Daily security scan
Date · 2026-11-04 (UTC — plugins first indexed that day)
Effective tier · new today
dynamic first · this report0 of 4 new entries take their tier from a dynamic audit conclusion; the rest use the static scan tier. Where a conclusion exists it is authoritative (it may raise or lower the tier).
Static scan · new today
rule heuristics · fallbackTier = scan verdict: critical hit → critical; warning / non-blocking critical → high / medium; none → low. Used only when no dynamic conclusion exists.
Dynamic audit · subset of new today
model reads source · no executionTier = highest finding. Of 4 new entries: 0 with a conclusion, 2 queued, 0 failed (no conclusion), 2 low-risk not queued.
Data file updated 2026-11-05 07:30 (UTC+8)
| Plugin | Effective | Static | Dynamic | Findings C/W/I | Manifest | Indexed |
|---|---|---|---|---|---|---|
| @lijiaqi-AI-Product-Manager/dsh-agent-compare 同一需求，两版真跑，体验后审查采用。Two live builds for one task in DSH. | low | low | not queued (low risk) | 0/0/0 | 0/0 | 2026-11-04 02:36 |
| @Ravi666688/dsh-screen-glow 为 DSH 加的屏幕边缘光：模型接管鼠标键盘时亮蓝光、提问时琥珀、等你批准时红色，并在屏幕中上方显示「正在做什么」。含设置页、看门狗与自检 CLI。 | medium | medium | queued | 0/1/15 | 0/0 | 2026-11-04 03:50 |
| @hxlog/dsh-skills-tools DSH 的 Skills 管理器：从 Git 仓库导入技能，按仓库分组管理，随时启用、停用、补齐与查看内容。 | medium | medium | queued | 0/5/4 | 0/0 | 2026-11-04 05:10 |
| @elims777/dsh-languages 14 community translations for the DSH web UI: ru, es, pt-BR, de, fr, it, pl, tr, ja, ko, zh-TW, id, vi, hi | low | low | not queued (low risk) | 0/0/3 | 0/0 | 2026-11-04 14:37 |
Dynamic audit results · new today (0 with a conclusion)
The model reads redacted source context and never executes plugin code. When a dynamic conclusion exists it is authoritative (it may raise or lower the level); otherwise the static tier applies. The audit never writes the exemption list.
No completed dynamic audit conclusion for this day yet (queued or failed — see the table above).
Site-wide effective tiers (dynamic first)
Dynamic conclusions set the tier where they exist; the static scan applies only where there is none. 25,429 in-scope entries (25,112 scanned + 317 pending).
Static scan for reference: low 24,931 · medium 0 · high 180 · critical 0 (dynamic conclusions moved these into the effective tiers above).
Critical-tier plugins (18)
Static heuristics + semantic manifest audit + a model-driven dynamic audit — not a full security audit; no code execution, no dependency resolution. Dynamic tiers come from the model reading source context (highest finding) and never exempt a static finding.
Daily report archive
80 reportsWhat does this daily report cover?
This report covers plugins first indexed by dsh.so on 2026-11-04. For each new plugin it records the name, risk tier, scan verdict, critical/warning/info findings, manifest audit signals, and index time. Plugins that were already in the registry before that date are not included.
How are the risk tiers assigned?
Risk tiers follow the same public model used across the site: four levels — critical / high / medium / low — read from finding counts, most severe first. Critical is reserved for secrets, exfiltration, destructive commands, or mining; a high-severity finding without a critical one reads high; medium (warning-level) findings read medium (needs review); no meaningful findings reads low. Where the model-driven dynamic security audit has a conclusion, that conclusion sets the tier (it can raise or lower it); the static scan tier (vet primary, dsh backstop) applies only when there is no conclusion.
Why is this not a full security audit?
The daily scan is a static heuristic scan plus manifest audit. It does not execute code or resolve dependencies, so it cannot prove that a plugin is safe. Use the report to prioritize inspection, not to replace it.
What does the "Manifest" column mean?
Manifest here is the vet engine's semantic analysis of the plugin's JSON manifest — not the dynamic security audit. It flags declaration-level signals such as install scripts, lifecycle hooks and broad file or network permissions.
Is the static scan the only layer?
No. A second, model-driven dynamic security audit runs on top of it for entries the static scan already flags as needing review: it reads source context without executing plugin code, covers that subset only, and its conclusion is authoritative when there is one — it can raise a verdict or lower it; the static scan tier (vet primary, dsh backstop) applies only when there is no dynamic conclusion. Exemptions stay manual and the script never writes the suppression list. This daily report shows both layers: every new entry is marked with its dynamic state (conclusion / queued / failed / out of the queue because it is low risk), and all conclusions of the day are listed below with their tier, model summary and findings. As of the latest run: 2899 dynamic audit records, 2294 with a model conclusion, 323 stricter than the static verdict, 790 softer.
Source: dsh.so security standards · Maintained by dsh.so · Published