Daily security scan

Date · 2026-10-13 (UTC — plugins first indexed that day)

Static scan · new today

rule heuristics · shape only

critical

high

medium

low

Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.

Dynamic audit · subset of new today

model reads source · no execution

critical

high

medium

low

Only entries static-flagged ≥ warn are audited; tier = highest finding. Of 102 new entries, 91 are out of the queue or have no conclusion yet.

Plugin	Static	Dynamic	Findings C/W/I	Manifest	Indexed
@evan7ang/dsh-agent-hints Per-request serving-intent hints for DSH: the X-Agent-Hint HTTP header on an independent chat-completions provider route. Install: dsh plugin add github:evan7ang/dsh-agent-hints	critical	medium	1/1/5	0/0	2026-10-13 02:15
@shZhang1614/dsh-float-lamp Floating task-status lamp for DSH: green running, orange approval, blue question, grey idle — a borderless always-on-top window outside the DSH app.	medium	not audited	0/3/3	0/0	2026-10-13 02:15
@vegerot/deepseek-harness-session-cost-pill 💸 Live session spend in the DSH composer dock — per-request peak/off-peak pricing, zero harness patches.	low	not audited	0/0/0	0/0	2026-10-13 02:15
@lanhui1942/dsh-agent-preset-branch 从任意已完成轮次把会话分支到一个新模式：选一个 Agent 预设，就以该模式新建会话并迁移这段对话。 Branch a session into another Agent preset from any completed turn — the conversation is migrated into a new session composed in the mode you pick.	medium	not audited	0/1/4	0/0	2026-10-13 02:15
@sheilacraig/dsh-rea-mcp	low	not audited	0/0/3	0/0	2026-10-13 02:15
@Imzl-zl/dsh-model-router Transparent cross-provider failover routing for DSH agents.	low	not audited	0/0/0	0/0	2026-10-13 02:15
@zhangcun1995521/deepwork Enterprise ontology and governance layer for DSH	medium	not audited	0/1/4	0/0	2026-10-13 02:15
@journ10/codex-dsh-bridge HTTP MCP bridge for Codex to create and continue visible sessions in DSH Web	medium	not audited	0/3/11	0/0	2026-10-13 04:15
@john-walks-slow/dsh-session-state Visual session state badges for DSH: prefix a session title with customizable emoji badges (wip 🚧 blocked ⏸️ review 👀 done ✅) — configurable default state for new sessions, session_state model tool, /state command, Web settings. dsh-session-state：用会话标题前缀（默认 Emoji，可自定义）标记状态，含新会话默认状态、Agent 工具与 /state 命令。	low	not audited	0/0/1	0/0	2026-10-13 04:15
@sxwer001/dsh-collab-dev DSH native collaboration: main-agent architecture and validated plans, parallel workers, verification and independent review.	low	not audited	0/0/12	0/0	2026-10-13 04:15
@Stephen-pc/publish-size-check 发布尺寸检查：对照目标平台规格，检查图片能不能发、哪一项参数过不了。零依赖、只查几何参数，含 dpi 达标≠可用与多图一致性检查。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@xfgil/dsh-session-clock DSH 会话时钟：按会话授时 + 跨轮/跨会话空闲间隔，作为内置 dsh-time-context 的补充插件。Per-session clock injection for DSH with durable idle-gap tracking. A companion to the built-in dsh-time-context.	low	not audited	0/0/1	0/0	2026-10-13 04:15
@feely0208/dsh-cn-log-retention 日志留存合规：检查日志是否开启、是否记了该记的、是否留够法定 6 个月。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@motionalpha84/dsh-model-check	low	not audited	0/0/2	0/0	2026-10-13 04:15
