Daily security scan
Date · 2026-09-25 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report12 of 45 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 45 new entries: 12 with a conclusion, 13 queued, 1 failed (no conclusion), 19 low-risk not queued.
Data file updated 2026-11-12 07:55 (UTC+8); latest conclusion audited 2026-10-23 08:47 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @SenmuuuuW/dsh-diagnostic-tutor Diagnosis-first AI learning runtime for DSH — map what you need, learn interactively, and move to the next best step. | medium | medium | queued | 0/2/9 | 0/0 | 2026-09-25 00:13 |
| @qikairo7/dsh-usage-panel Session-level token usage & cost panel plugin for DSH | mediumD↓ | critical | medium | 1/0/2 | 0/0 | 2026-09-25 00:13 |
| @3289192-bot/dsh-cache-bricks Cache Bricks for DSH — visualize prompt-cache health and request activity. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-25 00:13 |
| @jackControls/dsh-nbcad-plate DSH plugin: 2D plate prints to noBS CAD scripts and STEP files (skill + CAD tools + native print probe) | mediumD | medium | medium | 0/3/7 | 0/0 | 2026-09-25 02:13 |
| @etony668/dsh-balance DeepSeek API 余额常驻显示（侧边栏「设置」旁）· DeepSeek API balance badge beside Settings in the DSH sidebar | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-25 02:13 |
| @VCPr0j3k7/dsh-index-tap-bridge Make tapIndex-based DSH plugins work in the official DSH desktop shell | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-25 02:13 |
| @Locietta/dsh-rewind-retry DSH plugin: Retry, Edit prompt, and Continue actions for chat turns (rewind by forking the session) | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 02:13 |
| @martyartem/dsh-plannotator Review a file, a folder or a web page in the Plannotator browser UI from DSH, and get the annotations back as a message. | medium | medium | queued | 0/2/13 | 0/0 | 2026-09-25 02:13 |
| @sequoiayunus-hue/dsh-subagent-model-config Configure per-teammate model & reasoning effort for DSH native agent teams — settings UI, zero official-file modification. 为 DSH 原生 Team 编队队员可视化配置模型与推理档位。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-25 02:13 |
| @qikairo7/dsh-gemini-pool DSH 用上 Gemini 的方式 —— 让你的 Google AI Pro 订阅成为编程模型池：多模态 / 前端生成 / 生图 / 多账号调度 | medium | medium | queued | 0/3/11 | 0/0 | 2026-09-25 02:13 |
| @mattcarvercom/dsh-unified-memory Long-term memory for DSH in Claude Code's format: private, overlay, or shared with Claude Code, with provenance on every file | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-25 02:13 |
| @hbgdjb/dsh-mimo-quota MIMO Quota Panel —— DSH 的模型额度面板：会话日志逐调用自动记账，一屏展示 Token 用量、消费金额、请求次数、趋势波形、模型构成，支持按模型/粒度/时间范围/项目·对话统计切换，内置可编辑定价与 DeepSeek 峰谷价自动套算。 | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-time-inject DSH 插件：每个 turn 首个 step 往模型上下文追加一条单行中文时间读数（当前时间 / 星期 / 时区 / 距上条消息） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 04:14 |
| @zhaoguoqiang-hub/dsh-soul-engine 可审计的明文 Markdown 记忆账本插件（DSH / DSH）：14 个 soul_* 工具 + 轮首账本注入 + 零 token 自维护 + 心跳唤醒 | medium | medium | audit failed | 0/4/21 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-peak-gate DSH插件：按 DeepSeek 峰谷分时计价在高峰踩刹车——拦重活、压输出上限、工具预算、峰时精简输出，含中国法定节假日自动日历与一键放行口令。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-25 04:14 |
