Daily security scan

Date · 2026-10-14 (UTC — plugins first indexed that day)

Static scan · new today

rule heuristics · shape only

critical

high

medium

low

Tier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low.

Dynamic audit · subset of new today

model reads source · no execution

critical

high

medium

low

Only entries static-flagged ≥ warn are audited; tier = highest finding. Of 99 new entries, 85 are out of the queue or have no conclusion yet.

Plugin	Static	Dynamic	Findings C/W/I	Manifest	Indexed
@liu19666/dsh-model-block-picker DSH 插件：把输入框模型选择器改成按来源渠道分块 + 下钻选模型，保留搜索与推理强度	medium	not audited	0/1/2	0/0	2026-10-14 00:15
@JMX-4869/dsh-mood 给 DSH 加一层心情：22 种心情各自持有数值，每 3~6 小时自动判定，注入提示词影响回复语气和内心话。附带每日心情日记、可自配来源的时事、可选的主动开口。	medium	medium	0/9/19	0/0	2026-10-14 00:15
@liujianqiao701/dsh-test-framework 面向测试工程师的 DSH 插件：把空文件夹一键变成「测试工作框架」骨架，并在 AI 会话里带上框架约束 —— 需求文档拆模块 / 确认版本 / 跨文档关联 / 登记测试环境与账密。AI test-framework plugin for DSH.	medium	medium	0/10/7	0/0	2026-10-14 02:15
@hydra-db/hydradb-deepseek-plugin Persistent long-term memory for the DSH, powered by HydraDB.	medium	not audited	0/1/6	0/0	2026-10-14 02:15
@sunrulin123/dsh-community-web-ui Unofficial responsive remote Web UI bundle for DSH with native Desktop isolation.	low	not audited	0/0/0	0/0	2026-10-14 02:15
@YQing0123/dsh-artifact-center	medium	not audited	0/1/1	0/0	2026-10-14 02:15
@jabingu/dsh-reply-suggestions Contextual reply suggestions for DSH. Press Enter to fill an editable draft.	low	not audited	0/0/0	0/0	2026-10-14 02:15
@Cikian/dsh-cture-image OpenAI-compatible image generation for DSH — text-to-image, image editing and batch generation, rendered straight in the conversation.	medium	not audited	0/1/4	0/0	2026-10-14 02:15
@YUsaltyfish/dsh-bongo-fish A BangoCat-style typing feedback widget that auto-snaps to the DSH composer, with customizable art and sound./一个BangoCat风格输入反馈小挂件，可以自动吸附在dsh输入框及窗口边缘，支持自定义形象和音效	low	not audited	0/0/15	0/0	2026-10-14 02:15
@linshenyuan/dsh-memory DSH 的跨会话长期记忆插件	low	not audited	0/0/1	0/0	2026-10-14 02:15
@lengfengng-tech/dsh-workspace-memories Per-workspace persistent memory plugin for DSH: sidebar panel, automatic system-prompt injection, and an agent tool to save memories	medium	not audited	0/2/1	0/0	2026-10-14 02:15
@feely0208/dsh-data-classify 数据分类分级：查数据有没有分级标注与资产清单（数据安全法 21 条）。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@feely0208/dsh-cn-data-export 数据出境检查：查代码与配置里的境外数据出口、个人信息外发、缺安全评估说明。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@feely0208/dsh-minor-guard 未成年人保护：查不满 14 周岁个人信息有没有监护人同意、专门规则、年龄门槛。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@feely0208/dsh-cn-filing 备案公示检查：查应用里有没有 ICP/APP 备案号、隐私政策入口、运营者信息。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@guyusky/dsh-export-plugin DSH 会话导出插件：在 dsh Web 会话「更多」菜单注入「导出 Markdown / 导出 PDF」，纯前端注入、零 npm 依赖。Export DSH sessions to Markdown or PDF from the web GUI.	low	not audited	0/0/0	0/0	2026-10-14 04:15
@feely0208/dsh-data-rights 个人信息权利：查查阅/复制/删除权有没有真的实现（个保法 45/47/50 条）。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@Sayi/dsh-plugin-kit DSH plugin kit	medium	not audited	0/1/13	0/0	2026-10-14 04:15
@wangbofan/dsh-restart-button DSH desktop (Windows) titlebar menu: a Restart button that closes and relaunches the whole app - shell + Host. Plugin-only, no app.asar patching.	medium	not audited	0/1/4	0/0	2026-10-14 04:15
@MengYuanzhuo/dsh-plugin-magi An EVA style MAGI system with three terminals for DSH plugin.	medium	not audited	0/2/2	0/0	2026-10-14 04:15
@TonyZiYuan/dsh-session-delete 在 DSH Web 界面里删除会话。	low	not audited	0/0/5	0/0	2026-10-14 04:15