@feely0208/dsh-key-rotate 密钥轮换：查密钥与证书多久没换、有没有轮换制度、有没有跨环境复用。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-alert-relay 告警外发：检查告警链路有没有告警、发到哪、有没有把敏感信息一起发出去。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-content-trust 外部内容信任边界：查 agent 有没有把网页/文件/邮件里的内容当指令信。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-license-guard 开源许可合规检查：扫描依赖树，找出 GPL/AGPL 传染、许可未知等风险 —— 发布前、开源前、被审计时跑一遍。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@Wang993/DSH_OrganizeFilesInTheSameWorkspace DSH Web 会话整理插件：标签分类 · 归档 / 恢复 · 已归档浏览（DSH session organizer plugin）	medium	not audited	0/1/3	0/0	2026-10-13 04:15
@feely0208/dsh-cn-mlps 等保对照：按 GB/T 22239-2019 找出代码与配置里可静态发现的等保项。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@KZADEA/dsh-her-memory DSH 跨会话长期记忆与动态心情状态插件。纯 Markdown 存储、零依赖、工作区隔离，自带可视化面板与定制人设，让 AI 记得住你、有心情起伏。	medium	not audited	0/4/5	0/0	2026-10-13 04:15
@feely0208/dsh-consent-guard 用户同意与授权确认：默认勾选、捆绑同意、没有撤回入口 —— 个保法有明确要求。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-ai-output-trust AI 输出信任边界：检查代码有没有直接执行 AI 输出（eval/shell/SQL/路径）。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-mcp-audit MCP 服务安全：审计 MCP 配置里的未锁定远端包、明文端点、可执行本地服务。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-least-privilege 最小权限检查：容器 root/privileged、IAM 通配、CORS 全开、令牌申请 admin。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@lengfengng1-ai-architect/dsh-workspace-memories Per-workspace persistent memory plugin for DSH: sidebar panel, automatic system-prompt injection, and an agent tool to save memories	medium	not audited	0/2/1	0/0	2026-10-13 04:15
@feely0208/dsh-ci-guard 扫 GitHub Actions 工作流，找出可被利用的配置 —— 供应链攻击的主要入口	low	not audited	0/0/0	0/0	2026-10-13 04:15
@realguan/dsh-deepseek-chat-embed Embed chat.deepseek.com into DSH desktop clients as a native chat surface — dual-entry design (centred main panel + right-dock tab), multi-desktop GuestAdapter strategy pattern, persistent login session, zero runtime dependencies.	medium	not audited	0/1/8	0/0	2026-10-13 04:15
@feely0208/dsh-data-scan 敏感数据发现：扫出代码/配置里的身份证、银行卡、手机号 —— 带校验位验证，不误报。	low	not audited	0/0/0	0/0	2026-10-13 04:15
@feely0208/dsh-dep-audit 检查依赖树的投毒与风险面：装包即执行的脚本、过宽版本、非 registry 来源	low	not audited	0/0/0	0/0	2026-10-13 04:15
@JsonLing/trae-cn-provider Trae CN as a native DSH LLM provider: browser OAuth login by default, an opt-in local-install credential source, and an OpenAI-compatible surface on the host web server.	medium	medium	0/8/13	0/0	2026-10-13 06:16
@XiaoSHang05/dsh-loop-guard A passive watchdog for DSH: watches a turn's thinking and text streams and cancels it when the model starts repeating itself.	high	low	2/3/9	0/0	2026-10-13 06:16
@LinHyu-2006/dsh-balance-hud Balance and per-session spend HUD for DSH, with budget alerts, peak-hour warnings and opt-in official price sync.	medium	not audited	0/3/20	0/0	2026-10-13 06:16
@polan-prologue/dsh-web-search-plus DSH 联网搜索的提供方优先级：Tavily 与 DeepSeek 原生搜索自由排序、失败自动回退，Tavily 侧多密钥轮换分摊每日额度	low	not audited	0/0/0	0/0	2026-10-13 06:16
@runcat-tommy/dsh-skill-mini-manager	low	not audited	0/0/2	0/0	2026-10-13 06:16
