Daily security scan
Date · 2026-09-27 (UTC — plugins first indexed that day)
63
added
0
critical
23
medium
40
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @rickwindman/dsh-destinywind-mcp DSH 插件：MCP 可视化管理（服务器/工具开关/环境变量/凭据托管）· Visual MCP manager UI plugin for DSH | low | pass | 0/0/1 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-memory DSH 插件：长期记忆库，注入每个会话的系统提示，设置页增删，HTTP API 改数 · Durable long-term memory bank plugin for DSH | low | pass | 0/0/5 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-tpm DSH 插件：TPM/DPAPI 封存的凭据提供器，取代明文凭据文件 · TPM/DPAPI-sealed credential provider plugin for DSH | medium | warn | 0/5/1 | 0/0 | 2026-09-27 00:13 |
| @Gaozx1/dsh-web-search-engine DSH 插件：用 Bing / DuckDuckGo / Mojeek / Google / Brave 多引擎混合替代默认网络搜索，带可视化设置页 | medium | warn | 0/5/7 | 0/0 | 2026-09-27 02:13 |
| @hiJoeLee/dsh-suggest-actions 类 Trae 体验，在 AI 回复后提供候选建议，点击后发送指令 | low | pass | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ChengqianHuang/dsh-personal Personal assistant bundle for DSH: natural-language capture, query, and review tools over one SQLite file | low | pass | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ONEOne-1v1/dsh-github-upload | low | pass | 0/0/12 | 0/0 | 2026-09-27 02:13 |
| @hu568/dsh-plugin-browser-use DSH 插件：ARIA 快照优先的浏览器操作工具集（导航/点击/输入/截图/多标签）+ 右侧栏实时投屏与用户接管面板。移植自 zai-org/ZCode（Apache-2.0）。MIT。 | medium | warn | 0/1/5 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-persona-memory DSH 插件：角色设定与长期记忆（角色库 persona.yml/SOUL.md/USER.md + FACT.md/MEMORY.md + JOURNAL.jsonl），注册在宿主组合层，对所有 agent 预设生效，附右侧栏管理面板。MIT。 | low | pass | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @jr-create/dsh-prompt-wisp 提示词精灵 — 在 DSH 输入框旁一键把草稿优化成结构化提示词 / One-click prompt optimization button for the DSH composer | low | pass | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-voice-transcribe dsh 插件：本地语音/视频转写（SILK 解码 + faster-whisper），不花 API 钱 | medium | warn | 0/1/2 | 0/0 | 2026-09-27 04:14 |
| @supengpeng/dsh-ssh SSH plugin for DSH: connection, exec/PTY, SFTP transfer, right-sidebar UI | low | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-memory-search Markdown 笔记 → Agent 的长期记忆：本地 embedding + SQLite FTS5 混合召回（dsh 插件） | low | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @s11phere/dsh-commandcode-quota Command Code plan quota in your DSH session header — 5h / weekly / monthly windows, reset countdowns, and billing-period usage | low | pass | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-pack-memory-browser DSH 插件包：记忆 + 浏览器（Schema v1 分发清单，spec 指向各插件仓库，随包附带离线 tarball 与自检脚本）。MIT。 | low | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @zhengjy01/dsh-mcp-manager MCP server manager for DSH: add, edit, enable and test stdio / Streamable HTTP MCP servers from the Web settings page and from agent tools, connected and disconnected at runtime without restarting DSH | low | pass | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @Weihong-Liu/dsh-html-live-preview Live HTML preview inside DSH conversations: a render_html tool plus an inline, sandboxed, auto-sized renderer. | low | pass | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @jipika/dsh-preset-hotswap Switch the agent preset (standard / PTC / cordis) of an already-started conversation from the session header. DSH host+client plugin. | low | pass | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @AllenWES365/dsh-local-memory Project-isolated long-term memory for DSH:每个项目各存各的库，一个总视角看遍全部。Seeds a project's memory from its git history without opening a session. | medium | warn | 0/2/5 | 0/0 | 2026-09-27 06:13 |
| @jcjyids/dsh-web-advanced-settings | medium | warn | 0/3/9 | 0/0 | 2026-09-27 06:13 |
| @underworld-oddball/sh-volume-shuff Read the newest turn aloud from the DSH composer | medium | warn | 0/1/6 | 0/0 | 2026-09-27 06:13 |
