Daily security scan
Date · 2026-09-29 (UTC — plugins first indexed that day)
69
added
0
critical
22
medium
47
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @williamzhangww/dsh-priceflow Official DeepSeek peak/off-peak pricing, countdown and off-peak message scheduling for DSH. | low | pass | 0/0/0 | 0/0 | 2026-09-29 00:13 |
| @yusufameri/dsh-t3-session-ui T3 Code's session-context UX for DSH: a session-row context block, provider chip, status pill, header context strip, and a context-window meter with compaction. | medium | warn | 0/1/2 | 0/0 | 2026-09-29 00:13 |
| @AFunDog/dsh-sidebar-git-graph DSH right-sidebar page: a read-only Git commit graph (VS Code style branch/merge lanes). Works with or without dsh-better-sidebar. | medium | warn | 0/1/9 | 0/0 | 2026-09-29 00:13 |
| @W-SING-HUNG/dsh-resume 求职简历工坊：粘贴 JD，AI 按岗位重写简历，只基于真实内容，不编造 — DSH 插件 | low | pass | 0/0/0 | 0/0 | 2026-09-29 00:13 |
| @Ln1m/dsh-pane-viewer DSH right column suite: document viewer and embedded browser · DSH 右栏家族：文档查看器与内嵌浏览器 | low | pass | 0/0/11 | 0/0 | 2026-09-29 02:13 |
| @Ln1m/dsh-pane-browser DSH 右栏内嵌浏览器：面板自绘工具条，画面是桌面外壳里的 WebView2 原生子控件 · Embedded browser in the DSH right column; the panel draws the toolbar while the picture is a WebView2 child control of the desktop shell | low | pass | 0/0/5 | 0/0 | 2026-09-29 02:13 |
| @yuluo554/dsh-pipeline Multi-node agent pipeline orchestration plugin for DSH — JSON-defined workflows, per-node model/skills routing, web editor, live run cards. Responds to dsh#7704. | low | pass | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @Ln1m/dsh-host-splash WebView2 启动片头层：铺满播放动画盖住页面未渲染时的空白，毛玻璃跳过气泡，片库与停顿可配 | low | pending | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @wangbodbs/dsh-plugins DSH plugins: a Feishu (Lark) chat channel and two MCP server bundles (DaVinci Resolve, FilmLight FLAPI). | low | pending | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @Ln1m/dsh-side-tools 工具栏：左栏「工具」Tab 面板 + 局域网服务（加卡范式）+ 两种「移动端访问」（自研局域网 / 第三方公网，只装一个） | low | pending | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @wanetcn/dsh-advancesearch DSH 高级搜索插件:按关键字搜索所有会话 + Claude Code / Codex / ZCode 等 agent 历史记录,工作区搜索按钮、会话跳转,内置 MCP 让 agent 自己检索历史 | medium | warn | 0/5/4 | 0/0 | 2026-09-29 02:13 |
| @Ln1m/dsh-side-files DSH Web 左栏文件家族：dsh-files-tree（文件 Tab + 输入区 @）+ dsh-files-open（右栏打开本机文件），需先装 dsh-vk-suite 骨架 | low | pending | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @MMiao79/dsh-pilot-releases DSH 领航官 · DSH-Pilot —— DSH Windows x64 管理与运维面板（成品发布仓，只发布成品） | low | pass | 0/0/0 | 0/0 | 2026-09-29 02:13 |
| @huimingli666/dsh-workspace-auto-sort | low | pass | 0/0/0 | 0/0 | 2026-09-29 04:11 |
| @huimingli666/dsh-session-delete | low | pass | 0/0/3 | 0/0 | 2026-09-29 04:11 |
| @yorelog/dsh-omarchy-agent DSH on Omarchy as Agent | low | pass | 0/0/0 | 0/0 | 2026-09-29 04:11 |
| @SkylerFee/dsh-llm-opencode-go-live DSH 的 OpenCode Go 动态模型目录插件。它从 Models.dev 更新 `opencode-go` 模型列表，注册独立的 `opencode-go-live` 路由。An OpenCode Go live model catalog plugin for DSH. It reads the `opencode-go` catalog from Models.dev, registers the separate `opencode-go-live` route. | low | pass | 0/0/1 | 0/0 | 2026-09-29 04:11 |
