Daily security scan
Date · 2026-09-28 (UTC — plugins first indexed that day)
64
added
0
critical
23
medium
41
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @HERO476/dsh-sidecard-ask DSH ????(??????):????/????????,???????????????????Selection follow-up for DSH with an independent side-card answerer. | low | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @shinelon/dsh-mermaid-plugin Render mermaid code blocks in DSH chat as diagrams - 在 DSH 聊天中将 mermaid 代码块渲染为图形 | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @BoweiDuan/dsh-tui-session-manager Session manager plugin for dsh-TUI: a /sessions scene to browse, filter and truly delete saved sessions, plus cleanup of the state leftovers the host delete path leaves behind. | low | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-huoqu DSH desktop plugin: capture a rendered webpage into a local offline HTML and MHTML copy. | medium | warn | 0/4/10 | 0/0 | 2026-09-28 02:14 |
| @qujinting/dsh-web-search-clinepass DSH plugin : web_search provider that searches with the session's selected model via gateway-native search tools, replacing the built-in DeepSeek-only provider. | low | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @knopki/dsh-prompt-profiles DSH bundle that adds a per-session prompt profiles: named sets of extra system-prompt sections with their own order and scope, sealed into the prompt at session start. | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Barricadetrecharm99/ruvnet-ruflo 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated | medium | warn | 0/2/3 | 0/0 | 2026-09-28 02:14 |
| @reactive-resume/reactive-resume A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today! | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Shadid516/dsh-off-peak-hours DSH plugin: an ambient pill under the composer showing whether your selected DeepSeek or z.ai plan is billed at peak or off-peak (half-price) rates right now, with a click-to-open schedule panel. PS: No human touched this code | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @fan56/dsh-jev-core Shared TypeSafe Jev decision-model client for the dsh ecosystem: strict response validation, keychain-first key resolution, typed fail-open errors. Jev-optional by design. | medium | warn | 0/1/3 | 0/0 | 2026-09-28 02:14 |
| @dn4hjtcr9s-del/dsh-wait-guard Keep an Agent's turn open until every descendant subagent settles — a pure Host-plane completion gate for DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-subagents DSH desktop plugin: staged team plans, continuable members, dependency tasks, and a collaboration board. | low | pass | 0/0/2 | 0/0 | 2026-09-28 02:14 |
| @Age10-Moyu/dsh-adiv-theme | low | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @aiyacharley/dsh-at-sider 给原生侧边栏文件树补上「@ 引用 + 修改时间」：右侧栏的 文件 标签页还是原生的，每一行多了一个紧跟文件名的【@文件】引用按钮，和行尾固定的【修改时间】。 | low | pass | 0/0/4 | 0/0 | 2026-09-28 04:14 |
| @Bill-666code/dsh-kimi-shell DSH Web UI plugin: turn the dsh-web-mobile session drawer into a kimi-style bottom sheet 把左侧会话抽屉变成 kimi 风格底部浮层 | low | pass | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @yonchicy/dsh-composer-modenter DSH web plugin: Enter for newline, Cmd/Ctrl+Enter to send | low | pass | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @YV3507/dsh-plugin-allcrash DSH Host plugin: a configured forbidden plugin - loaded, enabled, or about to be installed - crashes the Host process on the spot, with a crash report. Inspired by the Minecraft Forge mod allcrash. | low | pass | 0/0/5 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-jev-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | low | pass | 0/0/11 | 0/0 | 2026-09-28 04:14 |
| @stuga-dev/agent-plugins Packages that connect coding agents to Stuga: DSH and Pi. | medium | warn | 0/3/7 | 0/0 | 2026-09-28 04:14 |
| @Jaffe2718/s1cap System-1 decision models (Jev/Laya/Kev-class) as the governance layer for an LLM agent context lifecycle: growing association graph over session segments, relevance-gated recall with Trace-as-State ordering, and plan pre-ranking — measured in solve rate, cache hit/miss tokens, cost and latency. DSH plugin + harness-agnostic proxy. | medium | warn | 0/8/12 | 0/0 | 2026-09-28 04:14 |
