0 | 0/0 | 2026-09-23 06:13 |
| @pbwheel/dsh-workbuddy-expert 把 WorkBuddy 专家装进 DSH：专家市场一键导入 · 会话选择器随时切换 | low | pass | 0/0/4 | 0/0 | 2026-09-23 06:13 |
| @Xixixiao2007/dsh-mail-digest 把每轮回答压成一条详略得当的摘要发到邮箱，并支持邮件回信作答或续接对话（DSH 插件） | medium | warn | 0/2/10 | 0/0 | 2026-09-23 06:13 |
| @loyalchiiina/dsh-lobsterai-daddy LobsterAIDaddy — draggable floating ball + slide-in drawer embedding the LobsterDaddy multi-account console in DSH, with a loopback-only same-origin reverse proxy, live status dot, account badge and a resizable persisted drawer. 把 LobsterDaddy 多账号控制台变成 DSH 界面悬浮球：可拖拽摆位并记忆，抽屉内嵌完整网页控制台，免退出并行登录/自动签到/积分额度/一键切号。 | medium | warn | 0/3/11 | 0/0 | 2026-09-23 06:13 |
| @jackovibe/dsh-settings-order DSH Web 设置左列自由排序插件：拖动 / Alt+↑↓ / ↑↓ 按钮，宿主持久，跨浏览器生效（Free ordering for the DSH Web Settings navigation） | low | pass | 0/0/15 | 0/0 | 2026-09-23 06:13 |
| @jianghu-lao-yao/sh-volume-knob | medium | warn | 0/1/16 | 0/0 | 2026-09-23 06:13 |
| @YevheniiMiachyn/dsh-tts-live Live sentence-level TTS for DSH with early speech, ordered streaming, barge-in cancellation, and custom WAV provider fixes. | medium | warn | 0/3/1 | 0/0 | 2026-09-23 06:13 |
| @LiHeng99/dsh-starbridge-client StarBridge (星桥) gateway client for DSH — address or platform-account sign-in, chat / feedback / knowledge-base tools, and Web UI panels. Ships with no baked-in gateway address. | low | pass | 0/0/3 | 0/0 | 2026-09-23 06:13 |
| @YIRC99/dsh-jev-context | low | pass | 0/0/1 | 0/0 | 2026-09-23 06:13 |
| @lphuxhuq/dsh-vietnamese-lang | low | pass | 0/0/3 | 0/0 | 2026-09-23 06:13 |
| @zhang0098/dsh-telegram-channel Telegram mobile remote for DSH sessions (Martty/ACP-compatible fork of hi-wenw/dsh-telegram-channel): bind a chat to a live session, plain text = followup, /model /last /sessions. | low | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @xchannel1987/dsh-sdd-progress-xc DSH web plugin: right-sidebar tab showing SDD task progress (todos) and ledger (sdd/progress.md) for the current session. 在右侧边栏展示当前会话的 SDD 任务进度与进度台账。 | low | pass | 0/0/7 | 0/0 | 2026-09-23 08:13 |
| @fufuyin/dsh-prompt-workbench Prompt rewrite workbench for DSH: four rewrite modes, cancellable streaming output, and a token-level before/after diff. | low | pass | 0/0/4 | 0/0 | 2026-09-23 08:13 |
| @fengchang618gmail/dsh-course-subtitles DSH plugin: fetch course/video captions (DeepLearning.AI, YouTube, Bilibili, Coursera), rebuild whole sentences, translate EN/ZH, auto-generate section headings, publish one Feishu doc per lesson. Also exports a course outline. Zero hardcoded keys - everything comes from env or the harness credential store. | medium | warn | 0/4/11 | 0/0 | 2026-09-23 08:13 |
| @ginkgonine/dsh-server-hub A persistent multi-server switcher for DSH Web | medium | warn | 0/8/14 | 0/0 | 2026-09-23 08:13 |
