Daily security scan
Date · 2026-09-26 (UTC — plugins first indexed that day)
84
added
0
critical
29
medium
55
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @weibaohui/dsh-fireworks dsh 插件 · 烟花庆祝引擎：agent 编程时在对话窗口上空放烟花——六类事件 × 30 张属性卡 × 洗牌袋随机变种，token 用量决定大小/高度/绚烂度，WebGL2 GPU 累积拖尾渲染 | low | pass | 0/0/6 | 0/0 | 2026-09-26 00:13 |
| @having5548/dsh-backup Backup & restore plugin for DSH: workspace, full conversations (byte-exact), attachments, settings and dsh-mnemon memory data in one zip | medium | warn | 0/2/5 | 0/0 | 2026-09-26 00:13 |
| @fan56/dsh-approval-policy dsh plugin: unattended approval gate — bounded answer window for subagent/scheduled/cron approvals, fail-closed default instead of hanging (per origin or per session) | low | pass | 0/0/7 | 0/0 | 2026-09-26 00:13 |
| @ZhangBo-cmd/dsh-coros-badge DSH 插件：常驻显示高驰手表型号与运动天数，点击展开一句话点评与建议 | low | pass | 0/0/4 | 0/0 | 2026-09-26 00:13 |
| @weibaohui/dsh-flow dsh 插件 · 执行流程图：把当前会话的执行过程画成实时三泳道流程图（回合/用户/助手/工具/审批/重试），子代理发散-收敛扇形 + 双击下钻子流程，SSE 事件驱动直播 | low | pass | 0/0/3 | 0/0 | 2026-09-26 00:13 |
| @PanChengN/dsh-plugin-session-delete 给 DSH 侧栏会话菜单加一行「删除会话」：真正从磁盘删除会话记录、派生缓存与子智能体会话（非官方插件） | low | pass | 0/0/3 | 0/0 | 2026-09-26 02:13 |
| @yknBugs/dsh-manual-approval A DSH Plugin that add a new permission that every tool call opens an approval card first | medium | warn | 0/9/13 | 0/0 | 2026-09-26 02:13 |
| @notf0und/dsh-opencode-sounds DSH plugin: opencode's notification sound pack for the DSH Web UI (fork of @ai-galaxy/dsh-sound) | low | pass | 0/0/0 | 0/0 | 2026-09-26 02:13 |
| @dxww123/dsh-alphasolve Session-scoped AlphaSolve workflow for DSH | low | pass | 0/0/1 | 0/0 | 2026-09-26 02:13 |
| @leolee9086/dsh-viz DSH 可视化卡面插件：把数据画成会话里的一张图（时间线、关系网、日历、ECharts、图册） | low | pass | 0/0/0 | 0/0 | 2026-09-26 04:13 |
| @mpetruc/dsh-vcc Deterministic VCC compaction for DSH | low | pass | 0/0/0 | 0/0 | 2026-09-26 04:13 |
| @win10ogod/dsh-fount-memory Fount-inspired memory plugin for DSH with in-turn recall and no autonomous conversation turns | low | pass | 0/0/1 | 0/0 | 2026-09-26 04:13 |
| @ZhaoAndy821/dsh-motion-background DSH WebUI 的动态背景插件：着色器型（GLSL 实时演算）与媒体型（MP4/WebM/GIF/图片）两类效果，每个效果是 mods/ 下的一个文件夹。Dynamic backdrops for the DSH WebUI. | medium | warn | 2/3/13 | 0/0 | 2026-09-26 04:13 |
| @win10ogod/dsh-evidence-first-knowledge-work Evidence-first knowledge work skill packaged as a DSH plugin | low | pass | 0/0/0 | 0/0 | 2026-09-26 04:13 |
| @win10ogod/dsh-fount-reality Autonomous screen attention and private background Agent loop for DSH | medium | warn | 0/2/5 | 0/0 | 2026-09-26 04:13 |
| @miqian-nomad/dsh-browser-playwright-codex Codex-merged dsh-browser-playwright (compiled-only fork for DSH) + full diagnosis and patches for the 'minimized browser window gets yanked back' bug. 面向 DSH 的浏览器插件整合版 + 最小化窗口被拽回桌面的诊断与补丁。 | medium | warn | 0/1/15 | 0/0 | 2026-09-26 04:13 |
| @sozercaniekosmosa/dsh-plugin-npm-run-shell | low | pass | 0/0/0 | 0/0 | 2026-09-26 04:13 |
