Daily security scan
Date · 2026-09-27 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report8 of 63 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 63 new entries: 8 with a conclusion, 15 queued, 1 failed (no conclusion), 39 low-risk not queued.
Data file updated 2026-11-12 07:55 (UTC+8); latest conclusion audited 2026-10-23 08:11 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @rickwindman/dsh-destinywind-mcp DSH 插件：MCP 可视化管理（服务器/工具开关/环境变量/凭据托管）· Visual MCP manager UI plugin for DSH | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-memory DSH 插件：长期记忆库，注入每个会话的系统提示，设置页增删，HTTP API 改数 · Durable long-term memory bank plugin for DSH | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-tpm DSH 插件：TPM/DPAPI 封存的凭据提供器，取代明文凭据文件 · TPM/DPAPI-sealed credential provider plugin for DSH | highD↑ | medium | high | 0/5/1 | 0/0 | 2026-09-27 00:13 |
| @Gaozx1/dsh-web-search-engine DSH 插件：用 Bing / DuckDuckGo / Mojeek / Google / Brave 多引擎混合替代默认网络搜索，带可视化设置页 | lowD↓ | medium | low | 0/5/7 | 0/0 | 2026-09-27 02:13 |
| @hiJoeLee/dsh-suggest-actions 类 Trae 体验，在 AI 回复后提供候选建议，点击后发送指令 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ChengqianHuang/dsh-personal Personal assistant bundle for DSH: natural-language capture, query, and review tools over one SQLite file | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ONEOne-1v1/dsh-github-upload | low | low | not queued (low risk) | 0/0/12 | 0/0 | 2026-09-27 02:13 |
| @hu568/dsh-plugin-browser-use DSH 插件：ARIA 快照优先的浏览器操作工具集（导航/点击/输入/截图/多标签）+ 右侧栏实时投屏与用户接管面板。移植自 zai-org/ZCode（Apache-2.0）。MIT。 | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-persona-memory DSH 插件：角色设定与长期记忆（角色库 persona.yml/SOUL.md/USER.md + FACT.md/MEMORY.md + JOURNAL.jsonl），注册在宿主组合层，对所有 agent 预设生效，附右侧栏管理面板。MIT。 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @jr-create/dsh-prompt-wisp 提示词精灵 — 在 DSH 输入框旁一键把草稿优化成结构化提示词 / One-click prompt optimization button for the DSH composer | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-voice-transcribe dsh 插件：本地语音/视频转写（SILK 解码 + faster-whisper），不花 API 钱 | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-27 04:14 |
| @supengpeng/dsh-ssh SSH plugin for DSH: connection, exec/PTY, SFTP transfer, right-sidebar UI | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-memory-search Markdown 笔记 → Agent 的长期记忆：本地 embedding + SQLite FTS5 混合召回（dsh 插件） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @s11phere/dsh-commandcode-quota Command Code plan quota in your DSH session header — 5h / weekly / monthly windows, reset countdowns, and billing-period usage | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-pack-memory-browser DSH 插件包：记忆 + 浏览器（Schema v1 分发清单，spec 指向各插件仓库，随包附带离线 tarball 与自检脚本）。MIT。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @zhengjy01/dsh-mcp-manager MCP server manager for DSH: add, edit, enable and test stdio / Streamable HTTP MCP servers from the Web settings page and from agent tools, connected and disconnected at runtime without restarting DSH | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @Weihong-Liu/dsh-html-live-preview Live HTML preview inside DSH conversations: a render_html tool plus an inline, sandboxed, auto-sized renderer. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @jipika/dsh-preset-hotswap Switch the agent preset (standard / PTC / cordis) of an already-started conversation from the session header. DSH host+client plugin. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @AllenWES365/dsh-local-memory Project-isolated long-term memory for DSH:每个项目各存各的库，一个总视角看遍全部。Seeds a project's memory from its git history without opening a session. | medium | medium | queued | 0/2/5 | 0/0 | 2026-09-27 06:13 |
| @jcjyids/dsh-web-advanced-settings | medium | medium | queued | 0/3/9 | 0/0 | 2026-09-27 06:13 |
| @underworld-oddball/sh-volume-shuff Read the newest turn aloud from the DSH composer | medium | medium | queued | 0/1/6 | 0/0 | 2026-09-27 06:13 |