@feely0208/dsh-pipia 个人信息保护影响评估：查是否按个保法 55 条做了评估、56 条留存三年。	low	not audited	0/0/0	0/0	2026-10-14 04:15
@wumou-sleep/dsh-xiaojingyu-persona 傲娇小鲸鱼：给 DSH 加一段可开关的全局人格段落（Tsundere whale-girl persona plugin for DSH）	low	not audited	0/0/0	0/0	2026-10-14 06:15
@Knight-Zjy/dsh-workspace-categories DSH 侧边栏的工作区分类树：分类 > 工作区 > 会话（VS Code 风格）。Collapsible category tree for DSH workspaces.	low	not audited	0/0/3	0/0	2026-10-14 06:15
@john-walks-slow/session-prefix Visual session state badges for DSH: prefix a session title with customizable emoji badges (wip 🚧 blocked ⏸️ review 👀 done ✅) — configurable default state for new sessions, session_prefix model tool, /state command, Web settings. session-prefix：用会话标题前缀（默认 Emoji，可自定义）标记项目状态，含新会话默认状态、Agent 工具与 /state 命令。	low	not audited	0/0/2	0/0	2026-10-14 06:15
@awol2005ex3/dsh-hdfs DSH 插件：在 dsh 里浏览与操作 HDFS。Rust (napi-rs + hdfs-native) 直连集群，支持 HA 多 Namenode 与 Kerberos，带 Web 浏览面板与 agent 工具。	low	not audited	0/0/2	0/0	2026-10-14 06:15
@kaya734/jevcore TypeSafe Jev for DSH, the Model Context Protocol, and plain Node: typed judgments instead of prose, offline by default.	low	not audited	0/0/0	0/0	2026-10-14 06:15
@masknull/dsh-composer-history DSH 插件：Web 输入框支持 shell 风格历史——↑ 翻出本会话已发送的文字，↓ 逐条回翻并恢复你在打的草稿。 \| DSH plugin: shell-style composer input history - ArrowUp recalls sent messages, ArrowDown walks forward and restores the draft you were typing. 支持 DSH 0.2.0-rc.1+。	low	not audited	0/0/0	0/0	2026-10-14 06:15
@6mt/dsh-control 本地一个窗口，驱动你所有机器上的 dsh · Drive the dsh instances on your other machines from one local window	critical	medium	1/6/13	0/0	2026-10-14 06:15
@Butt91/flameox Runtime evidence that helps agents trace, profile, and burn down hotspots in application and native code, GPU kernels, and inference stacks.	low	not audited	0/0/0	0/0	2026-10-14 06:15
@Roussel27423/engramory A portable memory protocol for AI agents — load it as standing rules; a curation discipline + reference spec + optional cap hook.	low	not audited	0/0/0	0/0	2026-10-14 06:15
@panqing0313/dsh-weixin 微信（iLink）通道插件：在微信里给 DSH Agent 发消息，在本机跑会话并把回复发回微信。Text, images, files and voice notes.	medium	low	0/2/5	0/0	2026-10-14 06:15
@wobushiyoushen0214/dsh-opencode-pin Pin an OpenCode Go upstream route in DSH by keeping one stable x-opencode-session key, with an in-GUI route picker and drift checks.	medium	not audited	0/2/5	0/0	2026-10-14 06:15
@Roussel27423/opencode2dsh DSH plugin — free OpenCode Zen models for DSH. Free LLM API, no API key needed. 在 DSH 中使用 OpenCode Zen 免费模型，无需 API key	low	not audited	0/0/0	0/0	2026-10-14 06:15
@xcasee/dsh-plugin-market-intelligence A DSH market-intelligence expert plugin powered by the CaSee platform — native intelligence tools, an expert persona, a bundled skill and a CaSee dark-dashboard HTML report contract.	medium	not audited	0/1/1	0/0	2026-10-14 08:16
@RaganaBloodedge/dsh-read-video DSH 视频阅读插件（TypeScript）：HTTP Range 按需取字节 + ffmpeg 远程 seek，给定时间戳只拉目标区间，实测取一帧仅占整片 0.7%，不落盘任何视频文件	low	not audited	0/0/0	0/0	2026-10-14 08:16
@xiamubumu/dsh-composer-launcher Launcher for DSH 1.5: one panel for the capability composer, plugin inventory, MCP bridge and the browser tab-bridge extension.	medium	medium	0/12/20	0/0	2026-10-14 08:16
@feely0208/dsh-agent-scope Agent 权限边界：查 agent 的工具/文件/网络权限有没有声明、是不是过宽。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@xiamubumu/dsh-context-reclaim Context governance for DSH 1.5: folds tool results, keeps the prompt cache warm, and takes over the host writable-request path (no official dsh-llm file patch needed).	medium	medium	0/5/7	0/0	2026-10-14 08:16
