Daily security scan
Date · 2026-09-28 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report5 of 64 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 64 new entries: 5 with a conclusion, 18 queued, 1 failed (no conclusion), 40 low-risk not queued.
Data file updated 2026-11-14 07:30 (UTC+8); latest conclusion audited 2026-11-12 07:50 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @HERO476/dsh-sidecard-ask DSH ????(??????):????/????????,???????????????????Selection follow-up for DSH with an independent side-card answerer. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @shinelon/dsh-mermaid-plugin Render mermaid code blocks in DSH chat as diagrams - 在 DSH 聊天中将 mermaid 代码块渲染为图形 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @BoweiDuan/dsh-tui-session-manager Session manager plugin for dsh-TUI: a /sessions scene to browse, filter and truly delete saved sessions, plus cleanup of the state leftovers the host delete path leaves behind. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-huoqu DSH desktop plugin: capture a rendered webpage into a local offline HTML and MHTML copy. | lowD↓ | medium | low | 0/4/10 | 0/0 | 2026-09-28 02:14 |
| @qujinting/dsh-web-search-clinepass DSH plugin : web_search provider that searches with the session's selected model via gateway-native search tools, replacing the built-in DeepSeek-only provider. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @knopki/dsh-prompt-profiles DSH bundle that adds a per-session prompt profiles: named sets of extra system-prompt sections with their own order and scope, sealed into the prompt at session start. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Barricadetrecharm99/ruvnet-ruflo 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated | medium | medium | queued | 0/2/3 | 0/0 | 2026-09-28 02:14 |
| @reactive-resume/reactive-resume A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today! | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Shadid516/dsh-off-peak-hours DSH plugin: an ambient pill under the composer showing whether your selected DeepSeek or z.ai plan is billed at peak or off-peak (half-price) rates right now, with a click-to-open schedule panel. PS: No human touched this code | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @fan56/dsh-jev-core Shared TypeSafe Jev decision-model client for the dsh ecosystem: strict response validation, keychain-first key resolution, typed fail-open errors. Jev-optional by design. | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-28 02:14 |
| @dn4hjtcr9s-del/dsh-wait-guard Keep an Agent's turn open until every descendant subagent settles — a pure Host-plane completion gate for DSH. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-subagents DSH desktop plugin: staged team plans, continuable members, dependency tasks, and a collaboration board. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 02:14 |
| @Age10-Moyu/dsh-adiv-theme | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @aiyacharley/dsh-at-sider 给原生侧边栏文件树补上「@ 引用 + 修改时间」：右侧栏的 文件 标签页还是原生的，每一行多了一个紧跟文件名的【@文件】引用按钮，和行尾固定的【修改时间】。 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 04:14 |
| @Bill-666code/dsh-kimi-shell DSH Web UI plugin: turn the dsh-web-mobile session drawer into a kimi-style bottom sheet 把左侧会话抽屉变成 kimi 风格底部浮层 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @yonchicy/dsh-composer-modenter DSH web plugin: Enter for newline, Cmd/Ctrl+Enter to send | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @YV3507/dsh-plugin-allcrash DSH Host plugin: a configured forbidden plugin - loaded, enabled, or about to be installed - crashes the Host process on the spot, with a crash report. Inspired by the Minecraft Forge mod allcrash. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-jev-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | low | low | not queued (low risk) | 0/0/11 | 0/0 | 2026-09-28 04:14 |
| @stuga-dev/agent-plugins Packages that connect coding agents to Stuga: DSH and Pi. | medium | medium | audit failed | 0/3/7 | 0/0 | 2026-09-28 04:14 |
| @Jaffe2718/s1cap System-1 decision models (Jev/Laya/Kev-class) as the governance layer for an LLM agent context lifecycle: growing association graph over session segments, relevance-gated recall with Trace-as-State ordering, and plan pre-ranking — measured in solve rate, cache hit/miss tokens, cost and latency. DSH plugin + harness-agnostic proxy. | mediumD | medium | medium | 0/8/12 | 0/0 | 2026-09-28 04:14 |
| @Drkoh-wz/team-craft Dependency-ordered multi-agent team orchestration plugin for DSH: per-role model routes, an independent review gate with bounded rework, a durable run ledger, and a live progress panel in the web UI. | lowD↓ | high | low | 4/3/3 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-agent-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @huangmiuXyz/dsh-edit-retry Right-click any user message to edit it and retry from that point — a client-side plugin for DSH. · 右键编辑任意一条用户消息并从那里重试。 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 06:15 |
| @d0ublecl1ck/dsh-external-link Open http/https/mailto/tel anchor links from the DSH web GUI in the OS default application — including localhost URLs the Electron shell keeps in-app. | medium | medium | queued | 0/1/2 | 0/0 | 2026-09-28 06:15 |