| @shiyan688/dsh-paperdesk DSH paper workbench: arXiv search → local library (metadata/PDF/full text) → L1/L2/L3 three-layer reading notes. Host + browser halves in one package, no build step. | medium | warn | 0/4/7 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-wifi-access Host-side mobile access for DSH: 3081 reverse proxy (0.0.0.0:3081 -> 127.0.0.1:3080) + mobile browser shims; the UI lives in dsh-pocket · 移动端访问 host 侧实现与 3081 反代热备（界面由 dsh-pocket 提供） | low | pass | 0/0/4 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-hot-memory Projects Mnemon USER.md / MEMORY.md into every session system prompt · 把 Mnemon 的 USER.md / MEMORY.md 投影进每个会话的 systemPrompt | low | pass | 0/0/0 | 0/0 | 2026-09-26 06:13 |
| @ardesp0630/dsh-work-progress Persistent work-progress row for DSH: task completion, a progress bar, and what the agent is doing right now. | low | pass | 0/0/0 | 0/0 | 2026-09-26 06:13 |
| @FlyingBamboo/dsh-pkg-atlas DSH 本机代码包依赖图谱（开发工具）：把已安装的 @deepseek-ai/* 包与第三方插件的依赖、挂载关系画成区-组-包三层交互图，支持聚焦、拖拽布局与中英切换。零运行时依赖，内置 cytoscape，断网可用。 | low | pass | 0/0/4 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-lan-services LAN service manager: probes ports 3090-3099, lists titles and LAN URLs, one-click start/stop · 局域网服务管理器：探测 3090~3099 端口段的本地 HTTP 服务，一键启停 | medium | warn | 0/4/6 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-restart-button Session-header two-click Restart DSH button that restarts exactly this instance · 会话头两击确认「重启 DSH」，按本进程身份重启同一实例 | medium | warn | 0/1/4 | 0/0 | 2026-09-26 06:13 |
| @win10ogod/dsh-agent-browser | medium | warn | 0/2/11 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-literature-search Model-callable literature_search tool (OpenAlex by citation count + arXiv by relevance) · 模型可调用的 literature_search 工具（OpenAlex 被引排序 + arXiv 相关度） | medium | warn | 0/1/2 | 0/0 | 2026-09-26 06:13 |
| @noahchalifour/dsh-anthropic-image-clamp DSH plugin: downscale images on Claude requests so many-image requests never hit the 2000px limit | low | pass | 0/0/1 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-skill-sets Group skills into task-type sets: switching a set swaps the injected skill list (catalog + body shadowed) · 技能档：按任务类型分档，切档即换注入的技能清单 | low | pass | 0/0/4 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-extensions-panel Registers a virtual-display toggle card in the sidebar Extensions tab · 在左栏「功能」Tab 注册虚拟显示器开关卡片 | medium | warn | 0/1/3 | 0/0 | 2026-09-26 06:13 |
| @miseryrua/dsh-wb-memory 给 DSH 里的 Agent 一份跨会话长期记忆：真值源是工作区里的纯 Markdown，无向量库、无外部服务、零运行时依赖；每回合按预算分层注入 systemPrompt，后台自动流水 → 提炼 → 整理 → 治理。 | low | pass | 0/0/4 | 0/0 | 2026-09-26 06:13 |
| @Headmaster218/dsh-llm-moe4all Local MoE4All engine provider for DSH. / DSH MoE4All | medium | warn | 0/6/17 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-archive-button Sidebar archive button: two-click confirm, zips sessions idle for more than 3 days and deletes the originals · 侧栏归档按钮：两击确认，把空闲超过 3 天的会话打包并删除原目录 | medium | warn | 0/1/3 | 0/0 | 2026-09-26 06:13 |
| @Ln1m/dsh-local-file-search Adds a machine-wide file search to the composer @ menu (hits never enter the file tree or workspace index) · 在 @ 列表加「搜索本机文件」，全机一次性搜索，不进文件栏与工作区索引 | low | pass | 0/0/1 | 0/0 | 2026-09-26 06:13 |
| @Iambatman1928/dsh-lawagent-ui ????????? lawagent-ui:??????????(DSH ??) | medium | warn | 0/3/2 | 0/0 | 2026-09-26 08:13 |