@npopov865/dsh-permission-rules Claude Code-style declarative permission rules for DSH: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, session-log audit, and HMR reload.	low	not audited	0/0/0	0/0	2026-10-14 08:16
@Solovyov232/dsh-crew DSH plugin: dispatch work to DSH agents from Claude Code / Codex — native subagent progress, in-host worker sessions with per-tier presets, and a multimodal bridge that lends the text-only harness vision and image generation.	low	not audited	0/0/0	0/0	2026-10-14 08:16
@zhongjiadeng-cmd/dsh-codex-appearance Appearance settings and a blue-gray theme for DSH	low	not audited	0/0/2	0/0	2026-10-14 08:16
@Ivanj61/seektty 面向 DSH 的 Claude Code 风格终端界面，支持 Windows、macOS 与 Linux，兼容透明终端、VS Code 主题和自定义配色。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@xiamubumu/dsh-capability-composer Capability composer for DSH 1.5: build per-session tool / skill / MCP compositions and shrink the system prompt on demand.	medium	not audited	0/1/9	0/0	2026-10-14 08:16
@feely0208/dsh-algorithm-filing 算法备案与告知：查算法推荐服务有没有关闭选项、告知、备案。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@lSzymanski73/flameox Runtime evidence that helps agents trace, profile, and burn down hotspots in application and native code, GPU kernels, and inference stacks.	low	not audited	0/0/0	0/0	2026-10-14 08:16
@imason85/dsh-normify Normify · DSH 插件：把项目架构写成归一化的分形模块树，三层校验（写时 / 校验 / 冻结回执）、30 个 normify_* 工具 + normify-gen 技能，一键渲染单文件交互式架构图；支持伴随式开发（change_open → brief → check → 实施 → refresh → change_close）。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@songzhiyin/dsh-local-model 让 DSH 直连本地模型：兼容 OpenAI 协议（llama.cpp / LM Studio / vLLM / Ollama 的 /v1）与 Ollama 原生 API。无需登录、不消耗账号 token。	medium	not audited	0/4/10	0/0	2026-10-14 08:16
@feely0208/dsh-incident-package 应急证据包：查出了事能不能拿出证据（预案/联系人/日志保全/上报流程）。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@MCviseron/dsh-matlab-mcp DSH 与matlab桥接的dsh端插件。含知识库。	medium	not audited	0/1/6	0/0	2026-10-14 08:16
@xiamubumu/dsh-aux-degrade Auxiliary-model degradation guard for DSH 1.5: keeps side calls cheap (reasoning effort off, token floor, tool stripping) without touching the main loop.	medium	medium	0/6/4	0/0	2026-10-14 08:16
@ytftu/dsh-session-cost DSH插件：底栏会话消费金额、每条回复本轮金额、右上角开放平台余额/今日用量/峰谷，点击弹出折线图。	medium	not audited	0/1/7	0/0	2026-10-14 08:16
@PieterPrice49/seektty 面向 DSH 的 Claude Code 风格终端界面，支持 Windows、macOS 与 Linux，兼容透明终端、VS Code 主题和自定义配色。	low	not audited	0/0/0	0/0	2026-10-14 08:16
@mikuniemo/dsh-skill-router Shrink the DSH skill catalog from O(n) to ~600 tokens - router + on-demand category indexes. Zero dependencies, cross-platform.	medium	not audited	0/2/1	0/0	2026-10-14 08:16
@Suxeca/dsh-literature-library DSH literature library: persistent, authenticated literature bookmarks and a local research knowledge base for academic review workflows.	low	not audited	0/0/1	0/0	2026-10-14 10:16
@Suxeca/dsh-plugin-repo-auditor DSH native plugin: audit GitHub repos for fake stars, stargazer bot farms and hollow codebases using CMU StarScout heuristics, plus static supply-chain and sensitive-permission inspection.	low	not audited	0/0/4	0/0	2026-10-14 10:16
@Arlenman/dsh-backup-sync DSH 备份 / 换机同步插件：把技能、插件、配置、记忆、待办打成一个包，换机时按模块做带基线的三方合并导入	low	not audited	0/0/4	0/0	2026-10-14 10:16
@Lain-in-coding/dsh-grok-search A DSH search provider backed by the grok-search-rs MCP server. Keeps the native web_search tool and swaps only the backend.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@fegnze/myspace-dsh-browser-computer 让 DSH 直接操作浏览器与电脑：以插件形式装配 playwright-mcp 与 peekaboo-mcp，附一键依赖安装、macOS 系统权限引导与 MCP 连接自检。	medium	not audited	0/2/5	0/0	2026-10-14 10:16