| @smellgamed3/dsh-plugin-list-sync Sync DSH plugin lists across clients via any S3-compatible endpoint (AWS S3 / MinIO / RustFS / R2 / OSS) | low | pass | 0/0/12 | 0/0 | 2026-09-29 04:11 |
| @Ln1m/dsh-pane-suite DSH right column suite: document viewer and embedded browser · DSH 右栏家族：文档查看器与内嵌浏览器 | low | pass | 0/0/11 | 0/0 | 2026-09-29 04:11 |
| @weibaohui/dsh-kite dsh 插件 · 放风筝:agent 编程时屏幕上放一只动画风筝,token 越多飞得越高;潍坊谱系框架卡组,支持自定义贴图 | low | pass | 0/0/6 | 0/0 | 2026-09-29 04:11 |
| @hongweifei/dsh-memory | low | pass | 0/0/0 | 0/0 | 2026-09-29 04:11 |
| @Asheblog/dsh-ollama-cloud Ollama Cloud provider for DSH: one-click setup with per-model reasoning-effort control. 一键配置 Ollama Cloud 供应商，并可调整思维链强度。 | low | pass | 0/0/5 | 0/0 | 2026-09-29 06:11 |
| @tangzijie716/dsh-wechat-push 向微信公众号推送草稿 | low | pass | 0/0/0 | 0/0 | 2026-09-29 06:11 |
| @wenhongquan/dsh-open-file-viewer Open File Viewer preview for DSH — PDF, Office, images, archives, CAD/3D/GIS preview inside the sidebar | low | pass | 0/0/0 | 0/0 | 2026-09-29 06:11 |
| @Utmotc/dsh-balance-card 在DSH左侧启用一个余额监测卡片 | medium | warn | 1/1/13 | 0/0 | 2026-09-29 06:11 |
| @6mt/dsh-plugin-loopback-trust Restore Host-persisted settings in dsh web behind a reverse proxy — marks the page connection as host-owning so Settings/Models pages load on non-loopback hostnames (dsh 0.1.7). | low | pass | 0/0/0 | 0/0 | 2026-09-29 06:11 |
| @jafewff/dsh-vdesktop Run GUI apps on an invisible Win32 virtual desktop: an LLM agent drives them via vdesk_* tools, while you watch and take over with real mouse clicks from the DSH web GUI panel. | medium | warn | 0/1/2 | 0/0 | 2026-09-29 06:11 |
| @zxmqq1234/dsh-auto-retry DSH自动重试插件：报错自动重试、中断自动继续、挂起自动唤醒、 每一步右上角弹窗告诉你，不用再手动发"继续"，数据看板还原每一次重试的真相。与 dsh系统重试互补而非替代——在内置重试耗尽或不覆盖的错误码上追加保障。 | low | pass | 0/0/4 | 0/0 | 2026-09-29 06:11 |
| @4869acdsh-a11y/dsh-deepseek-web DSH 侧边栏插件：原生菜单项在独立窗口打开 chat.deepseek.com，登录态持久化，支持 DSH 与网页端双向划词互传 | low | pending | 0/0/0 | 0/0 | 2026-09-29 06:11 |
| @sredevopsorg/dsh-plugins Our DSH custom plugins, skills and tools | low | pass | 0/0/4 | 0/0 | 2026-09-29 06:11 |
| @9527ccccccc/dsh-xiangqi 中国象棋：棋规引擎 + DSH 插件（右栏棋盘 + 会话可直接调用的工具） | low | pass | 0/0/4 | 0/0 | 2026-09-29 08:14 |
| @Ezisup/dsh-stop-kills-jobs 在点击DSH停止时, 不只是停止会话输出而包含了停止后台终端运行 | low | pass | 0/0/3 | 0/0 | 2026-09-29 08:14 |
| @asun-labs/dsh-plugin-agent-deck DSH plugin for interactive agent-switch terminals with tab and grid layouts. | medium | warn | 0/2/5 | 0/0 | 2026-09-29 08:14 |
| @YunpengDon/dsh-knowledge-tree 一个「把散落知识捋成自己的教程」的个人知识管理系统。在与AI的对话中收集零散知识（树叶），AI 自动归类到知识树，长期积累最终形成个人独有的知识体系。 | low | pass | 0/0/0 | 0/0 | 2026-09-29 08:14 |
| @jaychang1989/dsh-webchat Opens the official chat.deepseek.com web app inside DSH: one sidebar entry renders the real page in the center column through the desktop shell's native browser guest, and keeps you signed in across restarts. No chat UI, no agent tools, no runtime dependencies. | medium | warn | 0/2/9 | 0/0 | 2026-09-29 08:14 |
| @xmwengxing/dsh-client-ui-sidebar-perfmon Real-time host performance monitoring for the DSH right Sidebar: CPU / memory / swap gauges plus a sortable process table. · DSH 右侧栏实时性能监控 | medium | warn | 0/1/3 | 0/0 | 2026-09-29 08:14 |