| @huguangyu666/dsh-plugin-android-emulator DSH plugin: port of the ZCode official android-emulator plugin — 23 Android build / emulator / ADB / UI-Automator MCP tools + the android-dev skill | medium | warn | 0/1/1 | 0/0 | 2026-09-26 08:13 |
| @linanbuan/dsh-usage 用量 · Usage — DSH 设置面板：当日/累计 token 用量、缓存命中、历史日历，以及 kimi-coding / commandcode 的额度与刷新时间。 A DSH settings panel: token usage, cache hits, a history calendar, and provider quotas. | low | pass | 0/0/2 | 0/0 | 2026-09-26 08:13 |
| @xlxs123/dsh-session-multiselect DSH Desktop plugin: multi-select panel for conversations ??grouped by workspace, batch delete / fork / export / summarize / pin / archive. | low | pass | 0/0/0 | 0/0 | 2026-09-26 08:13 |
| @pure-craft/dsh-actions Deterministic project actions for people and agents — a DSH Web plugin. One actions.json, two surfaces: a right-sidebar panel and agent tools. | low | pass | 0/0/5 | 0/0 | 2026-09-26 08:13 |
| @Lequait/dsh-proxy-router Direct-first fetching with automatic proxy fallback for DSH. 订阅链接 → 本地内核 → 直连优先、失败自动切代理 | medium | warn | 0/8/8 | 0/0 | 2026-09-26 08:13 |
| @Lequait/dsh-glm-web 非官方的智谱清言（chatglm.cn）网页版 provider for DSH —— 用网页版登录态与积分驱动 agent。Unofficial Zhipu Qingyan web provider for dsh. | low | pass | 0/0/5 | 0/0 | 2026-09-26 08:13 |
| @DSH-PackForge/dsh-pack-plugin | low | pass | 0/0/1 | 0/0 | 2026-09-26 08:13 |
| @s-huizhuy-u/dsh-github-sync Publish a DSH workspace to GitHub: create the repo, initialize git, commit, and push — with the token held in the DSH credential store. | medium | warn | 0/1/8 | 0/0 | 2026-09-26 08:13 |
| @longgege-cd/dsh-skin-pixel-anime Pixel-anime skin plugin for DSH web UI: palettes, pixel fonts (incl. simplified Chinese), corner presets, pixel clock. | low | pass | 0/0/0 | 0/0 | 2026-09-26 08:13 |
| @HapyRain/dsh-router-laya Auto tier routing for DSH: a locally fine-tuned model picks low/high/max thinking effort per message. Private, <1s, no cloud. 自动档位路由 | medium | warn | 0/11/17 | 0/0 | 2026-09-26 08:13 |
| @re-ITRT/dsh-skill-mcp-panel A Skill list and MCP server manager for DSH, mounted as a sidebar panel and themed entirely from the host's own design tokens. | low | pass | 0/0/6 | 0/0 | 2026-09-26 08:13 |
| @eighteentang/dsh-plugin-dev-tools DSH 开发工具箱：界面元素定位（Alt+悬浮）、随插件分发的开发经验库、开发模式自检清单注入 | medium | warn | 1/10/12 | 0/0 | 2026-09-26 10:13 |
| @bruceyork00-a11y/PinMe Just Pin a model to Favorites, so you dont need to choose it from menu. (Dsh plugin) | low | pass | 0/0/3 | 0/0 | 2026-09-26 10:13 |
| @Billwu18/dsh-cache-hit-monitor Live prompt-cache telemetry for the current session in the DSH right sidebar: a register bank, a dot-matrix hit rate and a reactor-core history board. | low | pass | 0/0/0 | 0/0 | 2026-09-26 10:13 |
| @superSizzzz/dsh-think-budget DSH 插件：给单步思考一个字数预算，连续几步没有可见结论时强制先给结论再继续 | low | pass | 0/0/1 | 0/0 | 2026-09-26 10:13 |
| @plumeume/dsh-copilot-key 把笔记本的 Copilot 硬件键变成启动/唤起 DSH：自研按键钩子 + DSH 管理器插件（dsh-copilot-key，已发布 npm） | medium | warn | 0/2/2 | 0/0 | 2026-09-26 10:13 |
| @jonah791/dsh-temporal-self 时间自我模型 T1 时距注入（距主人上条 / 距自圈 / 今日已醒）——注入坐标，不假装感觉 | low | pass | 0/0/1 | 0/0 | 2026-09-26 10:13 |
| @Daniel92Q/dsh-sidebar-footer-stack DSH plugin: stacks the sidebar footer slot entries vertically, unifies their card chrome, and lets you drag them to reorder. | low | pass | 0/0/4 | 0/0 | 2026-09-26 10:13 |