@runcat-tommy/dsh-mcp-mini-manager Minimal MCP manager for DSH Web: one Settings page at the same sidebar level as Plugins that lists every MCP server this DSH actually loads, with each server's summary and live state, and takes any of them out of rotation. / MCP 极简管理：与「插件」同级的一页设置，列出当前 DSH 装载的全部 MCP 及其简介与状态，并可逐个停用（写入可恢复的停用补丁）。	low	not audited	0/0/3	0/0	2026-10-13 06:16
@wjh-ux/dsh-wechat-media Personal WeChat for DSH: QR pairing, one DSH conversation per contact or group, two-way text/image/video/document/archive transfer	medium	medium	0/5/10	0/0	2026-10-13 06:16
@polan-prologue/dsh-experience-plus DSH 综合体验插件：会话菜单 4 组重排 + 8 项会话管理、批量管理、桌面「重启」入口、插件升级卡片（版本检查 / 项目地址 / Star）	low	not audited	0/0/0	0/0	2026-10-13 06:16
@ruaibeite/dsh-auto-observe Records the edit target's current version as an observation when the agent never used the read tool (bash inspection does not count), so the fs observation policy stops rejecting edits with FS_NOT_OBSERVED.	low	not audited	0/0/0	0/0	2026-10-13 06:16
@sevenhsu7/dsh-codex-like-markdown Codex-like Markdown editing for the DSH right Sidebar: a rendered document you edit in place, including table cells.	low	not audited	0/0/0	0/0	2026-10-13 06:16
@YangtzeCoder/dsh-plugin-ignore	low	not audited	0/0/0	0/0	2026-10-13 06:16
@belowthetree/dsh-openjev-browser Native DSH (cordis) plugin port of the openjev-browser MCP stdio tool: model-driven browser control with a tiny context footprint. A local OpenJev decision model reads the page and returns only the one element that matters, so the agent never ingests the DOM.	medium	medium	0/5/16	0/0	2026-10-13 06:16
@Xxsttb/dsh-model-endpoint DSH plugin: exposes the model you selected in chat (or in Settings) through a standalone OpenAI-compatible HTTP API, reachable over LAN, public network or NAT port forwarding. Streaming, bearer auth, CORS and a dedicated settings page. AI-generated.	medium	not audited	0/1/9	0/0	2026-10-13 06:16
@Sakayorilove/dsh-laurel Laurel 套件：给 DSH 的「功能管理」面板 + 四个可单独开关的插件（通知 / Claude 主题 / 记忆与上下文 / 可视化规划）	low	not audited	0/0/0	0/0	2026-10-13 06:16
@xiake-1/dsh-skill-toggles DSH plugin: enable/disable skills by group (skill toggles manager)	low	not audited	0/0/8	0/0	2026-10-13 06:16
@ven314/dsh-conflict-doctor DSH plugin conflict governance: diagnose silent plugin conflicts in DSH and get the exact patch that fixes each one. DSH 插件冲突诊断与修复建议。	low	not audited	0/0/3	0/0	2026-10-13 06:16
@polan-prologue/dsh-reasoning-plus DSH 推理等级补齐：为 API 地址非官方的自定义提供方实测出与官方同形的推理等级，每一档都在上游真实生效	low	not audited	0/0/0	0/0	2026-10-13 06:16
@lhylhy2024/dsh-deepseek-turn-cost DSH widget: DeepSeek account balance above the sidebar account area, running cost of the open conversation, per-turn cost, and a button-triggered AI breakdown for turns over a token threshold. Peak/off-peak billing, holiday-aware.	medium	not audited	0/1/6	0/0	2026-10-13 06:16
@Xxsttb/dsh-input-optimizer DSH plugin: a four-pointed-star button left of the composer's model selector that rewrites your draft before you send it — fixing grammar, ambiguity and execution order — plus a dedicated settings page. AI-generated.	low	not audited	0/0/3	0/0	2026-10-13 06:16
@mmparko/dsh-purge DSH 破甲 (mirror of YuJunZhiXue/dsh-purge) — 上游即将删库，此为本仓库全量镜像：含全部分支/73 个 tag/完整提交历史。原作者署名与二开要求见 README 署名章节。	medium	not audited	0/4/5	0/3	2026-10-13 06:16