| @52baihehhh-ai/dsh-splash-screen DSH开屏动画插件：可跳过的全屏启动动画，纯插件实现、可在插件库开关。A skippable full-screen splash animation plugin for DSH. | medium | warn | 1/0/3 | 0/0 | 2026-09-29 08:14 |
| @shinelon/dsh-workspace-group-plugin Custom workspace groups for the DSH sidebar: group directories, drag to regroup/reorder, inline search and sessions, one-click official-view fallback. | low | pass | 0/0/8 | 0/0 | 2026-09-29 08:14 |
| @HarryKong824/fde-copilot 给 AI 助手装上工程护栏的 DSH 插件套件 —— AI 改业务规则、推进阶段时没通过校验就动不了，所有动作记在一本改不掉的哈希链账上。零运行时依赖，41 套离线回归。 | low | pending | 0/0/0 | 0/0 | 2026-09-29 08:14 |
| @xinshang777/dsh-per-turn-isolation DSH 插件：让每轮对话互相独立——每轮只把「本轮输入 + 长期设定」交给模型，历史自动折叠，显著降低上下文占用与费用；界面历史仍完整可回看。 | medium | warn | 0/2/3 | 0/0 | 2026-09-29 08:14 |
| @4869acdsh-a11y/dsh-DeepSeek-chat DSH 插件：在左侧边栏加原生菜单项打开 chat.deepseek.com（独立窗口 + 登录态持久化），并支持 DSH 与网页端双向划词互传（基于 CDP）。 | medium | warn | 0/7/15 | 0/0 | 2026-09-29 08:14 |
| @sandyyst/dsh-plugin-mermaid-gb-svg DSH 插件：Mermaid 流程图 → GB/T 1526-1989（ISO 5807）国标流程图 SVG，符号合规、正交走线、超 A4/A3 自动分页 | low | pass | 0/0/0 | 0/0 | 2026-09-29 08:14 |
| @SpookyWaste/dsh-plan-compact-execute 为 DSH Web 客户端的 plan 模式审批卡片增加第三个选项「压缩后执行」：先把计划提交之前的上下文压缩成一条摘要检查点，再批准计划，模型带着逐字保留的计划开始执行。 | low | pass | 0/0/1 | 0/0 | 2026-09-29 08:14 |
| @Du010902/dsh-knowledgenet-plugin | low | pass | 0/0/0 | 0/0 | 2026-09-29 08:14 |
| @namehousiqi/dsh-ssh-manager 适配DSH 官方桌面端 - SSH管理插件 | medium | warn | 0/1/7 | 0/0 | 2026-09-29 08:14 |
| @GMH13552/dsh-mc-art DSH 面板插件 + 做模组的 skill：从描述到可验证的 Minecraft mod，由游戏自己的 GameTestServer 判定 | medium | warn | 0/1/3 | 0/0 | 2026-09-29 08:14 |
| @BuvkB/dsh-vaultwarden Vaultwarden/Bitwarden real-time sync for DSH: WebSocket push, incremental sync, read/write tools and an entry browser panel. | medium | warn | 0/2/6 | 0/0 | 2026-09-29 10:12 |
| @Canary-Builds/dsh-web-search-zai Z.AI (GLM) web search provider for DSH — native web_search via the Anthropic-compatible Messages API. Dependency-free DSH Profile Bundle. | low | pass | 0/0/1 | 0/0 | 2026-09-29 10:12 |
| @Fwkkk666/dsh-time-stop-theme JoJo-inspired time-stop transition for the DSH light/dark appearance switch | low | pass | 0/0/1 | 0/0 | 2026-09-29 10:12 |
| @haotian-lu-prog/dsh-notifications macOS menu bar activity indicator for DSH (community fork of dsh-notify; supports DSH 0.1.7-rc.2 and 0.2.0-rc.1) | medium | warn | 0/2/2 | 0/0 | 2026-09-29 10:12 |
| @mydsp/dsh-branchman Tree-branching engineering directions for DSH: one action = a git worktree + a child session that inherits the conversation + an edge in a tree you can see. | medium | warn | 0/1/5 | 0/0 | 2026-09-29 10:12 |
| @Shiyuedong-Jade/DM-inspect 达梦 DM8 数据库巡检插件：85 项只读巡检，生成 HTML 报告。支持单实例与共享存储集群（DMDSC）。 | low | pass | 0/0/13 | 0/0 | 2026-09-29 10:12 |
| @acdsh4869/dsh-DeepSeek-chat DSH 插件：在左侧边栏加原生菜单项打开 chat.deepseek.com（独立窗口 + 登录态持久化），并支持 DSH 与网页端双向划词互传（基于 CDP）。 | medium | warn | 0/7/15 | 0/0 | 2026-09-29 10:12 |
| @SiriusWJ/dsh-kimi-code-oauth DSH plugin for Kimi Code subscription OAuth | low | pass | 0/0/0 | 0/0 | 2026-09-29 10:12 |
| @railgun52/dsh-mcp-servers MCP servers settings page for the dsh web GUI: a JSON editor over a profile-config namespace that mounts live mcp-client instances from the saved servers | low | pass | 0/0/0 | 0/0 | 2026-09-29 10:12 |
