Daily security scan
Date · 2026-10-04 (UTC — plugins first indexed that day)
72
added
0
critical
30
medium
42
low
| Plugin | Risk | Verdict | C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|
| @p455enger/dsh-web-tray Windows tray + desktop shortcut for dsh web in WSL, with switchable auto start/stop and live status (fork of dsh-wsl-tray) | medium | warn | 0/6/9 | 0/0 | 2026-10-04 00:13 |
| @chunsi-w/dsh-ctxopt-compaction DSH 的上下文压缩插件 | low | pass | 0/0/0 | 0/0 | 2026-10-04 00:13 |
| @JWE24-code/dsh-pii-anonymizer Deterministic, one-way PII anonymizer at the start of the DSH agent loop | low | pass | 0/0/0 | 0/0 | 2026-10-04 00:13 |
| @liuyu-f/dsh-plugin-session-cascade-delete Permanently delete DSH sessions from the UI (header button + sidebar row menu) or via the session_delete tool: removes the log directory, projection cache and workspace accounting, cascades into the subagent sessions a session owns (your forked branches are never touched), and stops a running agent first. | low | pass | 0/0/3 | 0/0 | 2026-10-04 02:13 |
| @YE-ZINAN/dsh-quiet 让 agent 在你离开时替你盯着，只在真的需要你出手时才叫你。DSH 桌面端插件。 | medium | warn | 0/3/2 | 0/0 | 2026-10-04 02:13 |
| @atlas5301/dsh-remote-sessions DSH plugin: run remote DSH agent sessions through the unchanged native UI — strict-SSH resident lifecycle, session/file-tree/terminal forwarding, durable bindings | medium | warn | 3/2/3 | 0/0 | 2026-10-04 02:13 |
| @Stmol/dsh-prompt-lib DSH plugin: keep your own prompts in Settings and switch them on per chat | low | pass | 0/0/0 | 0/0 | 2026-10-04 04:13 |
| @gaoyian7251/dsh-window-state 在 DSH 桌面客户端「设置 → 通用设置」中选择启动窗口状态（默认 / 最大化 / 全屏）。Windows. | medium | warn | 0/1/6 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-pomodoro-dock DSH 右侧栏番茄闹钟：专注/休息循环，计时只存 endsAt、切 tab 不中断（pomodoro_panel）。 | low | pass | 0/0/3 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-media-dock DSH 右侧栏媒体台：抖音/YouTube 链接进来，本机 yt-dlp 下载 + ffmpeg 转码 + 官方 speechToText（SenseVoice）本地转写，字幕进面板，一键让 Agent 总结。 | medium | warn | 0/3/10 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-calendar-dock DSH 右侧栏通用日历：月视图 + 当天事件 + 接下来；本地存储，Agent 也能加删勾（calendar_panel）。 | low | pass | 0/0/4 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-todo-dock DSH 右侧栏轻量待办：一行一件、回车就加、勾掉即完成（todo_panel）。 | low | pass | 0/0/4 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-irc-dock DSH 右侧栏 IRC 客户端：node tls 直连或走 HTTP CONNECT 隧道，SASL、自签证书、限次重连（irc_panel）。 | medium | warn | 0/2/5 | 0/0 | 2026-10-04 04:13 |
| @yunliya-cuter/dsh-explain-assistant DSH Web GUI 插件：主对话右上角「?」弹出独立浮窗，用白话中文解释主 agent 正在做什么。只读、不打扰主 agent | low | pass | 0/0/0 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-rss-dock DSH 右侧栏 RSS 阅读器：订阅源在配置里，未读/收藏双向状态，Agent 也能读（rss_panel 工具）。 | medium | warn | 0/3/7 | 0/0 | 2026-10-04 04:13 |
| @tcgbp/dsh-flash-net-mon Network monitor, outbound audit and network-alert provider for dock-flash — a GitHub mirror of the authoritative Gitee repository. | low | pass | 0/0/7 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-ledger-dock DSH 右侧栏记账本：记一笔、本月结余、分类统计；金额按分存整数（ledger_panel）。 | low | pass | 0/0/4 | 0/0 | 2026-10-04 04:13 |
| @p56568833/dsh-plugin-groups Category tabs for the DSH Plugins page's Installed list, with patch plugins nested under their parent. | medium | warn | 1/0/6 | 0/0 | 2026-10-04 04:13 |