@2861292267/dsh-prompt-forge WorkBuddy's 增强提示词 (Enhance Prompt) as a DSH plugin: rewrite the composer draft into a stronger prompt with one click.	medium	not audited	0/2/6	0/0	2026-10-13 06:16
@27painter/dsh-moli DSH plugin · Drive the local Moli headless browser from DSH: moli_fetch and moli_probe for JS-rendered pages, Markdown, semantic trees, screenshots and PDFs, with sandbox-aware failure classification.	high	medium	1/5/7	0/0	2026-10-13 06:16
@suanlv/dsh-local-compute-pool DSH plugin: pool several local inference endpoints and spread delegated subagents across them	low	not audited	0/0/9	0/0	2026-10-13 06:16
@MycatQieZi/dsh-persona-shaoxin 给 DSH 挂一个烧心体人格：改 Markdown 就是改人格，保存即生效。	low	not audited	0/0/1	0/0	2026-10-13 08:15
@Shiyuedong-Jade/DM-recovery 达梦 DM8 数据库可恢复能力评估插件。按 16 个恢复场景逐项对照「要求 vs 本库实际」，回答能恢复到哪一点、要丢什么，生成 HTML 报告。	medium	not audited	0/3/20	0/0	2026-10-13 08:15
@HelloQingTao/dsh-global-prompt Global instructions panel for DSH web — fixed, installable fork of couplingartist/dsh-global-prompt	low	not audited	0/0/3	0/0	2026-10-13 08:15
@liuzwZYW/dsh-pwa-ui	low	not audited	0/0/0	0/0	2026-10-13 08:15
@Taulee/dsh-ecnu-quota DSH 网页界面里的华东师范大学 (chat.ecnu.edu.cn) Open API 额度卡片与详情面板	medium	not audited	0/4/16	0/0	2026-10-13 08:15
@Shiyuedong-Jade/DM-security 达梦 DM8 数据库只读安全评估插件：13 个域 60 项检查（53 项库内 + 7 项主机侧 OS/SSH），六态结论不评分，等保 2.0（GB/T 22239-2019）控制点对照（2/3/4 级可选），输出单文件 HTML 报告。	medium	not audited	0/3/24	0/0	2026-10-13 08:15
@john-walks-slow/dsh-sidebar-toggle Quickly toggle DSH Web UI sidebar grouping between workspace and flat list via Alt+R or clicking the section header title (Sessions / Workspaces). 侧边栏工作区分组与平铺会话列表快捷切换插件。	low	not audited	0/0/0	0/0	2026-10-13 08:15
@vec715/dsh-activity-view Activity view for the DSH web sidebar: a bell swaps the sessions list for Needs attention, Working and Today.	low	not audited	0/0/2	0/0	2026-10-13 08:15
@ax2/dsh-toolbox-bundle One command installs four deterministic DSH plugins: 46 offline, bounded tools for JSON/YAML/CSV/encoding chores plus JVM, Python and Windows production diagnostics.	low	not audited	0/0/0	0/0	2026-10-13 08:15
@Wlaeg/dsh-pet-desktop-linux A transparent always-on-top desktop pet for DSH on Linux (X11 / XWayland)	medium	medium	0/6/7	0/0	2026-10-13 08:15
@iuuuuuuuu/dsh-tauri-notify-webhook DSH Tauri plugin: forward a task notification to email (SMTP) or pushplus when a task stops abnormally or completes, and only while the window is not in front of you.	low	not audited	0/0/0	0/0	2026-10-13 08:15
@373831615/dsh-think-level DSH 会话思考档位插件（think-level）：每个会话六档推理开关（关闭/低/中/高/最高/超高），子代理继承，就近收敛到模型支持档位	low	not audited	0/0/1	0/0	2026-10-13 08:15
@Nesarf/Oishikunaare-Moe-Moe-Kyun Output house rules for every DSH agent: no check-mark or cross glyphs in replies or written files, and a light kaomoji habit in conversation. One global prompt section, so every preset, workspace and subagent obeys without a single preset edit.	low	not audited	0/0/11	0/0	2026-10-13 08:15
@guojinpeng/dsh-cost-meter 极简匹配DSH官方风格的计费卡片	low	not audited	0/0/0	0/0	2026-10-13 08:15