| @Napstablooky233/dsh-agent-dispatch Visible dispatch panel for DSH — decide whether other agents help, pick free-lane helpers, and inject the division-of-labour policy. | medium | medium | queued | 0/2/11 | 0/0 | 2026-09-28 06:15 |
| @linzimu666/dsh-intent-suggest 在 dsh 输入框上方猜你还没打完的意图，给几条可以直接发的任务候选；点一下只填回输入框，不替你发送 | medium | medium | queued | 0/1/7 | 0/0 | 2026-09-28 06:15 |
| @lilcandi/dsh-any-background-plus Enhanced fork of dsh-any-background: dual-lane wallpaper (one picture down each side, clear of the centre column) + one folder per side dsh-any-background 的增强分支：左右双图轮播（避开中间会话区）+ 左右各一个文件夹 | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @wxlei2004/dsh-plugins DSH plugins collection | mediumD↑ | low | medium | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @mattlennon/jev-harness-router Budget-aware Jev routing plugin for DSH with multi-provider reasoning, SSE, and cancellation reconciliation | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-09-28 06:15 |
| @liggest/dsh-alt-enter-newline 拯救 dsh 中的 Alt+Enter 换行选手 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @MengXinSu/dsh-viya-memory 本地长期记忆插件 for DSH：卡片以 Markdown 存在你自己的 Obsidian vault 里 · Local long-term memory as plain Markdown cards in your own Obsidian vault | medium | medium | queued | 0/1/0 | 0/0 | 2026-09-28 08:13 |
| @dao-awa/dsh-computer-use-native Windows computer use for DSH, built for a vision model: screenshot the real desktop, read the interface from pixels, and drive it through Win32 FFI with no accessibility tree. Input posts to a window's own queue so the desktop focus is left alone. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @JessenReinhart/dsh-tokenslash | medium | medium | queued | 0/3/6 | 0/0 | 2026-09-28 08:13 |
| @feihong-li/dsh-abaqus DSH plugin: drive Abaqus CAE modelling from a declarative JSON spec, with a verified free CalculiX backend for solving and result extraction. | medium | medium | queued | 0/2/7 | 0/0 | 2026-09-28 08:13 |
| @Utmotc/dsh-plugin-balance 在DSH左侧启用一个余额监测卡片 | mediumD↓ | high | medium | 1/1/13 | 0/0 | 2026-09-28 08:13 |
| @shinelon/dsh-mcp-plugin | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 08:13 |
| @laa1991/dsh-health Declarative health readout for DSH: declare where to read, what counts as healthy, and which verdict each reading maps to. Read-only. | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-28 08:13 |
| @BoyangL04/dsh-task-notify DSH plugin: in-app toast + macOS notification when a session finishes a turn or is blocked on you (tool approval, question, plan review). | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @XIAOZHAOXSXH/dsh-moyu-reader dsh-moyu-reader，dsh小说阅读器 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @yuhhhong/dsh-skill-status dsh插件，用于显示当前会话skill的状态 | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @xujian519/dsh-annotator 对DSH的交付物进行标注的插件，人工标注后，DSH会根据标注执行 | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-09-28 10:14 |
| @798645706/dsh-strawberry-data-hub Strawberry research tools for DSH | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @ShukebtAb/Dsh-OtherAPI One-click setup for any OpenAI-compatible API in DSH, with automatic thinking-mode support. Adapted to the DSH 0.1.7 entry-config settings model. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @OutLawZhangSan-liii/dsh-tailnet-gateway | medium | medium | queued | 0/1/11 | 0/0 | 2026-09-28 10:14 |
| @winditer/dsh-paste-spill Inbound large-paste handling for the DSH composer: each 4-50 KB paste folds into one chip, a >=50 KB paste becomes a real file attachment with a deliverable card. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @BarneyZhaoooo/dsh-theme-native A small, native theme plugin for the DSH Web GUI. | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-28 10:14 |
| @CrazyPigHead/dsh-plugin-agents-loader dsh plugin: auto-load ~/.agents/mcp.json MCP servers (http/stdio), ~/.agents/commands/ slash commands and AGENTS.md, with hot reload | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @dzwalker/dsh-session-keepwarm Keep the most recently used sessions resident in the browser, so switching back reuses the loaded history instead of re-reading it. DSH plugin. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @flyhigao/dsh-file-download Add a download button to DSH document previews | medium | medium | queued | 0/1/1 | 0/0 | 2026-09-28 10:14 |
| @xurunxin/dsh-llm-model-tuning Per-model reasoning-effort levels and multimodal input settings for custom providers in the DSH Models settings page. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @demxyuanli/dsh-canvas DSH project-board plugin —— 适配 DSH 的项目看板插件：agent 写的 .canvas.tsx 看板实时编译渲染到右栏，面板决定可回流给 agent。 | medium | medium | queued | 0/2/1 | 0/0 | 2026-09-28 10:14 |