| @yijiezhong/dsh-output-setting DSH output settings plugin: auto-expand reasoning/tool nodes, code block font size & line height, model output language (auto/Chinese/English) | low | pass | 0/0/0 | 0/0 | 2026-10-04 04:13 |
| @49zr664rb8-hue/dsh-codex-effort 把 DSH 输入框的「模型·推理等级」菜单换成 Codex 那样的横向滑动滑条 | medium | warn | 0/2/3 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-calorie-dock DSH 右侧栏卡路里日记：内置食物热量表，选食物+克数自动算 kcal（calorie_panel）。 | medium | warn | 0/1/5 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/dsh-qqmail-dock DSH 右侧栏 QQ 邮箱：读最近邮件、看正文、发纯文本；凭据只读私有文件，发送要 confirm（qqmail_panel）。 | low | pass | 0/0/4 | 0/0 | 2026-10-04 04:13 |
| @lemonhall/birefnet-cutout-skill 抠人物的方法与实测边界：模型代际、rembg 的 1024 陷阱、官方 2048 HR-matting 的软 alpha、8GB 显卡跑不了 2048 的原因，以及用「半透明像素占比」客观量发丝。附两个通用脚本（GPU 快路线 / 官方高清路线）。DSH 与 Codex 都能用。 | low | pending | 0/0/0 | 0/0 | 2026-10-04 04:13 |
| @YOU-SHOULD-KNOW-ME/dsh-rail-music DSH Web 插件：轮次导航轨道随本机正在播放的声音律动。彩虹频谱、悬停还原、不占用端口。Windows WASAPI / Linux PulseAudio / macOS CoreAudio。 | medium | warn | 0/2/8 | 0/0 | 2026-10-04 06:13 |
| @bauerelizabeth07139/dsh-plugin-dxpdf DSH plugin: convert Word .docx to PDF with the dxpdf Rust/Skia engine — no Microsoft Office, no LibreOffice, no network. It repairs the schema-invalid constructs WPS Office writes and restores Word's odd/even page parity. | medium | warn | 0/1/3 | 0/0 | 2026-10-04 06:13 |
| @mikazuhe13-ui/dsh-hook DSH lifecycle hooks settings panel plugin — 7-event coverage, guard rules with live toggles, run status. dsh-plugin | low | pass | 0/0/10 | 0/0 | 2026-10-04 06:13 |
| @Joker-Principal/dsh-proxy-control 在运行中控制 DSH 的出站代理 | medium | warn | 0/7/11 | 0/0 | 2026-10-04 06:13 |
| @xiaocxiaohai666/dsh-plugin-selfcheck Terminal-first self-check for a DSH install. At boot it prints every plugin row in the loader tree — mounted, disabled, or failed with the exception text — then reports dependency version drift, profile config validity, web port reachability, and the registered tool inventory. Reads whatever plugins you actually have. | low | pass | 0/0/4 | 0/0 | 2026-10-04 06:13 |
| @YunpengDon/dsh-hitl Human-in-the-loop gate for DSH tool calls: mount any tool behind an approve / modify / reject decision card in the DSH Web UI. | low | pass | 0/0/2 | 0/0 | 2026-10-04 06:13 |
| @Madao1210/dsh-deep-reading DSH 的深度阅读插件——逐章理解书籍，不是摘要，不是搬运目录，而是真正理解并解释。有AI自己的观点，让用户真正读懂一本书DSH's deep reading plugin—understand books chapter by chapter, retain traceable reading memories, enabling users to truly comprehend a book | low | pass | 0/0/3 | 0/0 | 2026-10-04 06:13 |
| @Xeraph627/local-lite 为短上下文窗口的对话提供更轻量的 Agent 预设，能降低78%的固定开销。由 Deepseek 制作 | low | pass | 0/0/0 | 0/0 | 2026-10-04 06:13 |
| @syc67169-source/dsh-team-employees 把 DSH 变成多员工协同团队：员工花名册、内容流水线、一道人工闸门，外加一个会动的办公室界面 | medium | warn | 0/3/14 | 0/0 | 2026-10-04 06:13 |
| @SherinG-official/dsh-siyuan-api DSH plugin for SiYuan (思源笔记): search notes, create documents, read/append blocks, and run read-only SQL over the local kernel HTTP API. | medium | warn | 0/5/11 | 0/0 | 2026-10-04 06:13 |
| @ALIve114514awa/dsh-prompt-optimizer Guided prompt optimization for DSH: Harness AI and Codex, editable previews, and explicit draft insertion across desktop, Web and TUI. | low | pass | 0/0/4 | 0/0 | 2026-10-04 06:13 |