@cpsGGG/dsh-task-board Cross-project task board for DSH: every DSH session becomes a task card across 待处理 / 处理中 / 待审阅, with a 16-colour priority palette, stable ordering and a one-page adaptive layout.	medium	not audited	0/1/13	0/0	2026-10-13 08:15
@MarchingWorkhorse/dsh-code-studio 像vscode一般支持修订记录审查，支持accept和undo，以及查看项目完整修订记录	low	not audited	0/0/1	0/0	2026-10-13 08:15
@Wlaeg/dsh-notify-linux DSH 插件：完成任务、需要选择或需要批准时发送桌面通知并播放提示音 · Desktop notifications + sound for DSH on Linux	medium	not audited	0/2/5	0/0	2026-10-13 08:15
@JianYiAG/dsh-prompt-enhancer DSH Web 插件：输入框一键优化提示词（需求 / 设计 / 实现 / 分发全记录）	low	not audited	0/0/0	0/0	2026-10-13 08:15
@RGarrido03/dsh-zed-provider Use your Zed AI subscription (Pro / Student) from DSH: registers the zed-agent route with Claude + GPT models, an editable Models-page card and a model chooser.	high	low	2/2/5	0/0	2026-10-13 10:15
@xyl886/dsh-key-usage DSH 侧边栏「使用情况」：按通道查看用量明细、年度热力图、项目/会话用量与余额配额快照，纯本地只读、零外网	low	not audited	0/0/4	0/0	2026-10-13 10:15
@WLX2007/DSH-SkillsHub DSH 技能中心插件 —— 原生 Web GUI 面板：搜索网络技能市场（SkillHub / skills.sh / GitHub）、一键安装到用户/项目根、管理与创建本地技能。npm: @wulongxi/dsh-skills-hub	low	not audited	0/0/0	0/0	2026-10-13 10:15
@sibetlyf/dsh-plugin-tencent-meeting Tencent Meeting plugin for DSH with user-supplied local credentials and explicit approval.	low	not audited	0/0/0	0/0	2026-10-13 10:15
@axuan-1314/dsh-usage-stats DSH 官方桌面版「使用统计」插件：设置页新增使用统计分区——五格摘要条 / 52 周 Token 热力图（每日·每周·累计三档）/ 今日·近 7 日·近 30 日趋势折线 / 模型用量环形图。全本地 JSONL 落盘，零上传、零运行时依赖，支持历史会话回填。	low	not audited	0/0/5	0/0	2026-10-13 10:15
@Echo-Note/dsh-hindsight-settings DSH settings page for the Hindsight coding-agents plugin: edit ~/.hindsight/coding-agent.json from the DSH GUI	medium	not audited	0/2/1	0/0	2026-10-13 10:15
@oliblue-evan/dsh-model-organizer 模型菜单整理器：按厂商折叠、悬浮滑出模型面板，支持置顶、最近、厂商内搜索、别名与隐藏。纯客户端插件（DSH / DSH）	low	not audited	0/0/3	0/0	2026-10-13 10:15
@Trisia/dsh-tmp-wks Stop leaving DSH to make a temp folder. One-click throwaway workspaces with optional cleanup · 告别手动建目录，DSH 一键临时工作区，删除可控	low	not audited	0/0/0	0/0	2026-10-13 10:15
@XinzeQing/dsh-user-memory User-authored tiered long-term memory for DSH: injected as a system-prompt section, with a Chinese panel to view and edit it. The AI never writes to memory on its own.	low	not audited	0/0/2	0/0	2026-10-13 10:15
@xfgil/dsh-onebot-companion QQ 通道一体化插件：出站沉默守卫、每轮行为规则、对话节奏（入站合并/出站分段）、人设（情绪+主动发言+风格学习）、语音（qq_say: 文字→edge-tts→语音消息）。Runtime prototype patching for dsh-onebot-qq — upgrade-proof, no node_modules edits.	low	not audited	0/0/3	0/0	2026-10-13 10:15
@ericlee041769-hash/dsh-waibao DSH 外包：Codex 分配任务，DSH 桌面执行；可见会话、连续上下文、完成回调。	medium	low	0/8/6	0/0	2026-10-13 10:15
@baitouwuya/dsh-mcp-server DSH plugin that publishes the running Harness as a Model Context Protocol (MCP) server for other agent harnesses.	medium	not audited	0/1/9	0/0	2026-10-13 10:15
@lizilong1993/dsh-offpeak Automatic peak-hour control for DSH	low	not audited	0/0/6	0/0	2026-10-13 10:15
@skyjjgw/dsh-version-guard DSH 版本守卫：记录插件版本与配置快照，插件冲突导致 DSH 崩坏后可脱离 DSH 进程回退到上一个可用版本 · Out-of-process rollback for DSH plugins	high	low	1/5/23	0/0	2026-10-13 10:15
