Daily security scan
Date · 2026-09-25 (UTC — plugins first indexed that day)
45
added
1
critical
24
medium
20
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @SenmuuuuW/dsh-diagnostic-tutor Diagnosis-first AI learning runtime for DSH — map what you need, learn interactively, and move to the next best step. | medium | warn | 0/2/9 | 0/0 | 2026-09-25 00:13 |
| @qikairo7/dsh-usage-panel Session-level token usage & cost panel plugin for DSH | critical | fail | 1/0/2 | 0/0 | 2026-09-25 00:13 |
| @3289192-bot/dsh-cache-bricks Cache Bricks for DSH — visualize prompt-cache health and request activity. | low | pass | 0/0/1 | 0/0 | 2026-09-25 00:13 |
| @jackControls/dsh-nbcad-plate DSH plugin: 2D plate prints to noBS CAD scripts and STEP files (skill + CAD tools + native print probe) | medium | warn | 0/3/7 | 0/0 | 2026-09-25 02:13 |
| @etony668/dsh-balance DeepSeek API 余额常驻显示（侧边栏「设置」旁）· DeepSeek API balance badge beside Settings in the DSH sidebar | low | pass | 0/0/3 | 0/0 | 2026-09-25 02:13 |
| @VCPr0j3k7/dsh-index-tap-bridge Make tapIndex-based DSH plugins work in the official DSH desktop shell | low | pass | 0/0/1 | 0/0 | 2026-09-25 02:13 |
| @Locietta/dsh-rewind-retry DSH plugin: Retry, Edit prompt, and Continue actions for chat turns (rewind by forking the session) | low | pass | 0/0/0 | 0/0 | 2026-09-25 02:13 |
| @martyartem/dsh-plannotator Review a file, a folder or a web page in the Plannotator browser UI from DSH, and get the annotations back as a message. | medium | warn | 0/2/13 | 0/0 | 2026-09-25 02:13 |
| @sequoiayunus-hue/dsh-subagent-model-config Configure per-teammate model & reasoning effort for DSH native agent teams — settings UI, zero official-file modification. 为 DSH 原生 Team 编队队员可视化配置模型与推理档位。 | low | pass | 0/0/2 | 0/0 | 2026-09-25 02:13 |
| @qikairo7/dsh-gemini-pool DSH 用上 Gemini 的方式 —— 让你的 Google AI Pro 订阅成为编程模型池：多模态 / 前端生成 / 生图 / 多账号调度 | medium | warn | 0/3/11 | 0/0 | 2026-09-25 02:13 |
| @mattcarvercom/dsh-unified-memory Long-term memory for DSH in Claude Code's format: private, overlay, or shared with Claude Code, with provenance on every file | medium | warn | 0/1/5 | 0/0 | 2026-09-25 02:13 |
| @hbgdjb/dsh-mimo-quota MIMO Quota Panel —— DSH 的模型额度面板：会话日志逐调用自动记账，一屏展示 Token 用量、消费金额、请求次数、趋势波形、模型构成，支持按模型/粒度/时间范围/项目·对话统计切换，内置可编辑定价与 DeepSeek 峰谷价自动套算。 | medium | warn | 0/1/5 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-time-inject DSH 插件：每个 turn 首个 step 往模型上下文追加一条单行中文时间读数（当前时间 / 星期 / 时区 / 距上条消息） | low | pass | 0/0/0 | 0/0 | 2026-09-25 04:14 |