| @rasyidmmz/dsh-paper-search Literature search for DSH: 13 international sources and 3 Indonesian journal portals, all native HTTP, with a status tool that reports which sources answer. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @cyh3436332528/dsh-plugin-session-purge DSH 会话管理插件：永久删除会话，连同它的日志、投影缓存、工作区记账与子会话（子代理）一起清掉。设置页入口，删除不可恢复。 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @relaxyabc/dsh-GitPanel 一个类似 intellij-idea 中 Git 插件UI 的 dsh git 插件 | medium | medium | queued | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @SanChou0627/dsh-token-bill Live DeepSeek balance and per-hour token costing for DSH: two agent tools read the live balance and the ledger-observed daily charge, then write Markdown/HTML/JSON statements. | medium | medium | queued | 0/3/7 | 0/0 | 2026-09-28 10:14 |
| @asun-labs/dsh-plugin-token-dashboard DSH plugin for generating a self-contained token usage dashboard | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @fengbinmov/R4-Coder-Provider R4 Coder账户的套餐余额、钱包、并发上限、到期时间、今日消费与最近 7 天用量。 | medium | medium | queued | 0/1/5 | 0/0 | 2026-09-28 10:14 |
| @ming-14/download-by-mirror-skill 让 AI 学会从镜像下载资源 - 覆盖 GitHub NuGet HuggingFace vcpkg Cargo Maven Maven DockerHub apt WinGet pip npm/pnpm | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @hu568/dsh-plugin-cluster-preset DSH「集群模式」agent preset：主控智能体自主编排 5 个具名专家子智能体，附「智能体寿命论」阶段提示器 | medium | medium | queued | 0/3/13 | 0/0 | 2026-09-28 12:14 |
| @gosomea/dsh-opencode-go OpenCode Go and Zen live model discovery, pricing and session routing for DSH | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-09-28 12:14 |
| @miqian-nomad/dsh-new-workdir 一键领一个独立工作目录并开干净会话：目录即沙盒边界，产物不再互相污染。One click: a fresh timestamped workdir as a DSH workspace with a clean session. 零官方文件改动。 | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-09-28 12:14 |
| @ZnonEn/dsh-mcp-manager DSH 插件：在桌面端设置页里管理 MCP 服务器 —— 新增/编辑/删除/启停 + 运行状态，直接读写 profile 的 cordis.patch.yml，零依赖。 | medium | medium | queued | 0/2/2 | 0/0 | 2026-09-28 12:14 |
| @Movingelated/dsh-local-ollama-models DSH plugin: delegate read-only collection tasks to a local Ollama model — zero cloud token cost, zero API key. 把只读采集任务交给本机 Ollama 模型：含设置面板 + 选型尺 + AI 可读说明书。 | medium | medium | queued | 0/2/11 | 0/0 | 2026-09-28 12:14 |
| @Soulize/dsh-continue-on-limit-host Auto-continue for DSH: when a local model hits its output-token cap, automatically send "continue" so the reply keeps flowing | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-09-28 12:14 |
Dynamic audit results · new today (5 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
Host balance route is authenticated and mostly defensive; the one real risk is provider-config expressions executed via new Function, giving host-process code execution to whoever can write the local provider JSON.
- mediumProvider config `response.*.expr` is executed with new Function (host-process code execution) · lib/parsers.js:65
- lowCredential reference and target URL both come from provider config, so any resolvable secret can be sent to an arbitrary host · lib/index.js:688
No backdoor or exfiltration found; two concrete gaps: the agent can self-enable IDA 'unsafe' tools, and SPSS is launched via a shell command string.
- mediumAgent can self-enable IDA 'unsafe' (DANGEROUS) tools by calling re_open with unsafe:true · packages/dsh-re-workbench/lib/index.js:206
- lowSPSS batch runner uses shell:true with a concatenated command string · packages/dsh-thesis-workbench/lib/spss-core.js:62
- lowUnescaped apostrophes in model-supplied paths are interpolated into SPSS GET FILE syntax · packages/dsh-thesis-workbench/lib/spss-core.js:153
Mostly inert plugin (ships enabled:false); real risks are config-driven process spawning with full env inheritance and API-key use against a configurable base URL.
- mediumLauncher spawns a configured executable and leaks the whole parent environment (incl. API keys) to it · packages/laya-runtime/src/node-deps.ts:51
- lowProvider API keys are resolved from env and sent to a configurable baseUrl, over plain HTTP for local providers · packages/s1-client/src/providers.ts:22
Well-hardened page-capture plugin: SSRF guards, pinned DNS, staged/symlink-checked output, redacted URLs; only low-severity stealth-browsing and preview-opening observations found. Half the code was not harvested, so res…
- lowHeadless capture deliberately hides automation (AutomationControlled disabled, HeadlessChrome stripped from UA) · lib/capture.js:645
- lowSaved page opened with the OS default handler; script-free guarantee comes from unharvested archive.js, not the verifier · lib/index.js:152
team-craft's runtime code is a loopback-only client UI plus config; the risky constructs sit in dev-only validation scripts and are not reachable at runtime.
- lowDev-only validation probes execute file contents via new Function (not reachable in the shipped plugin) · validation/_probe-workflows-tab.mjs:6
- lowDev probe creates and deletes real Agent records in the live ~/.dsh storages · validation/ui-form-payload-check.mjs:11
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 29,369 in-scope entries (29,024 scanned + 345 pending).
Static scan for reference: low 28,826 · medium 0 · high 196 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
89 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-28. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2925 dynamic audit records, 2341 with a model conclusion, 321 stricter than the static verdict, 794 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published