Daily security scan
Date · 2026-10-26 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report0 of 28 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 28 new entries: 0 with a conclusion, 10 queued, 0 failed (no conclusion), 18 low-risk not queued.
Data file updated 2026-10-29 07:30 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @liu19666/dsh-screenshot DSH 截图插件：窗口/屏幕/任务栏自动识别 + 标注 + 马赛克，截图直接进会话输入区（Windows 原生 C# + Cordis 插件，v2.1.0） | medium | medium | queued | 0/4/23 | 0/0 | 2026-10-26 00:16 |
| @Stijnus/dsh-workspace-status Workspace status marks, a pinned-conversation section and pinned-only notifications for the DSH sidebar. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-10-26 00:16 |
| @dmscode/dsh-rightbar-tab-gestures DSH 右侧栏标签页：鼠标中键关闭、左键双击关闭，手感与浏览器一致 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 00:16 |
| @Stijnus/dsh-move-to-workspace Move and organize DSH conversations across workspaces. Copies history to the target workspace and archives the original. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-10-26 00:16 |
| @ZachT11/dsh-runtime-env-watch Periodic AI runtime, hardware, and remote-device status checks for DSH | low | low | not queued (low risk) | 0/0/6 | 0/0 | 2026-10-26 00:16 |
| @axyatech/rea-harness-plugin REA (Reverse Engineer Anything) is a plugin designed for the DSH that provides agents with specialized tools to inspect binaries, applications, packages, and web pages while returning verifiable evidence for each conclusion. | medium | medium | queued | 0/2/5 | 0/0 | 2026-10-26 00:16 |
| @Achi-Migo/dsh-dwf Deterministic dynamic-workflow engine for DSH: TypeScript-checked workflow scripts, SQLite replay journal, deterministic guest sandbox, actor subagents, provider model pool. (non-commercial license) | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 00:16 |
| @x402/dsh-fail-fast Group-aware fail-fast tool batches for DSH: parallel-safe calls in a group still overlap, but once a call fails every call that has not started yet is skipped with a synthesized "not executed" result. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 02:16 |
| @heix0x/dsh-share-transcript DSH plugin — export part of a conversation as editable Markdown or a PNG card. Pick turns, edit the draft, copy/export. Redacted by default, read-only routes. | low | low | not queued (low risk) | 0/0/4 | 0/0 | 2026-10-26 02:16 |
| @luoyiyxo/dsh-happycode Your DSH activity as a GitHub-style contribution graph. | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-10-26 02:16 |
| @huhuai-ni/dsh-screenshot DSH 插件：全局快捷键截屏（微信式拖框选区、自动复制到剪贴板） | medium | medium | queued | 0/3/4 | 0/0 | 2026-10-26 02:16 |
| @xmdxzy/dsh-gpu-governor GPU governor plugin for DSH: per-process VRAM attribution grouped into projects, a top-5 board with budgets, and guarded suspend/resume/kill control | medium | medium | queued | 0/3/2 | 0/0 | 2026-10-26 02:16 |
| @huhuai-ni/dsh-homeassistant DSH 插件：用 Home Assistant 接管米家（小米智能家居）设备 —— 灯 / 空调 / 风扇 / 红外遥控，带设置页与完整教程。 | medium | medium | queued | 0/1/4 | 0/0 | 2026-10-26 02:16 |
| @huhuai-ni/dsh-github DSH 插件：直接管理你的 GitHub 账号 —— 仓库、issue、PR、通知、Actions、star | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-10-26 02:16 |
| @yuloop/dsh-secret-vault DSH plugin: hand secrets to the agent without them entering the context | low | low | not queued (low risk) | 0/0/1 | 0/0 | 2026-10-26 02:16 |
| @huhuai-ni/dsh-recorder DSH 插件：全局热键录屏（ffmpeg gdigrab） | medium | medium | queued | 0/3/4 | 0/0 | 2026-10-26 02:16 |
| @helix-byte/dsh-chinese-thinking DSH 插件：五层冗余机制强制模型使用中文推理 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 02:16 |
| @long18229425025/dsh-firebird-connector Safe Firebird 2.5-5.0 connector for DSH: named connections, read-only/read-write/admin modes, parameter binding, object whitelists, confirmation gates, and JSONL audit logs. Install from npm as dsh-firebird-connector. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 02:16 |
| @violin-i/dsh-plugin-law-workbench 工作台面板 for DSH：右侧停靠栏的文献库可视化面板（列表/检索/阅读） | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-10-26 02:16 |
| @huhuai-ni/dsh-clock DSH 插件：让 AI 知道现在几点 —— 时间、星期、时段、该用什么口吻 | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 02:16 |
| @uss7118/dsh-win-control Windows desktop control for DSH: window/UIA automation, local OCR, browser CDP reads, humanised mouse and keyboard input, live control panel. | medium | medium | queued | 0/5/8 | 0/0 | 2026-10-26 02:16 |
| @xsllo425/dsh-work-status DSH 插件：把 Agent 的工作状态收进标题栏一行——在做什么、做到哪、失败过没有；点开是目标、当前步、最近记录与上一轮。不调模型、不写提示词，只读已发生的事件。 | medium | medium | queued | 0/1/4 | 0/0 | 2026-10-26 02:16 |
| @zlwzk/dsh-friends DSH whale friends: see whether your fellow DSH users are online and whether their model is running a task. Signatures, mood, pokes, end-to-end encrypted, zero server. | low | low | not queued (low risk) | 0/0/10 | 0/0 | 2026-10-26 02:16 |
| @gitMFQ/dsh-terminal-keybar-dock Mobile touch key bar for the DSH Web terminal: docks Esc/Tab/Enter/Ctrl-C/Arrows along the bottom edge, and the terminal reserves the bar's band so the prompt stays visible. Rides the soft keyboard via visualViewport. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-10-26 02:16 |
| @LiGoHi/dsh-pet-mobile dsh-pet手机端补丁，打完后可以把大肥鱼留在手机桌面上，本项目由大肥鱼自行完成 | medium | medium | queued | 0/8/15 | 0/0 | 2026-10-26 02:16 |
| @S0ra233/DSH-game-translate DSH (`dsh`) 可视化本地游戏汉化插件 — 支持 Unity、RPG Maker、Ren'Py、Godot、WOLF、TyranoScript 六大引擎，提供原生玻璃窗口、双栏对照审校、多模型子 Agent 派发与 100% 读回安全写回。Visual game localization plugin for DSH. | low | low | not queued (low risk) | 0/0/2 | 0/0 | 2026-10-26 02:16 |
| @AirPineApplea/feiyu-chat-companion 给 DSH 的桌面桌宠：一只住在屏幕上的鲸鱼娘，会自己开口、能右键问一句。一句话 0.1 分。 | low | low | not queued (low risk) | 0/0/5 | 0/0 | 2026-10-26 02:16 |
| @qwq-wny/dsh-eta-forecast DSH Web 界面的「工作完成时间预测」挂件：按 todo 清单与步进节奏估算本轮还剩多久、几点完成，附进度条与样本置信度。 | medium | medium | queued | 0/7/19 | 0/0 | 2026-10-26 02:16 |
Dynamic audit results · new today (0 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
No completed dynamic audit conclusion for this day yet (queued or failed — see the table above).
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 23,461 in-scope entries (23,118 scanned + 343 pending).
Static scan for reference: low 22,953 · medium 0 · high 163 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
73 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-10-26. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2881 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published