| @pgnqukezrdxmhjso/dsh-llm-codebuddy-power 功能齐全的 CodeBuddy（WorkBuddy）提供者插件。 A full-featured CodeBuddy (WorkBuddy) provider plugin. | low | pass | 0/0/0 | 0/0 | 2026-09-26 12:13 |
| @jevgpt/dsh-plugin-locale-tr Turkish (tr) language pack for the DSH web GUI - 45 namespaces, 1,870 UI strings, no core changes | low | pass | 0/0/3 | 0/0 | 2026-09-26 12:13 |
| @superSizzzz/dsh-feishu-bridge Two-way bridge between DSH and a Feishu / Lark bot: stage conclusions out, messages in, work summary at the end. | medium | warn | 0/1/8 | 0/0 | 2026-09-26 12:13 |
| @Lgv-H/dsh-maibot-plugin-writer DSH 插件：让 DSH自己编写、校验、安装麦麦（MaiBot）插件。5 个 maibot_* 工具 + 随包 skill，能力白名单与 SDK 方法表实时取自本机 MaiBot | medium | warn | 0/1/4 | 0/0 | 2026-09-26 12:13 |
| @Snowy117/dsh-direnv Load each workspace's direnv environment into every DSH command. 让 DSH 每个工作区的子进程自动带上该工作区的 direnv 环境。 | low | pass | 0/0/0 | 0/0 | 2026-09-26 12:13 |
| @YYK0402/dsh-siyuan-archive | medium | warn | 0/4/12 | 0/0 | 2026-09-26 12:13 |
| @ZhaoZeW/dsh-rollback TRAE-style conversation rollback for DSH: per-turn checkpoints, in-place context truncation, and an affected-file diff preview. | low | pass | 0/0/1 | 0/0 | 2026-09-26 12:13 |
| @Planckbaka/dsh-plugin-github-workflows GitHub workflows for DSH: repos, PRs, issues, commits, releases, Actions, Codespaces, search & raw gh api - one plugin on the GitHub CLI | low | pass | 0/0/0 | 0/0 | 2026-09-26 12:13 |
| @18569663yz-web/dsh-plugin-crypto-ticker DSH 侧边栏左下角的实时加密货币行情卡片：BTC / ETH / SOL / JUP 的价格、24h 涨跌幅与 24 点迷你走势图，价格跳动带脉冲反馈，零依赖、免密钥。A live crypto ticker card in the DSH sidebar footer, above the balance and Settings - zero dependencies, no API key. | medium | warn | 0/1/5 | 0/0 | 2026-09-26 12:13 |
| @Zioove/gpt-6-astra-dsh-preset DSH agent preset + bundle plugin: the GPT-6 / Codex Astra persona on dsh standard toolset, with a preset-local reference skill and a slim spawned-subagent persona | medium | warn | 0/3/2 | 0/3 | 2026-09-26 12:13 |
| @rinDBeans/codex-ui DSH Web 的 Codex 化界面插件 · A Codex-style interface plugin for DSH Web | medium | warn | 0/3/22 | 0/0 | 2026-09-26 12:13 |
| @EXarchive/DshLauncher DSH 桌面控制台 —— 单文件便携，双击即用 | low | pass | 0/0/0 | 0/0 | 2026-09-26 12:13 |
| @dienlanhvietnam-lang/deepseek-harness-vietnamese Vietnamese language pack for DSH with complete localization, CI verification and upstream tracking. | low | pass | 0/0/1 | 0/0 | 2026-09-26 14:13 |
| @kangtsang/dsh-worktree-space dsh-worktree-space is a DSH plugin that creates isolated multi-repo workspaces for AI agents using Git worktrees. Each task gets its own workspace containing separate worktrees for every repository, enabling parallel agents to work without file conflicts, context pollution, or tangled commits. | low | pass | 0/0/2 | 0/0 | 2026-09-26 14:13 |
| @overact/dsh-context-management Windowed compaction, session-private notes and paged history recall for DSH | low | pass | 0/0/4 | 0/0 | 2026-09-26 14:13 |
| @ArthurZhou/dsh-plugin-model-hub A DSH web plugin that adds a Model Hub settings page for configuring | low | pass | 0/0/0 | 0/0 | 2026-09-26 14:13 |
| @weibaohui/dsh-matrix dsh 插件 · 黑客帝国数字雨：对话窗口铺上经典字符雨背景，token 原文掺进雨里，雨势随 agent 活跃度起伏 | low | pass | 0/0/6 | 0/0 | 2026-09-26 14:13 |