@huihuangdi/dsh-model-provider-badge Shows the provider behind a session's current model as a compact badge in the DSH Web composer tool row.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@KKUCODES/dshm-plugin Desktop plugin for DSH that connects DSHM to computer sessions, with device pairing, access control, and synchronized chat.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@Suxeca/dsh-client-ui-session-switcher DSH session switcher: Ctrl+K command palette to create/archive/rename/search sessions, plus Ctrl+[/] cycling and VSCode-style shortcut layout.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@GrowingPPP/dsh-inquiry-preset 探究模式：把一个概念变成学习者亲手操作的交互式学习任务（DSH agent preset）	medium	not audited	0/1/2	0/0	2026-10-14 10:16
@wzn16/dsh-skill-market DSH 可视化技能商店 — Visual skill market inside DSH: browse, search, install and manage Agent Skills	medium	medium	0/6/6	0/0	2026-10-14 10:16
@Suxeca/dsh-science-map Science Map for DSH: compiler and toolkit that turns a research reasoning flow into an evolving, gated evolution map.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@chenyuan1251/dsh-pet-niumali A desk pet that floats over the DSH interface and opens into a daily check-in, focus timer and habit journal.	low	not audited	0/0/0	0/0	2026-10-14 10:16
@Domaki-co/dsh-message-forward dsh会话消息转发	low	not audited	0/0/0	0/0	2026-10-14 10:16
@fegnze/dsh-plugin-scout Discover and verify DSH plugins from GitHub topic:dsh-plugin — trust score, official peer compatibility, one-click install via the official installer	low	not audited	0/0/5	0/0	2026-10-14 10:16
@kickTiger/dsh-pin-projects DSH 插件：项目（工作区）置顶 —— 置顶块锁定会话列表顶部 + 可折叠置顶区管理面板	low	not audited	0/0/0	0/0	2026-10-14 10:16
@133563825as-ai/dsh-asmrone DSH 音声库插件：asmr.one / B站 / DLsite 试听 / 本机曲库四源合一	low	not audited	0/0/0	0/0	2026-10-14 10:16
@AndroidSix/dsh-multi-router Multi-account WorkBuddy, Trae and Qoder routing for DSH	medium	not audited	0/1/4	0/0	2026-10-14 10:16
@temotee2103/dsh-remote-gui Embed a remote DSH GUI in the local DSH window over an SSH tunnel, with remote session listing and local/remote switching.	medium	high	0/8/20	0/0	2026-10-14 10:16
@john-walks-slow/dsh-session-prefix Visual session state badges for DSH: prefix a session title with customizable emoji badges (wip 🚧 blocked ⏸️ review 👀 done ✅) — configurable default state for new sessions, session_prefix model tool, /state command, Web settings. session-prefix：用会话标题前缀（默认 Emoji，可自定义）标记项目状态，含新会话默认状态、Agent 工具与 /state 命令。	low	not audited	0/0/2	0/0	2026-10-14 10:16
@xuelin632/dsh-aris-glass DSH 液态玻璃插件：给助手消息、左侧栏与标题栏菜单加毛玻璃底色（纯客户端样式注入）	low	not audited	0/0/0	0/0	2026-10-14 10:16
@384124694/dsh-host-paths DSH Desktop: dropped files and folders become @path references instead of uploads, by wiring the shell file-path bridge into the composer host-path seam.	low	not audited	0/0/0	0/0	2026-10-14 12:16
@XiaoSHang05/dsh-rice-guard A passive watchdog for DSH: watches a turn's thinking and text streams and cancels it when the model starts repeating itself.	low	medium	0/0/0	0/0	2026-10-14 12:16
@imtwa/dsh-recall DSH 跨会话记忆（按需）：列出并加载之前会话干了什么，不自动污染上下文。Cross-session memory for DSH, loaded on demand.	low	not audited	0/0/0	0/0	2026-10-14 12:16
@WiseXin/dsh-session-intent-title DSH 独立会话意图分类自动命名插件（⚡ 优化 / 🐛 修复 / ✨ 功能）	low	not audited	0/0/0	0/0	2026-10-14 12:16