| @hanbernate/dsh-save-button Adds a Download button to DSH delivery cards, so files delivered with present save straight from the browser. | low | pass | 0/0/3 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-usage-dashboard DSH 宿主插件：把 dsh-usage-stats 生成的用量报表挂到宿主 Web 的 /usage，鉴权复用宿主登录态（零依赖） | low | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @hbgdjb/dsh-session-shield Session Shield —— 让 DSH 会话日志永远不会因为一次畸形 tool call（空 id / 空 name / 非法 arguments）而打不开。装上即用，零配置、零依赖。 | low | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-ask-timeout-notify DSH 宿主插件：ask_user_question 超过阈值（默认 60 分钟）无人回答时，向 notify-hub 投递一条待办并通过飞书/webhook/email 推送 | low | pass | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @upcyan/dsh-mimo-usage MiMo (Xiaomi) quota ring and usage detail tab for DSH | medium | warn | 1/0/10 | 0/0 | 2026-09-27 06:13 |
| @Timebro9999/dsh-session-deck Manage your whole workspace in the DSH sidebar: a pinned band for projects and conversations, a bell activity view with answer previews, per-project emoji icons, and collapsible 置顶/项目/组件 sections. Bilingual (EN/中文). | low | pass | 0/0/4 | 0/0 | 2026-09-27 06:13 |
| @cjx12036/TaskWatch User-intent tracking and agent supervision for DSH · 用户意图监督与受控纠偏 | low | pass | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @Theflowyears/dsh-arknights-theme Arknights theme pack for the DSH Web GUI: wallpapers with saturation-driven edge blur, an acrylic sidebar, and a one-click wallpaper picker. | low | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @Finderchangchang/brewreel 精酿 BrewReel：让 DeepSeek 这类便宜模型也能做出好看的竖版宣传片。写一份产品简报，AI 挑镜头、写文案，一条命令出片。3 种配方、6 个行业、广告法校验，开源可商用。 | low | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @luckbiao/dsh-markdown-highlighter Rich syntax highlighting for DSH Markdown: activates builtin Shiki theme colors and styles diff codeblocks with green/red backgrounds and split-view | low | pass | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @Zessi-C/dsh-model-thinking-levels Per-model thinking levels (reasoningEfforts) for custom DSH llm-pi-ai routes, with gateway-side capability probing | low | pass | 0/0/2 | 0/0 | 2026-09-27 08:13 |
| @Paimonshen/dsh-coding-plugin 代码学习插件 — DSH 动态 Cordis 插件：悬浮窗代码编辑器/多语言执行/课程关卡评判/分析直投对话 | low | pass | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @rezon-aki/dsh-doc-kit 文档体系体检：只读工具 doc_lint（注入层配额 / 被禁措辞 / 索引路径 / 是否进 git）+ 随包 doc-governance 技能 | medium | warn | 0/1/1 | 0/0 | 2026-09-27 08:13 |
| @john-walks-slow/dsh-live2d-voice Live2D companion for DSH: realtime TTS voice, continuous speech input, subtitle translation, multi-model catalog, standalone entry | low | pass | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @b8yg7vjstj-ctrl/dsh-llamacpp-bridge DSH plugin: local llama.cpp (llama-server) as a first-class model provider — process/router management, catalog sync with mmproj vision pairing, auto-start, stop-then-load switching, and a sidebar terminal monitor panel. | low | pass | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @s11phere/dsh-tex-block-normalizer DSH plugin: fix Pandoc-style $$ display-math blocks that DSH mis-parses into a red KaTeX parse error. | medium | warn | 0/1/0 | 0/0 | 2026-09-27 08:13 |
| @yousj666/dsh-audio-converter DSH 音频转换器：解密网易云 NCM / 酷我 KWM / 酷狗 KGM / QQ音乐 QMC，格式互转 + 音质增强（EBU R128 响度归一化、EQ、重采样、位深）。可打成 197MB 单文件 exe，零依赖。 | medium | warn | 0/6/14 | 0/0 | 2026-09-27 08:13 |
| @mingdui/dsh-growth-workbench 面向普通用户的个人成长工作台：画像 → 能力模型 → 90 天计划 → 今日执行 → 证据 → 考核复盘。页面与 Agent 读写同一份数据。 | low | pass | 0/0/9 | 0/0 | 2026-09-27 08:13 |
| @SFLAQiu/dsh-waker 正在苏醒的数字员工 | medium | warn | 0/12/32 | 0/0 | 2026-09-27 08:13 |
| @pandarayc/dsh-skill-tier Progressive disclosure for DSH skill collections: one generated index skill stays in the catalog, every member stays user-invocable but leaves the model catalog. Zero dependencies. | low | pass | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @lyp88997/dsh-browser-service 自建 DSH 浏览器服务：单例 CDP 守护 + DSH ctx.browser provider + 兼容 dsh-univer-office 的可执行包装（非 root 服务器环境） | medium | warn | 2/11/45 | 0/0 | 2026-09-27 10:13 |
| @LeeLizuoLiu/rice-patrol Rice Patrol: a bounded reasoning loop guard and clean recovery plugin for DSH | low | pass | 0/0/1 | 0/0 | 2026-09-27 10:13 |