| @passerby325799/dsh-trans-md Keeps DSH chat replies short: final replies over 15 lines are written to a Markdown file in the workspace, leaving a digest and file path in chat. | low | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @exoticknight/dsh-plugin-template One sentence to an AI agent: create, release and list a DSH plugin. DSH 插件模板与 AI 操作手册 | medium | warn | 0/1/14 | 0/0 | 2026-09-23 08:13 |
| @jipika/dsh-memory Two-layer long-term memory for DSH: global + per-project markdown, live re-read, zero extra LLM cost, with a Settings panel. 给 DSH 的两层长期记忆。 | low | pass | 0/0/2 | 0/0 | 2026-09-23 08:13 |
| @yicun0316/dsh-claude-slider DSH / DSH 推理强度滑块插件：Claude 风格拖拽滑块 + 23 种 Canvas 粒子动效 + 客制动效自由组合 + 配色与图标自定义。Claude-style reasoning-effort slider plugin for DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @yvhcel888/dsh-slide-gauge DSH 滑动测量仪挂件：右下角拖动角色显示状态，边界彩蛋，记住上次位置 · DSH plugin | low | pass | 0/0/2 | 0/0 | 2026-09-23 08:13 |
| @Neptune810/dsh-power-button A draggable one-press stop button for the DSH Web GUI. / DSH 一键结束服务按钮。 | medium | warn | 0/4/11 | 0/0 | 2026-09-23 08:13 |
| @XiaoBinGan/dsh-mermaid-fence Render settled ```mermaid fences in the dsh Web GUI chat as SVG diagrams — hardened output, source toggle, and a code-block fallback that never loses the source. | low | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @LeoEthanZ/dsh-beyond-glass A three-column glass UI for deepseek-harness, delivered as installable packages instead of a fork. | low | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @Suguyun/dsh-insight DSH浏览器伴侣：网页划词即解读、侧栏多轮追问，并让 dsh 智能体读取页面、抓取流量、驱动浏览器。Chrome/Edge MV3 扩展 + 配套 dsh host 插件。 | medium | warn | 0/6/12 | 0/0 | 2026-09-23 10:13 |
| @wangzhuoyuan229-source/DeepSeekLauncher macOS desktop launcher for DSH — Chrome, custom transparent icon, and installation skill | low | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @liaowenqi123/dsh-meeting-coordinator DSH 多 Agent「会议室」插件：会议室会籍 + fork 上下文入场 + 主持人控场多轮讨论 + 会后各自压缩纪要并回到工作区继续干活。基于 dsh-std 元协议（Community v0.15）。 | low | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @Eapp1e/dsh-poker Texas Hold'em table for DSH: model-callable poker tools, six heuristic opponents, an optional coach, and a browser table whose buttons never post a chat message. | medium | warn | 0/1/6 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-worktree Git worktree isolation for DSH: create a worktree, register it as its own project, and start the session inside it | medium | warn | 0/1/1 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-memory Claude-compatible memory for DSH: a user-chosen memory directory with MEMORY.md index and topic files, the memory tool, and a settings page | low | pass | 0/0/2 | 0/0 | 2026-09-23 10:13 |
| @boyl/dsh-sidebar-pins Codex-style pinned/recent sidebar panes for DSH, with one full row menu on every row (pins, unread, rename/fork/archive, reveal in Finder, guarded workspace delete). | low | pass | 0/0/6 | 0/0 | 2026-09-23 10:13 |