@asun-labs/dsh-plugin-computer-user Virtual desktop computer use for DSH with a live right sidebar and a virtual pointer.	medium	not audited	0/1/1	0/0	2026-10-13 10:15
@std-microblock/orange-bot 橘波特 (Orange): a QQ group chat bot stack for DSH — the dsh plugin, the koishi bridge for the official QQ bot, and the crossgram extension for the userbot. Monorepo.	medium	not audited	0/1/1	0/0	2026-10-13 10:15
@StarCried/starlite-dsh A privacy-conscious Inochi2D desktop companion for DSH on Windows 11 + WSL2.	medium	not audited	0/2/6	0/0	2026-10-13 10:15
@wobenshiwomu/dsh-plan DSH 插件：深潜计划 —— DSH 里的自营 Token Plan 页面。七档订阅（¥10~自定义），订阅跳官方充值页；充回来自动把额度写进 dsh-ration \| A self-hosted Token Plan page inside DSH: subscribe, top up DeepSeek balance, self-quota syncs	low	not audited	0/0/5	0/0	2026-10-13 12:16
@axuan-1314/dsh-keepsake DSH 跨会话记忆插件：本地 markdown 落盘、自动提取+注入、零依赖 + 管理面板。Local-first cross-session memory plugin for DSH.	low	not audited	0/0/0	0/0	2026-10-13 12:16
@Audrey-cn/dsh-bot-codex-ui Unified install for DS Bot and the Codex-style sidebar, with their layout conflicts fixed. One package for DSH.	medium	not audited	0/1/3	0/0	2026-10-13 12:16
@Alice39s/agent-stash Personal Agent Skills, pi extensions, and DSH plugins	low	not audited	0/0/2	0/0	2026-10-13 12:16
@Jeffry-Z/dsh-plugin-archived-sessions Manage archived DSH sessions: list, restore, and permanently delete with immediate sidebar synchronization.	low	not audited	0/0/3	0/0	2026-10-13 12:16
@Tim-ReJet/dsh-plugin-durable-subagent Durable subagent execution for DSH: a `durable` provider and a model-facing tool that drive pi-durable-subagents, so a crashed delegation converges on its first outcome instead of running twice.	medium	not audited	0/1/1	0/0	2026-10-13 12:16
@58catmiao/dsh-sciwork dsh-sciwork 把「科研模式」装进 DSH：一个落在自己硬盘上的科研库、一套技能与一块面板。课题、图、草稿、文献、数据表、期刊档案、投稿台账各有其位，写入都经库脚本落盘并登记，面板只读为主、自己不出图。技能把「怎么画、怎么写、怎么引」固化成纪律：出图交给 Origin 链路，写作、引用、投稿格式各有专门技能，外加 12 份期刊档案兜底。零 npm 依赖，路径运行时解析，换台机器照样跑。	medium	medium	0/5/20	0/0	2026-10-13 12:16
@xingzhen199186/dsh-subagent-custom DSH 子代理模型管控与 Jev 智能分流插件（合并自 vitas/dsh-jev-subagent-dispatch 与 ringoage/dsh-subagent-model-picker）	low	not audited	0/0/3	0/0	2026-10-13 12:16
@lishuo4096/dsh-enet-review 嘉立创 EDA .enet 网表原理图校对 —— DSH 插件（9 个 enet_* 工具 + 2 个技能）	low	not audited	0/0/1	0/0	2026-10-13 12:16
@SpookyWaste/dsh-ohjingjing-team 智能体团队面板美化: 用「哦鲸鲸」形象替换 DSH 智能体团队面板里成员行的状态图标（静止 / 运行 / 失败）	low	not audited	0/0/0	0/0	2026-10-13 12:16
@flying4055/dsh-window-bounds Remember the DSH desktop window size and position between launches (dsh plugin)	low	not audited	0/0/4	0/0	2026-10-13 12:16
@iuuuuuuuu/dsh-coldread-cache DSH plugin: keep a session's parsed event log resident so a local append extends the resident parse instead of invalidating it - a long session is parsed once per host process, not once per read.	medium	not audited	0/1/0	0/0	2026-10-13 12:16
@Flan246/dsh-lit-search-mcp MCP server: academic literature search, citations (GB/T 7714/APA) and BibTeX (Crossref + OpenAlex + Semantic Scholar)	low	not audited	0/0/0	0/0	2026-10-13 12:16
@wangbofan/dsh-daily-chat 【蓝色大肥鱼版】DSH 日常聊天插件：把「新会话」拆成日常与工作，日常人格是「蓝色大肥鱼」（DeepSeek娘 / 鲸鱼娘），支持真删除单条与批量聊天记录	low	not audited	0/0/6	0/0	2026-10-13 12:16