| @yuanstarstar/dsh-maid DSH 女仆模式插件 | low | pass | 0/0/0 | 0/0 | 2026-10-04 06:13 |
| @thezavtrak-a11y/dsh-image-annotate Draw on a pasted screenshot in the DSH web GUI: pen, arrow, rectangle, ellipse and text stamps, flattened into a PNG attachment at the image native resolution. | medium | warn | 0/2/21 | 0/0 | 2026-10-04 08:13 |
| @liyuqian/dsh-flutter-sandbox dsh plugin: let Flutter and Dart run inside DSH's workspace-write sandbox | medium | warn | 0/1/2 | 0/0 | 2026-10-04 08:13 |
| @vi0let-dev/dsh-session-trash 给 DSH 补上会话删除：删除先进回收站可还原，彻底删除会清干净日志、工作区记账、归档标记与宿主会话表。 | medium | warn | 0/1/7 | 0/0 | 2026-10-04 08:13 |
| @thezavtrak-a11y/dsh-session-tabs DSH Web UI plugin: browser-style tabs for open Sessions - switch, close, reorder by drag, and tear a tab off into a separate window. | medium | warn | 0/4/16 | 0/0 | 2026-10-04 08:13 |
| @xfpuls/dsh-usage-suite DSH 用量与费用统计 + 提问置顶：本轮花费、今日 token 与消费、空闲/高峰时段，并钉住最新提问 | medium | warn | 0/1/7 | 0/0 | 2026-10-04 08:13 |
| @overact/dsh-statusline-plus Statusline for DSH Web: quotas, Git, context, API reference costs, Subagents and streaming speed | low | pass | 0/0/17 | 0/0 | 2026-10-04 08:13 |
| @shuqingyang666/dsh-github-adapted Adapted build of @perrylink/dsh-github 0.7.15 for DSH 0.2.0-rc.2 — classic-script client registration (upstream #12/#13, fix PR #14) | medium | warn | 0/1/1 | 0/0 | 2026-10-04 08:13 |
| @ventisyn/dsh-agent-control DSH plugin: delete a session or a single turn through one confirmation flow and one set of failure codes | low | pass | 0/0/3 | 0/0 | 2026-10-04 08:13 |
| @ZHOU-ZHIZHEN/dsh-terminal-context Turns a selection in DSH's built-in sidebar terminal into an @file reference in the composer, through a button above the composer and a keyboard shortcut. | medium | warn | 0/2/7 | 0/0 | 2026-10-04 08:13 |
| @lvzhiyuan0308/dsh_session_delete A DSH plugin for deleting a sidebar conversation after confirmation | low | pass | 0/0/2 | 0/0 | 2026-10-04 08:13 |
| @playinginzzz/Fairy-DSH-compat DSH Desktop 跨内核兼容版 Fairy 插件套件（视觉 / HDD 主题 / 朗读 / 余额）。基于孤舟版 v0.3.8（原作者 橙汁本色，上游 Guzhou2002）追加 18 个内核兼容提交，适配 dsh 0.1.5-rc.1 → 0.2.0-rc.2（DSH Desktop 2.0.9 / 2.0.17 实测），feature-detection 双内核兼容。一键安装见 Releases。 | low | pass | 0/0/0 | 0/0 | 2026-10-04 08:13 |
| @datit309/dsh-telegram-bridge Full 2-way Telegram Remote Control, Vision, Voice, Shell, Diff & Sound Notifications for DSH | medium | warn | 0/3/9 | 0/0 | 2026-10-04 08:13 |
| @AKHYui/DSH-Remote-plugin DSH desktop plugin that exposes a local harness to your own relay over a single outbound WebSocket - no inbound ports, works behind NAT. Forwards a fixed op allowlist, session events, prompts and attachments, and relays approvals or questions to the companion mobile app. Node ESM, zero runtime dependencies. | medium | warn | 0/1/3 | 0/0 | 2026-10-04 10:14 |
| @dgmico/dsh-workspace-recency-order DSH 插件：按工作区内最新会话活动时间自动重排左侧工作区顺序（Host 侧，写入官方持久工作区顺序，不覆盖官方 UI） | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @123wansui-989/dsh-flight-compare DSH plugin: registers flight_compare, fetches Travelpayouts fares, groups by flight and date, marks lowest price in Markdown table. | low | pass | 0/0/3 | 0/0 | 2026-10-04 10:14 |