| @TOP1Wu/dsh-session-isolation 为 DSH 提供工作区级会话隔离：同一工作区里多个会话各自写自己的产出目录，拒绝覆盖其他会话的文件。 | low | pass | 0/0/1 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-ui-beautify Page beautification for DSH: ship open-source CJK webfonts and let the Web GUI pick its body font | low | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @victorygod/dsh-tavern-fengyue | low | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @jackovibe/dsh-codex-pin Codex 式会话置顶与归档风格的 DSH Web 插件（置顶=标记不是排序，宿主持久，零顺序改动） | low | pass | 0/0/9 | 0/0 | 2026-09-23 10:13 |
| @JessenReinhart/dsh-snapcompact Bitmap-frame context compression plugin for DSH: deterministic pixel-font visual archiving of conversation history | medium | warn | 0/1/2 | 0/0 | 2026-09-23 10:13 |
| @yixiuzhemu/Skills-Manager Skills管理 | low | pass | 0/0/4 | 0/0 | 2026-09-23 10:13 |
| @chinazkk/dsh-console DSH 控制台插件：主视图「控制台」标签页，真 PTY 交互终端（iTerm 风格多标签），vim/top/ctrl+c 全支持。 | medium | warn | 0/3/12 | 0/0 | 2026-09-23 10:13 |
| @luxus0946/dsh-uuyc UU Remote (uuyc-cli) Windows remote-control plugin for DSH - device management & remote terminal execution. Everything is a Plugin. | medium | warn | 0/3/2 | 0/0 | 2026-09-23 10:13 |
| @dpwgc/dsh-coding-workflow 一个 DSH 编程工作流模式预设(Preset)，用于更好地约束LLM进行编程工作。 | medium | warn | 0/3/0 | 0/3 | 2026-09-23 10:13 |
| @2huy4n/roleplaytimer 每隔一段时间主动唤醒会话中的AI，以此达到更沉浸式的角色扮演体验。 | low | pass | 0/0/3 | 0/0 | 2026-09-23 12:13 |
| @SciF-Lin/dsh-browsercontrol-mcp Real browser control for DSH: mounts Playwright MCP as native tools so the agent drives a browser you actually use. | low | pass | 0/0/0 | 0/0 | 2026-09-23 12:13 |
| @harde1/dsh-xcodebuild Xcode build, test, archive, run and log streaming for DSH: build/test/clean/archive/run an iOS or macOS project, with a live filterable build log and simulator and USB device log channels. macOS only. | low | pass | 0/0/2 | 0/0 | 2026-09-23 12:13 |
| @Gnatnaituy/dsh_sidebar_element_picker A browser panel in DSH's right sidebar: browse a site through a per-origin loopback proxy, pick elements into [label][DOMn] references, with tabs, page zoom, phone/tablet viewport preview and saved logins. | medium | warn | 0/2/14 | 0/0 | 2026-09-23 12:13 |
| @azazo1/dsh-approve-prefix 按单命令前缀自动放行 DSH 沙箱提权请求, 含管道与链式的命令一律转人工审批. | low | pass | 0/0/0 | 0/0 | 2026-09-23 14:13 |
| @JD579g/dsh-mcp-hub DSH plugin: one-click MCP deployment + built-in MCP toolkit + doctor. Windows-first, connects without restarting. | medium | warn | 0/3/21 | 0/0 | 2026-09-23 14:13 |
| @wuenna/dsh-deepseek-cost DSH plugin: DeepSeek-official cost accounting (session total + current turn) added to the built-in Token usage panel. | low | pass | 0/0/1 | 0/0 | 2026-09-23 14:13 |
| @Gnatnaituy/dsh-sidebar-browser A browser panel in DSH's right sidebar: browse a site through a per-origin loopback proxy, pick elements into [label][DOMn] references, with tabs, page zoom, phone/tablet viewport preview and saved logins. | medium | warn | 0/2/14 | 0/0 | 2026-09-23 14:13 |
| @TACONailoong/dsh-plugin-smart-config DSH plugin for model smart configuration and parameter adaptation ported from ZCode | medium | warn | 0/1/2 | 0/0 | 2026-09-23 14:13 |