| @Drkoh-wz/team-craft Dependency-ordered multi-agent team orchestration plugin for DSH: per-role model routes, an independent review gate with bounded rework, a durable run ledger, and a live progress panel in the web UI. | medium | warn | 4/3/3 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-agent-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | low | pass | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @huangmiuXyz/dsh-edit-retry Right-click any user message to edit it and retry from that point — a client-side plugin for DSH. · 右键编辑任意一条用户消息并从那里重试。 | low | pass | 0/0/4 | 0/0 | 2026-09-28 06:15 |
| @d0ublecl1ck/dsh-external-link Open http/https/mailto/tel anchor links from the DSH web GUI in the OS default application — including localhost URLs the Electron shell keeps in-app. | medium | warn | 0/1/2 | 0/0 | 2026-09-28 06:15 |
| @Napstablooky233/dsh-agent-dispatch Visible dispatch panel for DSH — decide whether other agents help, pick free-lane helpers, and inject the division-of-labour policy. | medium | warn | 0/2/11 | 0/0 | 2026-09-28 06:15 |
| @linzimu666/dsh-intent-suggest 在 dsh 输入框上方猜你还没打完的意图，给几条可以直接发的任务候选；点一下只填回输入框，不替你发送 | medium | warn | 0/1/7 | 0/0 | 2026-09-28 06:15 |
| @lilcandi/dsh-any-background-plus Enhanced fork of dsh-any-background: dual-lane wallpaper (one picture down each side, clear of the centre column) + one folder per side dsh-any-background 的增强分支：左右双图轮播（避开中间会话区）+ 左右各一个文件夹 | low | pass | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @wxlei2004/dsh-plugins DSH plugins collection | low | pass | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @mattlennon/jev-harness-router Budget-aware Jev routing plugin for DSH with multi-provider reasoning, SSE, and cancellation reconciliation | low | pass | 0/0/6 | 0/0 | 2026-09-28 06:15 |
| @liggest/dsh-alt-enter-newline 拯救 dsh 中的 Alt+Enter 换行选手 | low | pass | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @MengXinSu/dsh-viya-memory 本地长期记忆插件 for DSH：卡片以 Markdown 存在你自己的 Obsidian vault 里 · Local long-term memory as plain Markdown cards in your own Obsidian vault | medium | warn | 0/1/0 | 0/0 | 2026-09-28 08:13 |
| @dao-awa/dsh-computer-use-native Windows computer use for DSH, built for a vision model: screenshot the real desktop, read the interface from pixels, and drive it through Win32 FFI with no accessibility tree. Input posts to a window's own queue so the desktop focus is left alone. | low | pass | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @JessenReinhart/dsh-tokenslash | medium | warn | 0/3/6 | 0/0 | 2026-09-28 08:13 |
| @feihong-li/dsh-abaqus DSH plugin: drive Abaqus CAE modelling from a declarative JSON spec, with a verified free CalculiX backend for solving and result extraction. | medium | warn | 0/2/7 | 0/0 | 2026-09-28 08:13 |
| @Utmotc/dsh-plugin-balance 在DSH左侧启用一个余额监测卡片 | medium | warn | 1/1/13 | 0/0 | 2026-09-28 08:13 |
| @shinelon/dsh-mcp-plugin | low | pass | 0/0/2 | 0/0 | 2026-09-28 08:13 |
| @laa1991/dsh-health Declarative health readout for DSH: declare where to read, what counts as healthy, and which verdict each reading maps to. Read-only. | low | pass | 0/0/1 | 0/0 | 2026-09-28 08:13 |
| @BoyangL04/dsh-task-notify DSH plugin: in-app toast + macOS notification when a session finishes a turn or is blocked on you (tool approval, question, plan review). | low | pass | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @XIAOZHAOXSXH/dsh-moyu-reader dsh-moyu-reader，dsh小说阅读器 | low | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @yuhhhong/dsh-skill-status dsh插件，用于显示当前会话skill的状态 | low | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @xujian519/dsh-annotator 对DSH的交付物进行标注的插件，人工标注后，DSH会根据标注执行 | low | pass | 0/0/4 | 0/0 | 2026-09-28 10:14 |
| @798645706/dsh-strawberry-data-hub Strawberry research tools for DSH | medium | warn | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @ShukebtAb/Dsh-OtherAPI One-click setup for any OpenAI-compatible API in DSH, with automatic thinking-mode support. Adapted to the DSH 0.1.7 entry-config settings model. | low | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @OutLawZhangSan-liii/dsh-tailnet-gateway | medium | warn | 0/1/11 | 0/0 | 2026-09-28 10:14 |