| @Sostay/dsh-wallpaper Custom full-window wallpaper plugin for DSH: gradient presets, image URLs, local uploads, frosted glass, and a theme-aware top gradient. | low | pass | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @fzy-yy/dsh-mcp-inventory DSH plugin: a Settings page listing the MCP servers the current profile has switched on | medium | warn | 0/1/10 | 0/0 | 2026-09-27 10:13 |
| @rajpaulsingh6-stack/dsh-genoffice-captain DSH plugin: launch GenOffice for GenOffice task-list skills, or designate a Captain session to orchestrate first | medium | warn | 0/1/18 | 0/0 | 2026-09-27 10:13 |
| @jetformat/dsh-plugin DSH plugin for Jetformat: Office to PDF and PDF tools via the local CLI | medium | warn | 0/1/2 | 0/0 | 2026-09-27 10:13 |
| @Sen70s/dsh-workspace-plus 增强DSH的工作区的多级目录功能 | low | pass | 0/0/4 | 0/0 | 2026-09-27 10:13 |
| @MuzeWinter/dscomputer-control Windows desktop automation for DSH: 14 tools for real GUI input (click, type, keys, scroll, drag), occlusion-proof window screenshots and the accessibility tree. | medium | warn | 0/1/4 | 0/0 | 2026-09-27 10:13 |
| @tayuLuc/dsh-ru-voice-input Russian-first Voice input for DSH: local GigaAM v3 with punctuation, and a speech registry fix that makes recognizer switching work | medium | warn | 0/2/13 | 0/0 | 2026-09-27 10:13 |
| @koinrokka/dsh-plugins DSH extension bundles for Koinrokka: sandbox runtime providers, IDE tools, LLM adapters | low | pass | 0/0/5 | 0/0 | 2026-09-27 10:13 |
| @HuaiminHuang/dsh-subscription-plugin Experimental DSH plugin for ChatGPT/Codex subscription sign-in and model routing. v0.0.2 preview; real login unverified. | low | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @upcyan/dsh-mimo-extension MiMo (Xiaomi) quota ring and usage detail tab for DSH | medium | warn | 1/0/10 | 0/0 | 2026-09-27 12:13 |
| @malko/dsh-malko-prefs Some settings to make DSH more comfortable to use | low | pass | 0/0/3 | 0/0 | 2026-09-27 12:13 |
| @sviktor75/dsh-sound-notification DSH Web plugin: plays a chime when any session's response finishes (rising tone) or a question/approval is asked (falling tone), with a click-to-mute badge. | low | pass | 0/0/2 | 0/0 | 2026-09-27 12:13 |
| @KAsyori/dsh-unicode-guard DSH plugin: keeps the glyph class that trips content moderation out of every model-visible surface, so a fetched page cannot permanently break a session. | low | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @OMSociety/dsh-mineru DSH 插件：把扫描版 PDF 送到 MinerU 云端解析，产出带页码块锚点的 Markdown（页码锚点 / 分片续跑 / 后台任务 / 配置页） | low | pending | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @wbb316/dsh-novel DSH 插件：小说创作台 —— 给 agent 5 个 novel_* 工具 + 一个能改设定、画关系图、一键续写并流式直播的右侧栏面板 | medium | warn | 0/4/9 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/dsh-uia-agent Windows UI Automation agent for DSH: enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot + window state as a dsh plugin (single C++ exe) | medium | warn | 0/1/1 | 0/0 | 2026-09-27 12:13 |
| @catsenior507/dsh-command-center Command center for DSH: watch running background jobs in one panel, tell a long silence apart from a hang, and see when the agent is waiting on you. | medium | warn | 0/2/8 | 0/0 | 2026-09-27 12:13 |
| @David7583/baigong_research_atlas Local research continuity across agents and AI clients, with versioned tasks, traceable evidence and verifiable handoffs. | low | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/uia-agent Windows UI Automation agent - single C++ exe (enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot/window-state). Built with MSVC, static CRT. | low | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @NMTZ-z/system-one-benchmark-lab | medium | warn | 0/3/4 | 0/0 | 2026-09-27 12:13 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
42 reports2026-09-27current63 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-27. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published