@lishuo4096/artifact-center Cross-session artifact center for DSH: agent tools register deliverable files (PDF/Excel/PPT/code/JSON) into one shared folder, plus a sidebar panel that filters them by category, extension or keyword.	medium	medium	0/2/0	0/0	2026-10-14 12:16
@qikairo7/dsh-web-search-fetch DSH 多来源搜索与网页正文整理插件：免密钥首次使用、搜索融合、正文去重互补、来源与差异记录，沿用原生 web_search / web_fetch。	low	not audited	0/0/0	0/0	2026-10-14 12:16
@YYC-JNU/dsh-skill-invocation-monitor Read-only skill invocation monitor for DSH — which Agents are running, which Skill each is calling, status and elapsed time, live in the Web GUI sidebar. · 只读技能调用监控：侧边栏实时展示活动 Agent 正在调用的 Skill、状态与耗时。	low	not audited	0/0/0	0/0	2026-10-14 12:16
@Girmmy3321/dsh-approval-enter Focus the DSH approval panel automatically, so Enter approves and Esc rejects without reaching for the mouse.	low	not audited	0/0/0	0/0	2026-10-14 12:16
@sqslm/dsh-pinpu Audio-reactive turn rail for DSH: the transcript's own turn marks dance to whatever the system is playing (WASAPI loopback), with hover-only highlighting and a left/right rail option.	medium	medium	0/3/4	0/0	2026-10-14 12:16
@Leo-sail/dsh-plugin-agent-collaboration Persistent Bots, group rooms and a durable run ledger for DSH — an installable DSH plugin.	low	not audited	0/0/0	0/0	2026-10-14 12:16
@Xiaoli-Asuna/dsh-theme-endfield-style Arknights: Endfield-style theme for the DSH web UI (unofficial fan work).	low	not audited	0/0/0	0/0	2026-10-14 12:16
@yffo/dsh-engramory-recall Local BM25 auto-recall + write guard + memory panel for the Engramory markdown store — no network, no model, no daemon.	low	not audited	0/0/4	0/0	2026-10-14 12:16
@greatyao/dsh-connect-cursor 把本机已登录的 Cursor 模型接入 DSH：原生 LlmAdapter 直连 agent.v1.AgentService/Run 双向流	low	not audited	0/0/0	0/0	2026-10-14 12:16
@yll86/dsh-theme-aemath AEMEATH Theme - sakura violet-rose theme plugin for the DSH Web GUI	low	not audited	0/0/0	0/0	2026-10-14 12:16
@Lanzuelo/dsh-codex-bridge Codex architect and read-only reviewer for DSH Desktop. ChatGPT sign-in, model selection, explicit file approval and checkpoints. Preview.	medium	low	0/7/3	0/0	2026-10-14 12:16
@Hielo19/dsh-think-chinese DSH plugin: force the model thinking chain (reasoning) to always be written in Chinese	low	not audited	0/0/0	0/0	2026-10-14 12:16
@Klop233/dsh-claude-code-theme Claude Code visual theme for the DSH Web GUI ??warm paper palette, terracotta accent, Claude Code transcript markers and mono-forward typography.	medium	not audited	0/1/0	0/0	2026-10-14 12:16
@1015677515/dsh-prompt-ErrorNotes-desk DSH 全局提示词/对话提示词，错误记录功能插件	low	not audited	0/0/3	0/0	2026-10-14 12:16
@Boenxia/dsh-plugin-notebook-tools Cell-aware Jupyter notebook tools for DSH agents	low	not audited	0/0/0	0/0	2026-10-14 12:16
@Bainianzzz/dsh-fork-worktree DSH plugin: fork a workspace row into a git worktree, or delete the workspace folder	medium	not audited	0/2/2	0/0	2026-10-14 12:16
@linshufan21/dsh-boot-compass DSH boot splash: covers the loading card before the first paint, plays a seven-beat compass sequence, then hands off to the app. \| DSH 启动动画：在加载卡出现前接住首帧，播完七段罗盘序列后交接给主界面	low	not audited	0/0/2	0/0	2026-10-14 12:16
@lance808/dsh-image-tool 给 DSH 补上生图能力：把任意 OpenAI 兼容的生图服务接成平台工具，模型在对话里直接出图。	medium	medium	0/9/18	0/0	2026-10-14 12:16
@5V1A-afk/dsh-sticker-pack 给你的大肥鱼回话加上表情包	medium	not audited	0/2/7	0/0	2026-10-14 12:16
@ZelotsNullzwei/dsh-ofm-updater 给 DSH Desktop 的 Our Free Model 插件做一键更新：双击即可，处理 PATH / 慢网络 / 完整性校验三个坑。	low	not audited	0/0/0	0/0	2026-10-14 12:16
@swyc520/dsh-plugin-model-whitelist DSH 插件：在「设置 → 模型」里逐个勾选要显示的模型，未勾选的从模型选择器菜单中隐藏。	low	not audited	0/0/3	0/0	2026-10-14 12:16