| @bakasbk/dsh-connect-comate Connect the locally signed-in WPS Comate account to DSH as a model provider, via a secure loopback shim (reverse-proxy style). 通过安全回环 shim（反向代理），把本机已登录的 WPS Comate 账号接入 DSH 作为模型来源。 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-toolbox DSH 工具箱：读 DSH 会话日志 / 维护 meow-memory 记忆库的常驻脚本集（由 DeepSeek 编写） | low | low | not queued (low risk) | 0/0/9 | 0/0 | 2026-09-25 04:14 |
| @mengqi1436/DSH-Rtk-rewrite DSH中通过Rtk进行改写 | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-25 04:14 |
| @CSlawyer1985/dsh-jev-router DSH 插件 · 用 Jev（TypeSafe System One）判定推理强度：默认只切思考强度（零缓存代价），自动模型路由出厂关闭 + 硬门禁 + 成本闸。作者 chenshi.ai | mediumD | medium | medium | 0/5/5 | 0/0 | 2026-09-25 06:13 |
| @windwhiterain/dsh-model-proxy Per-model outbound proxy routing for DSH: send only the models you name through a proxy, with a direct fallback while it is unavailable. | medium | medium | queued | 0/3/7 | 0/0 | 2026-09-25 06:13 |
| @CroissanTTs/dsh-harness-jarvis 贾维斯 · 常驻桌面的悬浮窗桌面助手 / 桌面宠物 —— DSH Desktop 的粒子光球：快速审批权限、⌃⌥J 快速对话。A floating-window desktop assistant & desktop pet for DSH Desktop. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 06:13 |
| @guooo1380/dsh-team-panel | lowD↓ | medium | low | 0/16/34 | 0/0 | 2026-09-25 06:13 |
| @ZhangBo-cmd/dsh-pricing-badge DSH plugin: shows the DeepSeek API peak/off-peak pricing period, current model output price, and account balance in the Web UI. Click to open a price reference for DeepSeek and third-party models. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-25 06:13 |
| @ninglovegithub/dsh-workspace-combiner | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-25 06:13 |
| @lyaoliu/dsh-approval-core DSH 自动审批决策管道：例行沙箱越界自动放行，危险/拿不准/失败一律转人工（fail-safe）；学习受约束可一键清空；含分级配置 UI 与块级撤销审查视图。fork 自 dsh-approval-gate 的加固版。 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-25 08:13 |
| @EnRaiha/dsh-drill-kit The drill for DSH: a bug-fix pipeline with gates, evidence and a reviewed PR — plugin, shared c2g/PR cores, Kilo+Hermes frontends, docs | mediumD | medium | medium | 0/7/5 | 0/0 | 2026-09-25 08:13 |
| @whding110/dsh-dev-progress-memory | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 08:13 |
| @2966859746/dsh-termux-notify DSH在Temux环境中使用的通知插件，通过Termux:API给手机发送消息通知或TTS语音通知。 | lowD↓ | high | low | 3/3/4 | 0/0 | 2026-09-25 08:13 |
| @omorisunn/dsh-vibrancy Frosted-glass (acrylic) surfaces for the DSH Desktop app - a plugin-only wallpaper blur, no shell change required | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-25 10:13 |
| @azazo1/dsh-deep-diving-back 把 DSH 0.1.6 及以前那个蓝色流光的深度求索中运行标志加回来, 并保留 steer 是否已并入请求的上下位置语义 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 10:13 |
| @yembors64632/dsh-connect DSH 插件：一个插件接入 WorkBuddy / Trae / Qoder 三渠道模型，带统一状态面板、一键签到与渠道管理 | lowD↓ | medium | low | 0/4/38 | 0/0 | 2026-09-25 10:13 |
| @2861292267/DSH-Official-WorkBuddy-Credit-Proxy DSH 官方版 · WorkBuddy 积分反代 —— 把本机 WorkBuddy 账号合并为自动故障转移的模型池，接入 DSH 官方版（含 DSH 内核 0.1.7 兼容修复、启动自动同步账号、卡片内 OAuth 扫码添加） | low | low | not queued (low risk) | 0/0/8 | 0/0 | 2026-09-25 10:13 |
| @snylonue/dsh-direnv direnv support for dsh | medium | medium | queued | 0/2/5 | 0/0 | 2026-09-25 10:13 |
| @Camusugar/dsh-notify | lowD↓ | high | low | 1/0/0 | 0/0 | 2026-09-25 10:13 |