| @HuaimaoCy/dsh-codex-chatgpt Use the Codex desktop app's ChatGPT models inside DSH: a first-class LLM provider plus conversation-access tools, reusing the desktop app's own ChatGPT sign-in. | low | pass | 0/0/7 | 0/0 | 2026-09-26 14:13 |
| @HuaimaoCy/dsh-agent-hub DSH plugin: run several agents on different models at once, with a shared real-time progress board. | low | pass | 0/0/0 | 0/0 | 2026-09-26 14:13 |
| @liuyun847/dsh-host-restart DSH 宿主插件:给模型一个 restart_dsh 工具,重启 dsh 后自动恢复原会话续跑 | medium | warn | 0/1/3 | 0/0 | 2026-09-26 14:13 |
| @Neo65536-engineer/dsh-agent-log Read-only work reports for DSH: reconstruct what an agent task actually did from session logs — tools used, files read/written, commands run, test results, failures, token usage, and whether it finished. Fully offline, no API key, no data leaves your machine. | medium | warn | 3/0/11 | 0/0 | 2026-09-26 14:13 |
| @functy23/dsh-mcp-studio DSH 的 MCP 服务与 Skills 管理器：面板里增删改 MCP 行、扫描导入其他 Agent 配置、管理 Skills（DSH Web 插件） | low | pass | 0/0/0 | 0/0 | 2026-09-26 14:13 |
| @liuyun847/dsh-client-ui-session-rail DSH Web 客户端插件:侧边栏收起时在左侧空白区竖排显示活跃会话横条 | low | pass | 0/0/0 | 0/0 | 2026-09-26 14:13 |
| @sunzphy/dsh-sidebar-status DeepSeek account wallet balance and the live peak/off-peak billing period, in a fixed status region at the sidebar foot — plus a one-click official top-up link. | low | pass | 0/0/0 | 0/0 | 2026-09-26 14:13 |
| @1497105876/dsh-text-inject dsh 插件：在官方设置页把文字注入系统提示词 / 会话上下文，独立文件存储，热加载 + 历史备份 · Inject text into the DSH system prompt or session context from a Settings page | medium | warn | 0/4/1 | 0/0 | 2026-09-26 16:13 |
| @seanchen88/dsh-pluginHive DSH的自定义插件（包括MCP工具、技能管理面板等） | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @lovezi0/dsh-workspace-acl-allow 处理沟槽的dsh Windows 的 DACL（Discretionary Access Control List，自主访问控制列表）必须显式授予的问题 | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @VoodooB0Ys/dsh-desktop-notify DSH 的 Windows 桌面提醒：需要授权 / 提问 / 完成 / 出错 / 被中止时在屏幕角落弹出提醒，点一下回到对应对话 | Windows desktop reminders for DSH, with click-to-open. | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @GIN0076/dsh-token-usage 📊 Token usage dashboard for DSH Settings — daily/weekly/monthly per-model token stats with line & bar charts. Local-first, zero deps, pure SVG. DSH 设置面板词元用量统计插件 | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @Aicksion/dsh-clean-desktop-shell-pro Enhanced fork of dsh-clean-desktop-shell: auto-start backend, no browser tab, ask-before-quit on exit, parallel cold start. | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @shuiiiiimu/dsh-selfharness DSH 上的 Harness 层自我改进插件 | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
| @HuaimaoCy/dsh-memory-vault Knowledge and memory vault for DSH: memory groups with automatic summarization, free assignment between conversation memory and the knowledge base, priorities, a base-prompt layer, and AI curation. | low | pending | 0/0/0 | 0/0 | 2026-09-26 16:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
42 reports2026-09-2763 added0 crit23 medium2026-09-26current84 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-26. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published