Site-wide fused risk

Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total

2026-10-21

266

critical

high

195

medium

22354

low

Critical-tier plugins (266)

claude-paper dsh-sentinel dsh-review-loop deepseek-harness-fnos dsh-for-vsc pi-mm-vision dsh-plugin-verify ds-web-ui deepseek-harness-desktop-7 dsh-plugin-manager dsh-fff deepseek-harness-plugins dsh-desktop-pet-2 dsh-science-workbench dsh-lan-2 dsh-workshop deepseekharnessremotegateway dsh-lorebookmd dsh-plugin-market-5 dsh-file-panel dsh-np-ppt deepseek-harness-android-app dsh-web-remote dsh-self-harness-tools dsh-change-review dsh-hotswap makocode dsh-skill-mcp-panel dsh-tavern-2 dsh-mc-agent dsh-web dsh-doctor-4 dsh-design-studio dsh-tailscale-console dhs-theme-plugin deepseek-harness-molt dsh-command-check-update dsh-auth-gate dsh-silly-plugin opendsh dsh-tool-code-review dsh-task-console dsh-agent-eval-2 deepseek-harness-plugins-3 dsher-bbs-plugin deepseek-harness-plugs-manage dsh-dev-server dsh-about-updater dsh-toolbox-web dsh-remote-public dsh-notifier-2 dsh-plugin-container dsh-desktop-huacai deepseek-herness-desktop paperlab chromex-browser dsh-github-tool dsh-lan-access-3 dsh-custom-ui dsh-pet-6 desk-harness dsh-plugin-lark dsh-webgate dsh-tavern-3 dsh-anchored-monitor dsh-neutrino living-dream-dsh dsh-comfyui dsh-desktop-68 dsh-wechatclawbot orbit-dsh-plugin dsh-perm-guard dsh-cc-plugins dsh-tool-generate-image dsh-routed-subagent dsh-swarm dsh-nuphus-mcp dsh-lark-all dsh-ide-panels chat-deepseek-vision deepseek-harness-liquid-glass-theme dshscan dsh-pwsh-direct dsh-capcheck dsh-minecraft-theme dsh-plugin-market-20 dsh-diffgeom dsh-remote-7 dsh-logcat dsh-ide-bridge dsh-mail-connector dsh-fleet dsh-desktop-tools-2 dsh-usage-6 dsh-mobileshare dsh-plugin-market-22 dsh-profile-port tavern-launcher dsh-file-links pdfreader dsh-publish-plugin dsh-workshop-3 dsh-qq-remote dsh-settings-pro dsh-github-push dsh-web-remote-frp dsh-pentester dsh-tool-lens dsh-testsuite codereader dsh-webroad weave-for-dsh dsh-tool-git-3 dsh-memory-eternal dsh-capability-manager dsh-arbitrary-host dsh-plugins-76 dsh-store dsh-lanchat dsh-k8s dsh-worktable dsh-tts-player dsh-agent-browser-2 dsh-image-read dsh-stats-expand dsh-usage-stats-11 dsh-input-enhancement dsh-safe-launch dsh-balance-plugin-6 atri-for-dsh convoport dsh-experience-library deepseek-harness-desktop-54 dsh-relay-2 dscoder dsh-inline-images-2 dsh-community-plugins-2 dsh-process-board dsh-rtk-tools dsh-plugin-offline-packager dsh-asset-manager dsh-vsceditor dsh-suhuang-scroll dsh-free-models-hub dsh-freeroute dsh-bg-plugin dsh-sandbox-permissions-not-strictly-wider-justification-empty-fix dsh-applauncher dsh-public-access dshessentialtools