| @zhaoguoqiang-hub/dsh-soul-engine 可审计的明文 Markdown 记忆账本插件（DSH / DSH）：14 个 soul_* 工具 + 轮首账本注入 + 零 token 自维护 + 心跳唤醒 | medium | warn | 0/4/21 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-peak-gate DSH插件：按 DeepSeek 峰谷分时计价在高峰踩刹车——拦重活、压输出上限、工具预算、峰时精简输出，含中国法定节假日自动日历与一键放行口令。 | low | pass | 0/0/1 | 0/0 | 2026-09-25 04:14 |
| @bakasbk/dsh-connect-comate Connect the locally signed-in WPS Comate account to DSH as a model provider, via a secure loopback shim (reverse-proxy style). 通过安全回环 shim（反向代理），把本机已登录的 WPS Comate 账号接入 DSH 作为模型来源。 | low | pass | 0/0/1 | 0/0 | 2026-09-25 04:14 |
| @CNyaotian-Lunar/dsh-toolbox DSH 工具箱：读 DSH 会话日志 / 维护 meow-memory 记忆库的常驻脚本集（由 DeepSeek 编写） | low | pass | 0/0/9 | 0/0 | 2026-09-25 04:14 |
| @mengqi1436/DSH-Rtk-rewrite DSH中通过Rtk进行改写 | medium | warn | 0/1/3 | 0/0 | 2026-09-25 04:14 |
| @CSlawyer1985/dsh-jev-router DSH 插件 · 用 Jev（TypeSafe System One）判定推理强度：默认只切思考强度（零缓存代价），自动模型路由出厂关闭 + 硬门禁 + 成本闸。作者 chenshi.ai | medium | warn | 0/5/5 | 0/0 | 2026-09-25 06:13 |
| @windwhiterain/dsh-model-proxy Per-model outbound proxy routing for DSH: send only the models you name through a proxy, with a direct fallback while it is unavailable. | medium | warn | 0/3/7 | 0/0 | 2026-09-25 06:13 |
| @CroissanTTs/dsh-harness-jarvis 贾维斯 · 常驻桌面的悬浮窗桌面助手 / 桌面宠物 —— DSH Desktop 的粒子光球：快速审批权限、⌃⌥J 快速对话。A floating-window desktop assistant & desktop pet for DSH Desktop. | low | pass | 0/0/0 | 0/0 | 2026-09-25 06:13 |
| @guooo1380/dsh-team-panel | medium | warn | 0/16/34 | 0/0 | 2026-09-25 06:13 |
| @ZhangBo-cmd/dsh-pricing-badge DSH plugin: shows the DeepSeek API peak/off-peak pricing period, current model output price, and account balance in the Web UI. Click to open a price reference for DeepSeek and third-party models. | low | pass | 0/0/3 | 0/0 | 2026-09-25 06:13 |
| @ninglovegithub/dsh-workspace-combiner | medium | warn | 0/1/2 | 0/0 | 2026-09-25 06:13 |
| @lyaoliu/dsh-approval-core DSH 自动审批决策管道：例行沙箱越界自动放行，危险/拿不准/失败一律转人工（fail-safe）；学习受约束可一键清空；含分级配置 UI 与块级撤销审查视图。fork 自 dsh-approval-gate 的加固版。 | low | pass | 0/0/4 | 0/0 | 2026-09-25 08:13 |
| @EnRaiha/dsh-drill-kit The drill for DSH: a bug-fix pipeline with gates, evidence and a reviewed PR — plugin, shared c2g/PR cores, Kilo+Hermes frontends, docs | medium | warn | 0/7/5 | 0/0 | 2026-09-25 08:13 |
| @whding110/dsh-dev-progress-memory | low | pass | 0/0/0 | 0/0 | 2026-09-25 08:13 |
| @2966859746/dsh-termux-notify DSH在Temux环境中使用的通知插件，通过Termux:API给手机发送消息通知或TTS语音通知。 | medium | warn | 3/3/4 | 0/0 | 2026-09-25 08:13 |
| @omorisunn/dsh-vibrancy Frosted-glass (acrylic) surfaces for the DSH Desktop app - a plugin-only wallpaper blur, no shell change required | low | pass | 0/0/6 | 0/0 | 2026-09-25 10:13 |
| @azazo1/dsh-deep-diving-back 把 DSH 0.1.6 及以前那个蓝色流光的深度求索中运行标志加回来, 并保留 steer 是否已并入请求的上下位置语义 | low | pass | 0/0/0 | 0/0 | 2026-09-25 10:13 |