| @AzureSkyHuHu/dsh-chinese-mode-modern Chinese mode for DSH: a composer toggle that opens a panel for reply / reasoning / tool-narration language. | low | pass | 0/0/1 | 0/0 | 2026-10-04 10:14 |
| @doitian/dsh-provider-aliyun Aliyun DashScope (Bailian) model provider preset for DSH: adds an OpenAI-compatible aliyun route with a starter Qwen catalog to the llm-pi-ai adapter. | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @huangxp12/dsh-recent-sessions Recent sessions across every workspace in one panel for DSH - plus deferred notes that come back when you reopen the conversation. | low | pass | 0/0/4 | 0/0 | 2026-10-04 10:14 |
| @HarryHeYu/dsh-sessionflow Cross-agent session continuity for DSH — continue work from Codex, Claude Code, Grok, ZCode and more with sessionFlow. | medium | warn | 0/1/2 | 0/0 | 2026-10-04 10:14 |
| @mubaid/dsh-linkedin-agent Eleven LinkedIn agent skills for DSH (port of Jakeschincariol/linkedin-agent-skill), MIT. | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @AnFRuJ/dsh-lark-plus DSH × 飞书/Lark 双向桥接：私聊/群聊、卡片按钮、审批与提问回传、任务板、goal、定时任务；另含全程本机的语音转写（音频不出本机）与网页端播放条。Feishu/Lark bridge for DSH + fully local voice transcription. | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @windrover/dsh-plugin-update-checker A DSH plugin that adds a Check-updates button to the Plugins settings: scans every installed bundle for published updates and DSH-runtime compatibility, with a per-plugin update action. | medium | warn | 0/2/6 | 0/0 | 2026-10-04 10:14 |
| @ItQianChen/dsh-github-flow 基于 GitHub CLI (gh) 为 DSH 打造的现代化原生工作流集成插件。 深度打通本地 Git 仓库开发与远程 GitHub 协作（PR、Issue、Actions CI 诊断与代码审查），兼备 Agent 模型工具、人类 Slash 指令以及原生 Web UI 双重视图。 | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @Ianzhyh/workbuddy-to-dsh 把本机 WorkBuddy 桌面端已登录的模型原生接进 DSH：本地桥 + 数据控制台 + dsh 原生插件（自带 bridge/控制台，单文件夹即可安装） | medium | warn | 0/4/7 | 0/0 | 2026-10-04 10:14 |
| @jonah791/dsh-goal-ops 目标生命周期扩展（不改 DSH 核心包）：goal_abandon 放弃原语 —— 以 block + blockedReason.code='abandoned' 承载主动放弃，停续跑且原因可辨识 | low | pass | 0/0/0 | 0/0 | 2026-10-04 10:14 |
| @panando/dsh-quote-sidechat DSH plugin: turn any selected reply snippet into an atomic reference chip — delete as one unit, click to jump back to the source, structured serialization on send. | low | pass | 0/0/2 | 0/0 | 2026-10-04 12:14 |
| @smj-1680/dsh-plugin-liquid-glass 适用于 DSH 桌面端的液态玻璃美化插件：输入框、消息气泡、侧栏与顶栏等主要界面元素改为液态玻璃材质，可搭配各类壁纸插件使用（需深色模式）。 | medium | warn | 0/6/12 | 0/0 | 2026-10-04 12:14 |
| @apherchin/dsh-photo2dsh-by-lan 手机拍照经局域网一键进 PC 文件夹，DSH 插件面板可配落地目录 | DSH plugin: one-tap photo transfer from phone to a configurable folder on this PC over the LAN, with a config card on the Plugins page. | medium | warn | 0/1/8 | 0/0 | 2026-10-04 12:14 |
| @copylee711/dsh-office DSH 插件：AI 直接在你打开的 Word / Excel / PowerPoint 里改文档，改动实时可见，可以一起编辑（Windows） | low | pass | 0/0/3 | 0/0 | 2026-10-04 12:14 |
| @GalileoNio/dsh-cost A DSH plugin: per-segment Session cost in the composer statistics strip, priced from the harness model catalog (41 providers, ~1495 models). | low | pass | 0/0/0 | 0/0 | 2026-10-04 12:14 |
| @apherchin/dsh-wonder-tools DSH 工具箱（装配包）：一个插件装好五个功能 —— 删除对话 / 重新生成 / 队友命令 / 跨会话提醒 / 首轮结束自动命名。插件页呈现为 1 张卡 + 5 行组件，每行独立开关。 | low | pass | 0/0/0 | 0/0 | 2026-10-04 12:14 |