| @hanbernate/dsh-save-button Adds a Download button to DSH delivery cards, so files delivered with present save straight from the browser. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-usage-dashboard DSH 宿主插件：把 dsh-usage-stats 生成的用量报表挂到宿主 Web 的 /usage，鉴权复用宿主登录态（零依赖） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @hbgdjb/dsh-session-shield Session Shield —— 让 DSH 会话日志永远不会因为一次畸形 tool call（空 id / 空 name / 非法 arguments）而打不开。装上即用，零配置、零依赖。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-ask-timeout-notify DSH 宿主插件：ask_user_question 超过阈值（默认 60 分钟）无人回答时，向 notify-hub 投递一条待办并通过飞书/webhook/email 推送 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @upcyan/dsh-mimo-usage MiMo (Xiaomi) quota ring and usage detail tab for DSH | lowD↓ | high | low | 1/0/10 | 0/0 | 2026-09-27 06:13 |
| @Timebro9999/dsh-session-deck Manage your whole workspace in the DSH sidebar: a pinned band for projects and conversations, a bell activity view with answer previews, per-project emoji icons, and collapsible 置顶/项目/组件 sections. Bilingual (EN/中文). | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-27 06:13 |
| @cjx12036/TaskWatch User-intent tracking and agent supervision for DSH · 用户意图监督与受控纠偏 | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @Theflowyears/dsh-arknights-theme Arknights theme pack for the DSH Web GUI: wallpapers with saturation-driven edge blur, an acrylic sidebar, and a one-click wallpaper picker. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @Finderchangchang/brewreel 精酿 BrewReel：让 DeepSeek 这类便宜模型也能做出好看的竖版宣传片。写一份产品简报，AI 挑镜头、写文案，一条命令出片。3 种配方、6 个行业、广告法校验，开源可商用。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @luckbiao/dsh-markdown-highlighter Rich syntax highlighting for DSH Markdown: activates builtin Shiki theme colors and styles diff codeblocks with green/red backgrounds and split-view | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @Zessi-C/dsh-model-thinking-levels Per-model thinking levels (reasoningEfforts) for custom DSH llm-pi-ai routes, with gateway-side capability probing | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-27 08:13 |
| @Paimonshen/dsh-coding-plugin 代码学习插件 — DSH 动态 Cordis 插件：悬浮窗代码编辑器/多语言执行/课程关卡评判/分析直投对话 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @rezon-aki/dsh-doc-kit 文档体系体检：只读工具 doc_lint（注入层配额 / 被禁措辞 / 索引路径 / 是否进 git）+ 随包 doc-governance 技能 | medium | medium | queued | 0/1/1 | 0/0 | 2026-09-27 08:13 |
| @john-walks-slow/dsh-live2d-voice Live2D companion for DSH: realtime TTS voice, continuous speech input, subtitle translation, multi-model catalog, standalone entry | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @b8yg7vjstj-ctrl/dsh-llamacpp-bridge DSH plugin: local llama.cpp (llama-server) as a first-class model provider — process/router management, catalog sync with mmproj vision pairing, auto-start, stop-then-load switching, and a sidebar terminal monitor panel. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @s11phere/dsh-tex-block-normalizer DSH plugin: fix Pandoc-style $$ display-math blocks that DSH mis-parses into a red KaTeX parse error. | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-27 08:13 |
| @yousj666/dsh-audio-converter DSH 音频转换器：解密网易云 NCM / 酷我 KWM / 酷狗 KGM / QQ音乐 QMC，格式互转 + 音质增强（EBU R128 响度归一化、EQ、重采样、位深）。可打成 197MB 单文件 exe，零依赖。 | mediumD | medium | medium | 0/6/14 | 0/0 | 2026-09-27 08:13 |
| @mingdui/dsh-growth-workbench 面向普通用户的个人成长工作台：画像 → 能力模型 → 90 天计划 → 今日执行 → 证据 → 考核复盘。页面与 Agent 读写同一份数据。 | low | low | not queued (low risk) | 0/0/9 | 0/0 | 2026-09-27 08:13 |
| @SFLAQiu/dsh-waker 正在苏醒的数字员工 | highD↑ | medium | high | 0/12/32 | 0/0 | 2026-09-27 08:13 |
| @pandarayc/dsh-skill-tier Progressive disclosure for DSH skill collections: one generated index skill stays in the catalog, every member stays user-invocable but leaves the model catalog. Zero dependencies. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @lyp88997/dsh-browser-service 自建 DSH 浏览器服务：单例 CDP 守护 + DSH ctx.browser provider + 兼容 dsh-univer-office 的可执行包装（非 root 服务器环境） | mediumD↓ | high | medium | 2/11/45 | 0/0 | 2026-09-27 10:13 |
| @LeeLizuoLiu/rice-patrol Rice Patrol: a bounded reasoning loop guard and clean recovery plugin for DSH | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-27 10:13 |