| @yembors64632/dsh-connect DSH 插件：一个插件接入 WorkBuddy / Trae / Qoder 三渠道模型，带统一状态面板、一键签到与渠道管理 | medium | warn | 0/4/38 | 0/0 | 2026-09-25 10:13 |
| @2861292267/DSH-Official-WorkBuddy-Credit-Proxy DSH 官方版 · WorkBuddy 积分反代 —— 把本机 WorkBuddy 账号合并为自动故障转移的模型池，接入 DSH 官方版（含 DSH 内核 0.1.7 兼容修复、启动自动同步账号、卡片内 OAuth 扫码添加） | low | pass | 0/0/8 | 0/0 | 2026-09-25 10:13 |
| @snylonue/dsh-direnv direnv support for dsh | medium | warn | 0/2/5 | 0/0 | 2026-09-25 10:13 |
| @Camusugar/dsh-notify | medium | warn | 1/0/0 | 0/0 | 2026-09-25 10:13 |
| @zlZayn/dsh-workbuddy-bridge DSH 插件：把 WorkBuddy 桌面 App 里的模型接入 DSH，零配置直接用。（原生嵌入"设置-插件-插件配置"） | low | pass | 0/0/4 | 0/0 | 2026-09-25 10:13 |
| @Andersen216/dsh-whale-girl-live2d 鲸鱼娘桌宠：DSH Web 界面里的 Live2D 桌宠（模型素材非商业，CC BY-NC-SA 4.0） | medium | warn | 0/25/76 | 0/0 | 2026-09-25 10:13 |
| @xs2966/dsh-termux-notify DSH在Temux环境中使用的通知插件，通过Termux:API给手机发送消息通知或TTS语音通知。 | medium | warn | 3/3/4 | 0/0 | 2026-09-25 10:13 |
| @Au1314/dsh-style-hub DSH主题插件 | low | pass | 0/0/5 | 0/0 | 2026-09-25 12:13 |
| @qcsjjjjj/dsh-planner Calendar + per-day plan cards for the DSH Web GUI, with recurring plans and model-facing tools for the agent. No build step, no runtime dependencies. | medium | warn | 2/6/7 | 0/0 | 2026-09-25 12:13 |
| @masknull/dsh-acl-sandbox-patch DSH 0.1.7 Windows ACL 沙箱在非系统盘工作区下全部命令 spawn 前失败的临时修复插件——不动任何系统 ACL，恢复 workspace-write。 | Temporary fix for the DSH 0.1.7 Windows ACL sandbox failing on non-system-drive workspaces (grantWrite / SetNamedSecurityInfoW Win32 5) — restores workspace-write without touching system ACLs. 支持 DSH 0.1.7-rc.1+。 | medium | warn | 0/1/6 | 0/0 | 2026-09-25 12:13 |
| @H-xie/zotero4DSH Zotero 文献全文检索插件（DSH plugin） | medium | warn | 0/1/6 | 0/0 | 2026-09-25 12:13 |
| @huzhengbang2007/dsh-orca-glass Liquid-glass SVG refraction layer for DSH Web + orca-scene skin | low | pass | 0/0/3 | 0/0 | 2026-09-25 12:13 |
| @qcsjjjjj/dsh-github-accel GitHub accelerator for DSH: hosts takeover + per-domain loopback SNI passthrough (no TLS MITM, no certificate install), a local CONNECT proxy and a PAC fallback. | medium | warn | 0/5/20 | 0/0 | 2026-09-25 12:13 |
| @Azhe0306/dsh-connectors DSH 连接器三件套：会话标题栏余额小组件 · 浏览器自动化接入 · Windows 桌面操控（截屏/窗口/鼠标/键盘）。 | medium | warn | 0/2/5 | 0/0 | 2026-09-25 12:13 |
| @chenpengfei/dsh-daily-brief 每日简报的 DSH 插件 | low | pass | 0/0/0 | 0/0 | 2026-09-25 12:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
42 reports2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-25current45 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-25. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published