Site-wide fused risk

Static + vet fused, dynamic raises applied (raise-only); 23166 entries in total

2026-10-21

266

critical

high

195

medium

22354

low

Critical-tier plugins (266)

claude-paper dsh-sentinel dsh-review-loop deepseek-harness-fnos dsh-for-vsc pi-mm-vision dsh-plugin-verify ds-web-ui deepseek-harness-desktop-7 dsh-plugin-manager dsh-fff deepseek-harness-plugins dsh-desktop-pet-2 dsh-science-workbench dsh-lan-2 dsh-workshop deepseekharnessremotegateway dsh-lorebookmd dsh-plugin-market-5 dsh-file-panel dsh-np-ppt deepseek-harness-android-app dsh-web-remote dsh-self-harness-tools dsh-change-review dsh-hotswap makocode dsh-skill-mcp-panel dsh-tavern-2 dsh-mc-agent dsh-web dsh-doctor-4 dsh-design-studio dsh-tailscale-console dhs-theme-plugin deepseek-harness-molt dsh-command-check-update dsh-auth-gate dsh-silly-plugin opendsh dsh-tool-code-review dsh-task-console dsh-agent-eval-2 deepseek-harness-plugins-3 dsher-bbs-plugin deepseek-harness-plugs-manage dsh-dev-server dsh-about-updater dsh-toolbox-web dsh-remote-public dsh-notifier-2 dsh-plugin-container dsh-desktop-huacai deepseek-herness-desktop paperlab chromex-browser dsh-github-tool dsh-lan-access-3 dsh-custom-ui dsh-pet-6 desk-harness dsh-plugin-lark dsh-webgate dsh-tavern-3 dsh-anchored-monitor dsh-neutrino living-dream-dsh dsh-comfyui dsh-desktop-68 dsh-wechatclawbot orbit-dsh-plugin dsh-perm-guard dsh-cc-plugins dsh-tool-generate-image dsh-routed-subagent dsh-swarm dsh-nuphus-mcp dsh-lark-all dsh-ide-panels chat-deepseek-vision deepseek-harness-liquid-glass-theme dshscan dsh-pwsh-direct dsh-capcheck dsh-minecraft-theme dsh-plugin-market-20 dsh-diffgeom dsh-remote-7 dsh-logcat dsh-ide-bridge dsh-mail-connector dsh-fleet dsh-desktop-tools-2 dsh-usage-6 dsh-mobileshare dsh-plugin-market-22 dsh-profile-port tavern-launcher dsh-file-links pdfreader dsh-publish-plugin dsh-workshop-3 dsh-qq-remote dsh-settings-pro dsh-github-push dsh-web-remote-frp dsh-pentester dsh-tool-lens dsh-testsuite codereader dsh-webroad weave-for-dsh dsh-tool-git-3 dsh-memory-eternal dsh-capability-manager dsh-arbitrary-host dsh-plugins-76 dsh-store dsh-lanchat dsh-k8s dsh-worktable dsh-tts-player dsh-agent-browser-2 dsh-image-read dsh-stats-expand dsh-usage-stats-11 dsh-input-enhancement dsh-safe-launch dsh-balance-plugin-6 atri-for-dsh convoport dsh-experience-library deepseek-harness-desktop-54 dsh-relay-2 dscoder dsh-inline-images-2 dsh-community-plugins-2 dsh-process-board dsh-rtk-tools dsh-plugin-offline-packager dsh-asset-manager dsh-vsceditor dsh-suhuang-scroll dsh-free-models-hub dsh-freeroute dsh-bg-plugin dsh-sandbox-permissions-not-strictly-wider-justification-empty-fix dsh-applauncher dsh-public-access dshessentialtools dsh-qrcode-hassle-free dsh-call-shrink dsh-automation-3 dsh-skill-hub-3 dsh-desktop-102 dsh-kit-4 dsh-plugin-ollama-monitor dsh-smart-reminder dsh-plugins-94 dsh-4-role-workflow dsh-raw-html-v2 dsh-gb dsh-git-review-2 dsh-plugin-canvas-pro dsh-search-pro dsh-git-9 dsh-tmwebdriver