| @railgun52/dsh-user-rules User rules settings page for the dsh web GUI: a list editor over a profile-config namespace whose rules are injected as a systemPrompt section | low | pass | 0/0/0 | 0/0 | 2026-09-29 10:12 |
| @PhysicalAI-0/dsh-paperforge PaperForge — forge your understanding of papers inside DSH: selection-to-highlight, selection-to-ask (one dedicated session per paper), marquee-to-note screenshots with backlinks. | medium | warn | 1/7/11 | 0/0 | 2026-09-29 10:12 |
| @hoyyang/dsh-smart-compact Codex-style context window auto-management for DSH — lossless zero-model context rollover | low | pass | 0/0/4 | 0/0 | 2026-09-29 10:12 |
| @Movingelated/DSH-LocalModels-TokenSavior DSH plugin: delegate read-only collection tasks to a local Ollama model — zero cloud token cost, zero API key. 把只读采集任务交给本机 Ollama 模型：含设置面板 + 选型尺 + AI 可读说明书。 | medium | warn | 0/2/12 | 0/0 | 2026-09-29 10:12 |
| @fuyu2022/dsh-session-dir 简单的工作区会话分组插件 | low | pass | 0/0/3 | 0/0 | 2026-09-29 12:12 |
| @XDTrees/dsh-opencode-xdbridge 把 OpenCode 的免费模型（big-pickle、LongCat、MiMo、Nemotron、Space Bunny 等）接进 DSH 的模型选择器，作为 opencode-xdbridge 分组使用，并在设置 → OpenCode-XD 里提供一个可视化的交互入口。 | medium | warn | 1/7/13 | 0/0 | 2026-09-29 12:12 |
| @wedfrgt/dsh-workspace-sync | medium | warn | 0/1/6 | 0/0 | 2026-09-29 12:12 |
| @rezon-aki/dsh-compaction-effort-inherit 上下文压缩沿用会话思考档位：DeepSeek 前缀缓存按档位分桶，不修就会在每次压缩时把整个上下文按未缓存价重算一遍。零依赖、不碰官方插件。 | low | pass | 0/0/0 | 0/0 | 2026-09-29 12:12 |
| @DSH-dsh/agent-mode-change Agent-mode floating window for DSH: a draggable Web-UI panel that switches a session's system prompt between the harness's own prompt and 13 archived coding-agent CLI prompts (Claude Code, Codex, Antigravity, Grok, Kimi, MiniMax, opencode…). dsh plugin / Cordis bundle, log-safe via /agent. | low | pass | 0/0/3 | 0/0 | 2026-09-29 12:12 |
| @shay-Ckm/dsh-skill-softcopyright DSH plugin: software-copyright delivery pipeline - 4 skills + 8 tools + 10-phase gated workflow + four-way consistency audit | low | pass | 0/0/0 | 0/0 | 2026-09-29 12:12 |
| @yh4922/dsh-workspace A remote workspace plugin for DSH. It manages SSH hosts inside DSH, opens remote terminals, lets you browse and edit remote files and inspect remote Git, and adds remote directories as workspaces, so the Agent's file operations and commands run on the remote machine. | low | pass | 0/0/0 | 0/0 | 2026-09-29 12:12 |
| @WTStarMark/dsh-myskin DSH 皮肤插件：可视化自定义 + 实时预览 + 「皮肤管理」设置页。 非侵入式：不改 DSH 源码 / 配置、不改 DSH 进程；皮肤是完全可逆的覆盖层。 适配：DSH 0.1.7-rc.2 与 0.2.0-rc.1 | medium | warn | 1/0/0 | 0/0 | 2026-09-29 12:12 |
| @shell-error/deepseek-harness-remote-access 面向 DSH 的 Codex Skill：提供局域网访问授权与 SSH 远程工作区能力。 | low | pass | 0/0/0 | 0/0 | 2026-09-29 12:12 |
| @gqallen931/paper-gogo-plugin DSH plugin for the Paper-gogo evidence-first paper workflow: 18 Phases, G0-G6 gates and four-state evidence audit as native tools, with the workflow and 57 skills bundled in. | low | pass | 0/0/0 | 0/0 | 2026-09-29 12:12 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
44 reports2026-09-29current69 added0 crit22 medium2026-09-2864 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-09-29. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published