| @zlZayn/dsh-workbuddy-bridge DSH 插件：把 WorkBuddy 桌面 App 里的模型接入 DSH，零配置直接用。（原生嵌入"设置-插件-插件配置"） | mediumD↑ | low | medium | 0/0/4 | 0/0 | 2026-09-25 10:13 |
| @Andersen216/dsh-whale-girl-live2d 鲸鱼娘桌宠：DSH Web 界面里的 Live2D 桌宠（模型素材非商业，CC BY-NC-SA 4.0） | lowD↓ | medium | low | 0/25/76 | 0/0 | 2026-09-25 10:13 |
| @xs2966/dsh-termux-notify DSH在Temux环境中使用的通知插件，通过Termux:API给手机发送消息通知或TTS语音通知。 | lowD↓ | high | low | 3/3/4 | 0/0 | 2026-09-25 10:13 |
| @Au1314/dsh-style-hub DSH主题插件 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-25 12:13 |
| @qcsjjjjj/dsh-planner Calendar + per-day plan cards for the DSH Web GUI, with recurring plans and model-facing tools for the agent. No build step, no runtime dependencies. | lowD↓ | high | low | 2/6/7 | 0/0 | 2026-09-25 12:13 |
| @masknull/dsh-acl-sandbox-patch DSH 0.1.7 Windows ACL 沙箱在非系统盘工作区下全部命令 spawn 前失败的临时修复插件——不动任何系统 ACL，恢复 workspace-write。 | Temporary fix for the DSH 0.1.7 Windows ACL sandbox failing on non-system-drive workspaces (grantWrite / SetNamedSecurityInfoW Win32 5) — restores workspace-write without touching system ACLs. 支持 DSH 0.1.7-rc.1+。 | medium | medium | queued | 0/1/6 | 0/0 | 2026-09-25 12:13 |
| @H-xie/zotero4DSH Zotero 文献全文检索插件（DSH plugin） | medium | medium | queued | 0/1/6 | 0/0 | 2026-09-25 12:13 |
| @huzhengbang2007/dsh-orca-glass Liquid-glass SVG refraction layer for DSH Web + orca-scene skin | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-25 12:13 |
| @qcsjjjjj/dsh-github-accel GitHub accelerator for DSH: hosts takeover + per-domain loopback SNI passthrough (no TLS MITM, no certificate install), a local CONNECT proxy and a PAC fallback. | medium | medium | queued | 0/5/20 | 0/0 | 2026-09-25 12:13 |
| @Azhe0306/dsh-connectors DSH 连接器三件套：会话标题栏余额小组件 · 浏览器自动化接入 · Windows 桌面操控（截屏/窗口/鼠标/键盘）。 | medium | medium | queued | 0/2/5 | 0/0 | 2026-09-25 12:13 |
| @chenpengfei/dsh-daily-brief 每日简报的 DSH 插件 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-25 12:13 |
Dynamic audit results · new today (12 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Drill plugin legitimately runs shell commands and external scripts; both paths are unconfined and the tool-wiring file index.js was not harvested, so reachability could not be fully verified.
- mediumrunCapture runs any caller-supplied command line through bash -lc and writes to an unchecked logPath · lib/runner.js:33
- lowPR_CRAFT_CORE environment variable selects a file executed with python3 · lib/pr.js:26
- lowpruneDir recursively deletes children of a caller-supplied base directory without containment check · lib/cache.js:116
Runtime entry lib/index.js and client/client.js are absent from the harvest; visible modules show third-party egress of prompt state and a permissive no-Origin same-origin check.
- mediumDecision state (per design the user's message text) is transmitted to third-party api.typesafe.ai · lib/jev-client.js:58
- lowSame-origin guard treats a missing Origin header as trusted, allowing non-browser local clients to mutate config/credentials · lib/routes.js:49
CAD/STEP plugin spawns engine and probe binaries with model-named paths; the only concrete weakness is engine auto-discovery trusting an unauthenticated shared-temp registry (medium).
