2026-W33
发布于 2026-08-16
1650
已扫描
21
严重
105
需注意
876
低风险
本周变化
严重风险插件
共 21 个插件被评为严重——vet critical，或密钥 / 外传 / 破坏性 / 挖矿等阻断（blocking）模式
| 插件 | 是什么 | 风险 |
|---|---|---|
| dsh-cyber-sec ★ 2 | Authorized security-assessment profile for DeepSeek Harness: scoped network tools, container-backed shell, authorization guard, durable evidence, 21 security skills, 7 specialist subagents | 严重 |
| dsh-auto-approve ★ 15 | 为 DeepSeek Harness 增加介于 Workspace Write 与 Full access 之间的自动批准权限档，危险或不确定操作仍转人工审批。An auto-approval permission preset between workspace-write and full access for DeepSeek Harness. | 严重 |
| dsh-clawrouter ★ 21 | A safety gate for DeepSeek Harness: a stronger model reviews dangerous tool calls before they run. Plus vision and BlockRun's full model catalog from one wallet, paid per request over x402. | 严重 |
| dsh-remote-ide ★ 3 | Cloud workspaces for DeepSeek Harness — pick Cloud (SSH) in the workspace picker and the agent's bash/read/write/edit/glob/grep tools transparently run on your Linux server over SSH. Zero remote install. | 严重 |
| dsh-remote ★ 100 | Remote-work assistant for DeepSeek Harness (DSH): connect SSH (key or password), pick a remote workspace, operate with rw_* tools, and SFTP-mirror it into a real local DSH workspace. | 严重 |
| dsh-terminal-panel ★ 2 | A manual Terminal tab for the DeepSeek Harness (dsh) web UI — run commands on the host machine, persistent cwd, sudo password prompt, command history.现在可以在web界面内直接执行命令行了 | 严重 |
| dsh-security-scan ★ 0 | No description provided. | 严重 |
| openguardrails ★ 48 | The vendor-neutral protocol for AI agent safety & security — and the neutral benchmark that ranks the vendors. | 严重 |
| dsh-file-upload ★ 9 | DSH 拖拽文件转路径插件：Codex 式拖拽，路径自动插入输入框（Drop File to Path for DeepSeek Harness） | 严重 |
| dsh-desktop ★ 2 | Desktop shell for DeepSeek Harness Web GUI — auto-installs dsh, native macOS tray, packaged for macOS & Windows. | 严重 |
| DeepSeek-harness-wecom ★ 4 | WeCom AI Bot text and image bridge for DeepSeek Harness | 严重 |
| dsh-drop-file-to-path ★ 9 | DSH 拖拽文件转路径插件：Codex 式拖拽，路径自动插入输入框（Drop File to Path for DeepSeek Harness） | 严重 |
| DeepSeek-harness-lark ★ 3 | Feishu and Lark text and image channel plugin for DeepSeek Harness | 严重 |
| hesi-dsh-plugins ★ 3 | DeepSeek Harness (DSH) 插件 —— 圆桌讨论（Roundtable）与 一键执行流（Plan） Hesi 出品 · 同源实现 | 严重 |
| dsh-openclaw-acp ★ 1 | DeepSeek Harness bundle for OpenClaw and WeChat over ACP | 严重 |
| dsh-image-to-path ★ 2 | DSH 插件:让纯文本模型对话也能拖图/贴图——图片自动保存到会话工作区,以文件路径交给模型(多模态模型不受影响) | 严重 |
| zeromd ★ 34 | Obsidian 零成本同步：iPhone ↔ Mac，GitHub 自动备份。本地优先 + 长期积累。｜Local First. Zero-cost Obsidian sync across iPhone, Mac & GitHub. Let knowledge grow over time. | 严重 |
| dsh-design-skills ★ 22 | Design aesthetics skill pack for DeepSeek Harness (DSH) - keeps vibe-coded websites away from the AI look. 6 styles: dark-saas, apple-minimal, neo-neumorphism, brutalism, glassmorphism, japanese-minimal. | 严重 |
| DeepSeek-harness-qqbot ★ 6 | QQ Bot text and image channel plugin for DeepSeek Harness | 严重 |
| DeepSeek-Harness-linux- ★ 3 | 一个基于官方WebUI二改的Linux桌面端，内置了一个外挂视觉插件(需手动接入API Key)，已经迭代了四个版本，可能还是有些小毛病，不过目前用下来暂时没有什么大问题。 | 严重 |
| dsh-plugin-hub ★ 3 | Plugin Store for DeepSeek Harness (DSH): a graphical app-store inside the Harness Web UI — browse, search and one-click install GitHub dsh-plugins (topic:dsh-plugin / #dsh-plugin repos), with local ratings, dependency impact graphs, audit logging and a plugin scaffold guide. | 严重 |