dsh-qrcode-hassle-free dsh-call-shrink dsh-automation-3 dsh-skill-hub-3 dsh-desktop-102 dsh-kit-4 dsh-plugin-ollama-monitor dsh-smart-reminder dsh-plugins-94 dsh-4-role-workflow dsh-raw-html-v2 dsh-gb dsh-git-review-2 dsh-plugin-canvas-pro dsh-search-pro dsh-git-9 dsh-tmwebdriver dsh-fleet-2 dsh-cc-backup dsh-token-pulse phone-tunnel-pool see-the-screen deepseek-harness-minimal-omni dsh-plugin-forge-5 dsh-session-progress dsh-move-rag dsh-cad-viewer dsh-agentic-proxy dsh-wechat-bridge-5 dsh-windows-remote-ssh dsh-remote-file-system dsh-better-display-2 dsh-better-uiux dsh-default-prompt dsh-agent-cluster dsh-sidebar-plus vscode-dsh-sidebar dsh-agnes-studio dsh-youdaonote dsh-plugin-repo-snapshot dsh-netease-music-2 dsh-lobsterai-daddy dsh-cua-preview dsh-buddy-spike dsh-novel-app dsh-desktop-settings dsh-zcode-connector anoslide-plugins dsh-destinywind-tpm dsh-waker voice-input dsh-draw-plugin dsh-ipynb-preview dsh-ask-form dsh-remote-access-cidr dsh-genbox-plugin dsh-wsl-projects dsh-mcp-unified-panel dsh-archive-keeper-plugin dsh-nutstore-backup dsh-kp-notes dsh-flow-3 dsh-aoci dsh-service-board cad-ppt-skills dsh-wb dsh-web-app dsh-text-explain dsh-ledger-memory dsh-artcraft dsh-remote-13 zadloop-ultimate-toolkit dsh-ai-ball dsh-mcp-manager-19 dsh-deploy-web dsh-plugin-cdp dsh-upgrade-2 dsh-envkit dsh-desktop-app-4 dsh-pwa-launcher dsh-steal-code dsh-tools-5 dsh-helper-plugin-workspace-browser dsh-console-plugin dsh-olivia-bridge dsh-obsidian-sync-2 dsh-git-server dsh-android-scrcpy zcode-dispatch dsh-armor-switch dsh-tool-suite pi-control-chrome dsh-skill-market-4 dsh-chatsync dsh-liquid-glass-theme-2 dsh-remote-gui dsh-plugins-151 dsh-plugin-30 dsh-skill-creator-5 dsh-xl-free-model dsh-browser-agent-4 dsh-plugin-market-30 dsh-maplestory-wz dsh-tool-mathfig dsh-phone-bridge-3 dsh-latex-studio dsh-6 dsh-brand-text mindie-agent-dsh dsh-bili-scroll-2 wa-agent dsh-opencode-free-3 dsh-phone-remote-2 dsh-android-phone dsh-dispatch-2 dsh-pocket-oauth

Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.

Daily report archive

66 reports

← Back to security reports

What does this daily report cover?

This report covers plugins first indexed by dsh.so on 2026-10-13. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.

How are the risk tiers assigned?

Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.

Why is this not a full security audit?

The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.

What does the "Manifest" column mean?

Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.

Is the static scan the only layer?

No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.

Source: dsh.so security standards · Maintained by dsh.so · Published 2026-10-13