| @CJYLZS/dsh-browser Give dsh agent a real browser to use | medium | warn | 0/1/7 | 0/0 | 2026-09-23 14:13 |
| @Ztyss/dsh-draft-fold 长输入自动折叠为一张附件式摘要卡 | low | pass | 0/0/0 | 0/0 | 2026-09-23 14:13 |
| @anthony1x6000/dsh-searxng-search | medium | warn | 0/11/23 | 0/0 | 2026-09-23 14:13 |
| @anthony1x6000/dsh-remote | low | pass | 0/0/1 | 0/0 | 2026-09-23 14:13 |
| @ffyfox/dsh-zcode-project-memory ZCode 项目记忆的 DSH 非官方社区移植：项目级长效记忆插件。Unofficial community port of ZCode's project memory to DSH: project-scoped long-term memory plugin | low | pass | 0/0/3 | 0/0 | 2026-09-23 14:13 |
| @wuenna/dsh-workspace-focus DSH plugin: an eye toggle that hides every workspace except the one holding the current session. | low | pass | 0/0/2 | 0/0 | 2026-09-23 14:13 |
| @DDDMUC/dsh-provider-hub DSH plugin: paste an API key to add a provider. 21 curated presets (OpenAI-compatible + Anthropic Messages) with per-app de-duplication and a custom endpoint form. | low | pass | 0/0/7 | 0/0 | 2026-09-23 14:13 |
| @MaybeMeibeMaybi/dsh-harmonyos-hiboard Push DSH task results to Huawei HarmonyOS assistant-today service cards. Compatible with dsh 0.1.5 / cordis 4. | low | pass | 0/0/3 | 0/0 | 2026-09-23 14:13 |
| @cup113/dsh-plugin-pyrun DSH插件：Python 快捷执行工具，源码经 stdin 直灌 `python -X utf8 -u -`，一步返回结果，全链路 UTF-8，支持后台作业与沙箱提权。 | low | pass | 0/0/0 | 0/0 | 2026-09-23 16:13 |
| @jackie-cqz/dsh-jev-plugin DSH plugin for TypeSafe Jev: typed decisions, configurable guardrails, and Web UI result cards. | low | pass | 0/0/3 | 0/0 | 2026-09-23 16:13 |
| @1475505/miliastra-beyond-simulator 千星沙箱模拟器：Lua 驱动的 2D 奇域外置沙箱 ，支持 DSH、Web 和 MCP | low | pass | 0/0/3 | 0/0 | 2026-09-23 16:13 |
| @JohnGD/dsh-office-preview Previews Word (.docx) and Excel (.xlsx) files in the DSH sidebar document pane — OOXML parsed in the browser, no Office, no network. | low | pass | 0/0/0 | 0/0 | 2026-09-23 16:13 |
| @hasan-aghayev/dsh-pet-companion Floating desktop pet for DSH with a growing local pet library | medium | warn | 0/5/8 | 0/0 | 2026-09-23 16:13 |
| @rasyidmmz/dsh-ai-memory Memory bridge between DSH and ai-memory: finalizes DSH sessions so they become wiki pages every other harness ai-memory serves can read. | low | pass | 0/0/3 | 0/0 | 2026-09-23 18:13 |
| @ClearLeaf13/dsh-llamacpp-connect 把本地 llama.cpp 管理器里的模型接入 DSH — bring local llama.cpp manager models into DSH | medium | warn | 0/3/9 | 0/0 | 2026-09-23 18:13 |
| @XGUIMAX/dsh-wrongbook DSH Tavern 错题库：按人物卡分类记下调试中踩过的坑，先查本卡、再跨卡。 / Per-card defect ledger for DSH Tavern. | medium | warn | 1/8/10 | 0/0 | 2026-09-23 18:13 |
| @tokai-teiodh/dsh-script-cards Script-archive card panel for DSH: rounded card grid, two-level branch canvas, and a host-side Typert bridge that keeps structure inside your own project folder. | medium | warn | 0/1/6 | 0/0 | 2026-09-23 18:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
38 reports2026-09-23current79 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-23. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published