| @SMSMy/dsh-arabic Arabic for DSH: bidi-safe RTL rendering for mixed Arabic/English content plus a full Arabic UI language pack (3,228 strings) | low | pass | 0/0/2 | 0/0 | 2026-10-04 12:14 |
| @apherchin/dsh-session-rewind （已合并进 dsh-wonder-tools）重新生成（从这里重来）：把某轮及之后从模型视野作废、原提示词回填输入框，支持分支找回。 | low | pass | 0/0/1 | 0/0 | 2026-10-04 12:14 |
| @cfyofjackie/dsh-selection-quote DSH client plugin: select text in a conversation and attach it to the composer as an atomic quote reference. | low | pass | 0/0/0 | 0/0 | 2026-10-04 12:14 |
| @gnk478/dsh-client-ui-wallpaper 把本地图片/视频（Dynamic Wallpaper.app 素材）用作 DSH 桌面客户端壁纸的客户端插件 · Wallpaper/image background plugin for the DSH desktop client | medium | warn | 0/1/5 | 0/0 | 2026-10-04 12:14 |
| @Depar7ure/dsh-desktop-web-refresh DSH Desktop 插件：标题栏「编辑」右侧新增蓝底白字伪 3D「刷新」按钮；有对话运行时禁用并弹警告，全静默才允许刷新。 | low | pass | 0/0/1 | 0/0 | 2026-10-04 12:14 |
| @Astemiir/dsh-client-locale-ru Russian localization plugin for the DSH web UI - adds the ru language (63 namespaces, 3119 strings) | low | pass | 0/0/0 | 0/0 | 2026-10-04 12:14 |
Static heuristic scan + manifest audit — not a full security audit; no code execution or dependency resolution. Risk tiers match the site model: critical in secrets/exfil/destructive/mining is "critical"; other critical-level findings and warnings are "medium" (needs review).
Daily report archive
49 reports2026-10-04current72 added0 crit30 medium2026-10-0388 added0 crit36 medium2026-10-0299 added1 crit47 medium2026-10-010 added0 crit0 medium2026-09-30182 added3 crit51 medium2026-09-2969 added0 crit22 medium2026-09-2864 added0 crit23 medium2026-09-2763 added0 crit23 medium2026-09-2684 added0 crit29 medium2026-09-2545 added1 crit24 medium2026-09-240 added0 crit0 medium2026-09-2379 added0 crit29 medium2026-09-2259 added1 crit18 medium2026-09-2165 added0 crit23 medium2026-09-20104 added1 crit34 medium2026-09-1981 added0 crit36 medium2026-09-1872 added0 crit14 medium2026-09-1770 added1 crit24 medium2026-09-1567 added2 crit32 medium2026-09-1482 added1 crit30 medium2026-09-1343 added0 crit15 medium2026-09-1284 added0 crit29 medium2026-09-1131 added0 crit12 medium2026-09-1096 added1 crit17 medium2026-09-0948 added0 crit15 medium2026-09-08922 added2 crit301 medium2026-09-0743 added0 crit15 medium2026-09-0614 added0 crit3 medium2026-09-0565 added0 crit20 medium2026-09-044 added0 crit0 medium2026-09-0377 added0 crit30 medium2026-09-0285 added0 crit19 medium2026-09-010 added0 crit0 medium2026-08-300 added0 crit0 medium2026-08-290 added0 crit0 medium2026-08-28444 added1 crit87 medium2026-08-2733 added0 crit15 medium2026-08-26253 added0 crit74 medium2026-08-25336 added1 crit106 medium2026-08-24327 added4 crit79 medium2026-08-23370 added2 crit119 medium2026-08-2212 added0 crit6 medium2026-08-212656 added8 crit509 medium2026-08-20597 added5 crit160 medium2026-08-191301 added12 crit402 medium2026-08-184003 added22 crit1352 medium2026-08-17142 added1 crit49 medium2026-08-16189 added0 crit80 medium2026-08-15348 added5 crit166 medium
What does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-10-04. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
Source: dsh.so security standards · Maintained by dsh.so · Published