需注意插件（中）
共 648 个插件被评为中——vet suspicious，或代码执行 / Shell 等旧“高”档命中
| 插件 | 是什么 | 风险 |
|---|---|---|
| dsh-hdc-bridge ★ 18 | DSH 原生鸿蒙开发助手：hdc 设备闭环调试 + 设备面板（官方 client 插件形态）+ 离线官方知识层（Tier-1 随包）+ DevEco CLI 构建/签名/模拟器控制 / DSH-native HarmonyOS dev assistant: hdc device loop, live device panel, offline official knowledge, DevEco CLI build/sign/emulator | 需注意 |
| DeepSeek-Harness-Desktop ★ 2 | dsh-desktop: DeepSeek Harness 桌面插件 - click-to-launch Codex-like native window over the live dsh web UI. Everything is a plugin - this one is the window. | 需注意 |
| DSH-Desktop ★ 21 | DSH-Desktop | 需注意 |
| dsh-wsl-workspace ★ 52 | WSL workspace support for DeepSeek Harness——无缝的 WSL 工作区使用体验，无需在 WSL 之中再安装一个dsh，安装该插件后在 GUI 里直接添加 WSL 工作区即可。WSL workspace support for DeepSeek Harness — Enjoy a seamless WSL workspace experience without needing to install dsh inside WSL. Once this plugin is installed, you can directly add a WSL workspace right from the GUI. | 需注意 |
| DSH-Plugin-Market ★ 3 | DeepSeek Harness 插件市场：精选目录 + GitHub 实时浏览、中英翻译搜索、安装前静态安全审计闸门。Plugin market for DeepSeek Harness with a pre-install security audit gate. | 需注意 |
| whale-notify ★ 6 | 鲸鱼通知——基于DeepSeek Harness的通知和鲸鱼娘人设插件 | 需注意 |
| deepseek-harness-desktop ★ 99 | DeepSeek Harness Codex Desktop — 无需预装环境、开箱即用的跨平台桌面客户端 · A ready-to-use cross-platform DeepSeek Harness desktop client with no environment setup | 需注意 |
| dsh-search-boost ★ 16 | The plunge for dsh to boost model's search ability. | 需注意 |
| DSH-Plugins-Marketplace ★ 168 | DSH插件市场 / DSH Plugin Marketplace: 在 DeepSeek Harness Web GUI 中一键浏览、安装与更新 GitHub topic:dsh-plugin 的全部插件 | browse, install & update all GitHub dsh-plugin plugins in the DSH Web GUI | 需注意 |
| dsh-remote-tunnel ★ 5 | Remote Host Tunnel Manager for dsh: remote port allocation + registry + resilient SSH tunnel | 需注意 |
| dsh-prompt-enhancer ★ 76 | DeepSeek Harness (DSH) 插件：✨ 提示词一键增强 + 💬 语音识别（说完自动停·云端/本地双引擎）· 附 🔁 服务异常一键重启 | 需注意 |
| dsh-toy ★ 66 | Toy Control Protocol for DSH | 需注意 |
| dsh-side-panel ★ 15 | DSH 侧边栏，集成文件浏览器、终端和 Git 审查，方便预览文件。 | 需注意 |
| DSH_plugins_4U ★ 1 | DSH 自建插件集合：微信桥接器 + GUI 微信入口补丁，一键安装 | 需注意 |
| dsh-desktop ★ 92 | 一款主打安全且更尊重开发者的开源 DeepSeek Harness 桌面客户端。官方 Web UI ，长任务常驻托盘，支持通知推送；内置安全市场，600+精选插件支持先审查、再安装。 | 需注意 |
| dsh-sentinel ★ 16 | Condition-driven wakeup for DeepSeek Harness: durable file/command/http/process/webhook watches that wake the agent, with dock, sidebar branch, and a global dashboard. | 需注意 |
| dsh-ankh-guard ★ 6 | dsh 自托管运维守护：agent 改完代码先验证构建测试再重启，起不来自动回滚。镜像仓，与 Khorsheed/dsh-plugins 的 packages/ankh-guard 自动同步。 | 需注意 |
| dsh-plugin-workshop ★ 24 | Steam Workshop-style plugin browser for the DeepSeek Harness (DSH) Web UI - zero-server: GitHub-powered search, trending windows, Chinese search & bilingual translation, plugin-signature filtering, and smart one-click install/update/uninstall with an installed-plugins manager. | 需注意 |
| dsh-desktop-tools ★ 1 | DeepSeek Harness 工具集导航:Web 插件集(dsh-web-plugins)/ Windows 桌面端(dsh-desktop-app)/ AI 知识库模板(ai-knowledge-base) | 需注意 |
| dsh-plugin-verify ★ 1 | 验证 DSH 插件的 CLI：一条命令跑 mock-llm 完整 agent 循环，检查 waterfall 链与零副作用，产出验证报告 | 需注意 |
展示最需要关注的 20 个（按严重发现排序）。
自动启发式扫描（静态分析）——规模化的第一道风险防线，可能存在误报；不是人工审核。
历史周报归档
8 期这份周报衡量什么？
本报告衡量 2026-W33 期间 dsh.so 插件市场的自动静态扫描状态：已扫描插件数量、低 / 中 / 严重三档风险分布，以及自上一期归档以来风险档位发生变化的插件。
为什么这不是背书？
报告里的每一行都来自公开仓库元数据与启发式规则命中，而非人工审计或运行时验证。误报与漏报都有可能，因此风险标记是一个在安装前检查插件的理由，而不是检查的替代品。
来源：dsh.so 安全标准 · 维护：dsh.so · 发布于