dsh-fleet-2 dsh-cc-backup dsh-token-pulse phone-tunnel-pool see-the-screen deepseek-harness-minimal-omni dsh-plugin-forge-5 dsh-session-progress dsh-move-rag dsh-cad-viewer dsh-agentic-proxy dsh-wechat-bridge-5 dsh-windows-remote-ssh dsh-remote-file-system dsh-better-display-2 dsh-better-uiux dsh-default-prompt dsh-agent-cluster dsh-sidebar-plus vscode-dsh-sidebar dsh-agnes-studio dsh-youdaonote dsh-plugin-repo-snapshot dsh-netease-music-2 dsh-lobsterai-daddy dsh-cua-preview dsh-buddy-spike dsh-novel-app dsh-desktop-settings dsh-zcode-connector anoslide-plugins dsh-destinywind-tpm dsh-waker voice-input dsh-draw-plugin dsh-ipynb-preview dsh-ask-form dsh-remote-access-cidr dsh-genbox-plugin dsh-wsl-projects dsh-mcp-unified-panel dsh-archive-keeper-plugin dsh-nutstore-backup dsh-kp-notes dsh-flow-3 dsh-aoci dsh-service-board cad-ppt-skills dsh-wb dsh-web-app dsh-text-explain dsh-ledger-memory dsh-artcraft dsh-remote-13 zadloop-ultimate-toolkit dsh-ai-ball dsh-mcp-manager-19 dsh-deploy-web dsh-plugin-cdp dsh-upgrade-2 dsh-envkit dsh-desktop-app-4 dsh-pwa-launcher dsh-steal-code dsh-tools-5 dsh-helper-plugin-workspace-browser dsh-console-plugin dsh-olivia-bridge dsh-obsidian-sync-2 dsh-git-server dsh-android-scrcpy zcode-dispatch dsh-armor-switch dsh-tool-suite pi-control-chrome dsh-skill-market-4 dsh-chatsync dsh-liquid-glass-theme-2 dsh-remote-gui dsh-plugins-151 dsh-plugin-30 dsh-skill-creator-5 dsh-xl-free-model dsh-browser-agent-4 dsh-plugin-market-30 dsh-maplestory-wz dsh-tool-mathfig dsh-phone-bridge-3 dsh-latex-studio dsh-6 dsh-brand-text mindie-agent-dsh dsh-bili-scroll-2 wa-agent dsh-opencode-free-3 dsh-phone-remote-2 dsh-android-phone dsh-dispatch-2 dsh-pocket-oauth

Static heuristic scan + manifest audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.

Daily report archive

66 reports

← Back to security reports

What does this daily report cover?

This report covers plugins first indexed by dsh.so on 2026-10-14. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.

How are the risk tiers assigned?

Risk tiers follow the same public model used across the site. Critical is reserved for secrets, exfiltration, destructive commands, or mining; other critical-level findings and warnings are reported as medium (needs review), and low for plugins with no meaningful findings.

Why is this not a full security audit?

The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.

What does the "Manifest" column mean?

Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.

Is the static scan the only layer?

No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusions can raise a verdict but never exempt one. The verdict shown across the site is the stricter of the two (max of static and dynamic). This daily report reflects the static layer. As of the latest run: 1898 dynamic audit records, 1767 with a model conclusion, 258 raised above the static verdict, 0 lowered below it.

Source: dsh.so security standards · Maintained by dsh.so · Published 2026-10-14