| @winditer/dsh-paste-spill Inbound large-paste handling for the DSH composer: each 4-50 KB paste folds into one chip, a >=50 KB paste becomes a real file attachment with a deliverable card. | low | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @BarneyZhaoooo/dsh-theme-native A small, native theme plugin for the DSH Web GUI. | low | pass | 0/0/3 | 0/0 | 2026-09-28 10:14 |
| @CrazyPigHead/dsh-plugin-agents-loader dsh plugin: auto-load ~/.agents/mcp.json MCP servers (http/stdio), ~/.agents/commands/ slash commands and AGENTS.md, with hot reload | low | pass | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @dzwalker/dsh-session-keepwarm Keep the most recently used sessions resident in the browser, so switching back reuses the loaded history instead of re-reading it. DSH plugin. | low | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @flyhigao/dsh-file-download Add a download button to DSH document previews | medium | warn | 0/1/1 | 0/0 | 2026-09-28 10:14 |
| @xurunxin/dsh-llm-model-tuning Per-model reasoning-effort levels and multimodal input settings for custom providers in the DSH Models settings page. | low | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @demxyuanli/dsh-canvas DSH project-board plugin —— 适配 DSH 的项目看板插件：agent 写的 .canvas.tsx 看板实时编译渲染到右栏，面板决定可回流给 agent。 | medium | warn | 0/2/1 | 0/0 | 2026-09-28 10:14 |
| @rasyidmmz/dsh-paper-search Literature search for DSH: 13 international sources and 3 Indonesian journal portals, all native HTTP, with a status tool that reports which sources answer. | low | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @cyh3436332528/dsh-plugin-session-purge DSH 会话管理插件：永久删除会话，连同它的日志、投影缓存、工作区记账与子会话（子代理）一起清掉。设置页入口，删除不可恢复。 | low | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @relaxyabc/dsh-GitPanel 一个类似 intellij-idea 中 Git 插件UI 的 dsh git 插件 | medium | warn | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @SanChou0627/dsh-token-bill Live DeepSeek balance and per-hour token costing for DSH: two agent tools read the live balance and the ledger-observed daily charge, then write Markdown/HTML/JSON statements. | medium | warn | 0/3/7 | 0/0 | 2026-09-28 10:14 |
| @asun-labs/dsh-plugin-token-dashboard DSH plugin for generating a self-contained token usage dashboard | low | pass | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @fengbinmov/R4-Coder-Provider R4 Coder账户的套餐余额、钱包、并发上限、到期时间、今日消费与最近 7 天用量。 | medium | warn | 0/1/5 | 0/0 | 2026-09-28 10:14 |
| @ming-14/download-by-mirror-skill 让 AI 学会从镜像下载资源 - 覆盖 GitHub NuGet HuggingFace vcpkg Cargo Maven Maven DockerHub apt WinGet pip npm/pnpm | low | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @hu568/dsh-plugin-cluster-preset DSH「集群模式」agent preset：主控智能体自主编排 5 个具名专家子智能体，附「智能体寿命论」阶段提示器 | medium | warn | 0/3/13 | 0/0 | 2026-09-28 12:14 |
| @gosomea/dsh-opencode-go OpenCode Go and Zen live model discovery, pricing and session routing for DSH | low | pass | 0/0/2 | 0/0 | 2026-09-28 12:14 |
| @miqian-nomad/dsh-new-workdir 一键领一个独立工作目录并开干净会话：目录即沙盒边界，产物不再互相污染。One click: a fresh timestamped workdir as a DSH workspace with a clean session. 零官方文件改动。 | low | pass | 0/0/3 | 0/0 | 2026-09-28 12:14 |
| @ZnonEn/dsh-mcp-manager DSH 插件：在桌面端设置页里管理 MCP 服务器 —— 新增/编辑/删除/启停 + 运行状态，直接读写 profile 的 cordis.patch.yml，零依赖。 | medium | warn | 0/2/2 | 0/0 | 2026-09-28 12:14 |
| @Movingelated/dsh-local-ollama-models DSH plugin: delegate read-only collection tasks to a local Ollama model — zero cloud token cost, zero API key. 把只读采集任务交给本机 Ollama 模型：含设置面板 + 选型尺 + AI 可读说明书。 | medium | warn | 0/2/11 | 0/0 | 2026-09-28 12:14 |
| @Soulize/dsh-continue-on-limit-host Auto-continue for DSH: when a local model hits its output-token cap, automatically send "continue" so the reply keeps flowing | low | pass | 0/0/0 | 0/0 | 2026-09-28 12:14 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
43 reports2026-09-28current64 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-28. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published