- mediumEngine auto-discovery trusts an unauthenticated session-registry directory in the shared temp dir · lib/host-utils.js:174
- lowTool paths are resolved against the process cwd with no workspace containment despite the documented contract · lib/index.js
Static 'critical' not reproducible: the audited code is a read-only usage API behind a same-origin fence; only hardening gaps (fail-open fence, unbounded body, dev-script path leaks) were found.
- mediumSame-origin fence fails open when Sec-Fetch-Site is absent on the unauthenticated usage API · src/lib/rpc-envelope.ts:70
- lowRequest body is buffered without any size limit · src/lib/rpc-envelope.ts:76
- lowDev sanitizer script hardcodes the author's absolute local paths and user names · scripts/sanitize-fixtures.mjs:25
Local LLM bridge that reuses the WorkBuddy desktop credential; loopback guards look solid, but credential extraction via a Spotlight-discovered helper and plaintext token copies are residual risks.
- mediumDesktop credential key is derived by spawning a WorkBuddy binary located via Spotlight, with no evidenced integrity check · scripts/issue-48-forced-fallback-e2e.mjs:6
- lowDesktop OAuth tokens are copied verbatim into plugin-owned files under $DSH_HOME · src/variants.ts:71
- lowOrigin gate passes any request without an Origin header, leaving only the bearer secret for non-browser local clients · src/llm/loopback.ts:43
Visible runtime code has no exploitable path; only low-severity hygiene issues in host-side credential-export scripts. Panel/provider sources were not in the harvest.
- lowrestore extracts an arbitrary user-supplied tarball into ~/.dsh/connect-auth without validating entry paths · scripts/export-connect-credentials.mjs:277
- lowQoder PAT is accepted as a command-line argument and persisted in plaintext · scripts/export-connect-credentials.mjs:175
- lowbundle writes a plaintext credentials tarball into the repository working directory by default · scripts/export-connect-credentials.mjs:247
Browser-only notification plugin; no network, filesystem or shell use, and the flagged dynamic-code path is a dev-only smoke harness not shipped in the runtime bundle.
- lowDev-only smoke harness executes lib/client.js via new Function(src); not part of the shipped runtime bundle · smoke.mjs:56
Harvested code is a calendar/plan store with regex-validated dates before every path join, so no traversal; the only eval-like construct sits in a dev-only script excluded from published files.
- lowDev-only test harness executes the plugin source via new Function; not a shipping risk · .dev/render-calendar.mjs:11
Team token-usage tracker: routes are guarded by the DSH trust fence and the panel output is HTML-escaped; no RCE or credential leak, only low hardening gaps.
- lowMember token and invite code are persisted in state.json with default (world-readable) file permissions · lib/index.js:177
- lowMember token is sent as a URL query parameter and the hub URL may default to plain HTTP · lib/index.js:419
- lowBrowser trust fence fails open when the connection service is missing or throws · lib/index.js:547
Refutes the static warn: every child process is spawned with argv arrays (no shell), config strings are range-checked, and the only HTTP route is POST-only, size-bounded and gated; one low hardening gap noted.
- lowCheck route trust gate is optional-chained, so it is silently skipped if the connection service lacks requestRejection · lib/index.js
Plugin only spawns fixed Termux:API binaries with argv arrays (no shell interpolation) and guards its HTTP route; static-scan criticals are heuristic false positives.
- lowCheck route silently skips the auth fence if connection.requestRejection is unavailable · lib/index.js
Only developer/publish scripts were provided; the plugin runtime entry (lib/) is absent, and the reviewed scripts are manually run with no attacker-reachable path.
- lowRestart script kills whatever process listens on port 3080 without identity check · tools/restart-dsh.sh:15
- lowDebug helpers launch headless Chrome with the sandbox disabled and remote debugging enabled · tools/dbg-eyes.mjs:12
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 28,551 in-scope entries (28,181 scanned + 370 pending).
Static scan for reference: low 27,985 · medium 0 · high 192 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
87 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-25. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2919 dynamic audit records, 2341 with a model conclusion, 321 stricter than the static verdict, 794 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published