| @Sostay/dsh-wallpaper Custom full-window wallpaper plugin for DSH: gradient presets, image URLs, local uploads, frosted glass, and a theme-aware top gradient. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @fzy-yy/dsh-mcp-inventory DSH plugin: a Settings page listing the MCP servers the current profile has switched on | medium | medium | queued | 0/1/10 | 0/0 | 2026-09-27 10:13 |
| @rajpaulsingh6-stack/dsh-genoffice-captain DSH plugin: launch GenOffice for GenOffice task-list skills, or designate a Captain session to orchestrate first | medium | medium | queued | 0/1/18 | 0/0 | 2026-09-27 10:13 |
| @jetformat/dsh-plugin DSH plugin for Jetformat: Office to PDF and PDF tools via the local CLI | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-27 10:13 |
| @Sen70s/dsh-workspace-plus 增强DSH的工作区的多级目录功能 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-27 10:13 |
| @MuzeWinter/dscomputer-control Windows desktop automation for DSH: 14 tools for real GUI input (click, type, keys, scroll, drag), occlusion-proof window screenshots and the accessibility tree. | medium | medium | queued | 0/1/4 | 0/0 | 2026-09-27 10:13 |
| @tayuLuc/dsh-ru-voice-input Russian-first Voice input for DSH: local GigaAM v3 with punctuation, and a speech registry fix that makes recognizer switching work | medium | medium | queued | 0/2/13 | 0/0 | 2026-09-27 10:13 |
| @koinrokka/dsh-plugins DSH extension bundles for Koinrokka: sandbox runtime providers, IDE tools, LLM adapters | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-27 10:13 |
| @HuaiminHuang/dsh-subscription-plugin Experimental DSH plugin for ChatGPT/Codex subscription sign-in and model routing. v0.0.2 preview; real login unverified. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @upcyan/dsh-mimo-extension MiMo (Xiaomi) quota ring and usage detail tab for DSH | lowD↓ | high | low | 1/0/10 | 0/0 | 2026-09-27 12:13 |
| @malko/dsh-malko-prefs Some settings to make DSH more comfortable to use | mediumD↑ | low | medium | 0/0/3 | 0/0 | 2026-09-27 12:13 |
| @sviktor75/dsh-sound-notification DSH Web plugin: plays a chime when any session's response finishes (rising tone) or a question/approval is asked (falling tone), with a click-to-mute badge. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-27 12:13 |
| @KAsyori/dsh-unicode-guard DSH plugin: keeps the glyph class that trips content moderation out of every model-visible surface, so a fetched page cannot permanently break a session. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @OMSociety/dsh-mineru DSH 插件：把扫描版 PDF 送到 MinerU 云端解析，产出带页码块锚点的 Markdown（页码锚点 / 分片续跑 / 后台任务 / 配置页） | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @wbb316/dsh-novel DSH 插件：小说创作台 —— 给 agent 5 个 novel_* 工具 + 一个能改设定、画关系图、一键续写并流式直播的右侧栏面板 | medium | medium | audit failed | 0/4/9 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/dsh-uia-agent Windows UI Automation agent for DSH: enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot + window state as a dsh plugin (single C++ exe) | medium | medium | queued | 0/1/1 | 0/0 | 2026-09-27 12:13 |
| @catsenior507/dsh-command-center Command center for DSH: watch running background jobs in one panel, tell a long silence apart from a hang, and see when the agent is waiting on you. | medium | medium | queued | 0/2/8 | 0/0 | 2026-09-27 12:13 |
| @David7583/baigong_research_atlas Local research continuity across agents and AI clients, with versioned tasks, traceable evidence and verifiable handoffs. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/uia-agent Windows UI Automation agent - single C++ exe (enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot/window-state). Built with MSVC, static CRT. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @NMTZ-z/system-one-benchmark-lab | medium | medium | queued | 0/3/4 | 0/0 | 2026-09-27 12:13 |
Dynamic audit results · new today (8 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Linux keyring fallback stores the raw AES data key in the on-disk JSON, so all sealed credentials are recoverable from the file alone; TPM key reuse can also destroy existing stores.
- highLinux keyring backend returns the raw data key, so the store file contains the AES master key in cleartext · linux.js:173
- mediumTPM probe recreates a machine-global key with OverwriteExistingKey and can permanently orphan existing stores · tpm.js:68
- lowLinux artefact directory falls back to /tmp and temp files use predictable names with default mode and no symlink protection · linux.js:141
Unvalidated Waker id is concatenated into a preset path and passed to recursive fs.rmSync, letting an RPC caller delete arbitrary directories; webhook tokens and message text are also persisted on disk.
- highUnvalidated Waker id reaches recursive fs.rmSync, enabling deletion of arbitrary directories · pkg/lib/index.js
- lowDingTalk session webhooks and raw message text are persisted in the install directory · pkg/bridge/bridge.cjs
Audio decrypt/convert plugin: ffmpeg is spawned with argv arrays (no shell) and there is no outbound network; the real risk is the unauthenticated loopback UI server in exe/main.mjs.
- mediumLoopback UI server authenticates only by source-address regex, no Origin/Host/token check, so any web page can drive it (CSRF) · exe/main.mjs:364
- lowUpload handler buffers up to 512 MB fully in RAM per request with no auth · exe/main.mjs:344
Browser daemon in a wrapper looks well-guarded (loopback-only CDP, Bearer token, 0600 state), but the bundled kernel runs with --no-sandbox; several low-risk gaps in dev scripts.
- mediumHeadless Chromium is always launched with --no-sandbox, so untrusted page content runs at full process privilege · src/config.mjs:127
- lowdshBin interpolated into `sh -c` command string in the peer-linking helper · scripts/lib/host-peers.mjs:19
- lowBrowser kernel path from config.json/env is spawned after an executable check only · src/config.mjs:96
Preset retargeting and sound route are guarded, but the malkoModels.probe RPC can send any env/credential as a Bearer token to a caller-chosen URL.
- mediummalkoModels.probe resolves any identifier-shaped env var/credential and sends it as Bearer to a caller-chosen URL · lib/index.mjs:157
- loweval/new Function executes !!js expressions parsed from preset YAML at load time · lib/preset-config.cjs:158
- lowpresetId is joined into the preset file path without traversal validation · lib/preset-config.cjs:118
The two harvested files are developer-only self-check scripts with no runtime reachability; host.js/client.js were not harvested, so the 4 heuristic criticals cannot be verified or refuted.
- lowDev self-check script evaluates client.js source with new Function inside a full-privilege Node process · check-client.mjs:34
- lowcheck.mjs re-evaluates extracted host/client source fragments via new Function · check.mjs
Only developer-run self-check scripts were harvestable; their eval/spawn patterns are never loaded by DSH at runtime, and no runtime file was available to review.
- lowDev-only self-check harness evaluates plugin source and loads modules from the resolved dsh install · check-client.mjs:34
Legitimate multi-engine search provider; browser spawn, API keys and proxy use are user-controlled and disclosed; only minor low-risk hardening gaps.
- lowBrave API key header is replayed on cross-host redirects · lib/http.js:299
- lowUser-configurable browser.exe path is spawned as a process · lib/browser.js:201
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 28,551 in-scope entries (28,181 scanned + 370 pending).
Static scan for reference: low 27,985 · medium 0 · high 192 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
87 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-27. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2919 dynamic audit records, 2341 with a model conclusion, 321 stricter than the static verdict, 794 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published