2026-W36
发布于 2026-08-30
11892
已扫描
9
严重
882
需注意
10892
低风险
严重风险插件
共 9 个插件被评为严重——vet critical，或密钥 / 外传 / 破坏性 / 挖矿等阻断（blocking）模式
| 插件 | 是什么 | 风险 |
|---|---|---|
| dsh-plugin-security-review ★ 2 | DSH 动态 Cordis 插件安装安全审查守卫 (DeepSeek Harness plugin install security review gate, security-first) | 严重 |
| dsh-qrcode-hassle-free ★ 1 | DSH plugin bundle: scan a QR to open the deepseek-harness web UI on your phone inside the same session - cloudflared quick tunnel, no database, Windows/macOS/Linux | 严重 |
| dsh-lmstudio-router ★ 0 | Local LM Studio model router for the dsh web GUI: routes token-expensive bulk tasks (text work, compaction, session titles) to a local LM Studio model over its OpenAI-compatible /v1 endpoint, auto-launches LM Studio, and fits requests into the model context window. Zero-dependency host plugin. | 严重 |
| dsh-file-viewer ★ 3 | A universal file preview layer for DeepSeek Harness: open and inspect files right inside the web UI — no external application needed. | 严重 |
| DSH_VsCodeMode ★ 3 | deepseek-harness | 严重 |
| dsh-report-studio ★ 2 | Turn a DeepSeek Harness session into deliverable work reports (daily/weekly/handoff/article) with verifiable receipts | 严重 |
| dsh-themes ★ 2 | — | 严重 |
| plugin-manager ★ 1 | — | 严重 |
| dsh-tool-plus ★ 0 | DeepSeek Harness 基础工具增强：持久 bash、结构化 read、多模式 edit、原子 write、双引擎 grep/glob、图像直读，一个插件全覆盖 | 严重 |
需注意插件（中）
共 882 个插件被评为中——vet suspicious，或代码执行 / Shell 等旧“高”档命中
| 插件 | 是什么 | 风险 |
|---|---|---|
| dsh-web-open ★ 0 | DSH Desktop embedded browser: open_url tool opens webpages in an in-window browser (tabs, favicons, smart zoom, search engine settings). One-click installer. | 需注意 |
| dsh-doctor ★ 2 | DeepSeek Harness environment diagnostic tool: dsh_doctor checks env, profile, config, bundles, mount, port, health, and disk | 需注意 |
| DeepSeek-Harness-Desktop ★ 7 | 一个 Electron 桌面壳，内嵌官方 DeepSeek Harness Web UI。启动时让用户选择安装模式，自动完成环境检测、安装、服务拉起，以百分比进度条展示各阶段，服务就绪后打开主界面。 | 需注意 |
| dsh-deepseek-web-adapter ★ 4 | 免费的 DeepSeek 网页版（chat.deepseek.com）LLM 服务提供方，用于 DeepSeek Harness——无需 API 密钥。自动启动网关，支持工具调用和连续对话。Free DeepSeek Web (chat.deepseek.com) LLM provider for DeepSeek Harness — no API key. Auto-launches gateway, tool calling, continuous chat. | 需注意 |
| dsh-flowglass ★ 12 | Dynamic Cordis plugin toolbox for DeepSeek Harness — 1 framework + 28 tools, hot-reload from disk. | 需注意 |
| dsh-wallpaper-bridge ★ 1 | Wallpaper Engine bridge for DeepSeek Harness (DSH) on Windows | 需注意 |
| dsh-plugin-gate ★ 1 | Installation safety gate for DeepSeek Harness plugins: antivirus-style scanner for install scripts, permissions, secrets and network callbacks (BLOCK/WARN/PASS). | 需注意 |
| dsh-raw-html ★ 16 | VCP visual-synesthesia protocol plugin for DeepSeek Harness: render agent HTML output as real UI (cards / KaTeX math / Mermaid diagrams / built-in calligraphy fonts / zero-JS interactions), plug-and-play on any DSH environment | 需注意 |
| dsh-vscode ★ 5 | DeepSeek Harness for VS Code: right-side chat agent that reads, edits, and runs your project — like Claude Code / Codex / Copilot. | 需注意 |
| dsh-remote-access ★ 0 | — | 需注意 |
| dsh-pet-remielle ★ 32 | — | 需注意 |
| dsh-desktop-electron ★ 5 | Cross-platform Electron desktop shell for the DSH Web GUI: tray-resident standalone window over your own dsh web, no bundled Node runtime | 需注意 |
| DSH-Desktop ★ 0 | Electron desktop shell for DeepSeek Harness, bundling node, pnpm, and the DSH runtime for one-click access to the dsh web UI. | 需注意 |
| dsh-vision ★ 8 | Vision for DeepSeek Harness: Doubao Web by default (zero-cost, no API key), Antigravity IDE quota (flash/pro), any IDE CLI, Gemini — auto detail escalation, evidence memory | 需注意 |
| crossplug ★ 1 | crossplug — AI coding-agent plugin bridge: convert plugins between DSH / MiniMax Code (mcode) / pi, agent-plugins.org 1.0.0 packages, pi extensions; dual-side installers | 需注意 |
| dsh-web-launcher ★ 1 | — | 需注意 |
| dsh-reasonix-desktop ★ 2 | — | 需注意 |
| dsh-sim-restart ★ 0 | Simulated-restart testing for DeepSeek Harness plugins: verifies plugins survive restart (module eval → apply → smoke → dispose) in isolated subprocesses, with a resident auto-watcher and agent feedback loop | 需注意 |
| DeepSeek-Harness-Desktop ★ 3 | dsh-desktop: DeepSeek Harness 桌面插件 - click-to-launch Codex-like native window over the live dsh web UI. Everything is a plugin - this one is the window. | 需注意 |
| dsh-guide-dog ★ 5 | Guide Dog for DSH — MiniMax multimodal plugin: image/video/music/speech generation & vision tools, hard-metric voice mode (host event-driven auto TTS, session-safe playback), voice input (mic → faster-whisper → composer), recorder page, two-layer settings. | 需注意 |
展示最需要关注的 20 个（按严重发现排序）。
自动启发式扫描——可能存在误报。非人工审核，绝非背书。
历史周报归档
4 期这份周报衡量什么？
本报告衡量 2026-W36 期间 dsh.so 插件注册表的自动静态扫描状态：已扫描插件数量、低 / 中 / 严重三档风险分布，以及自上一期归档以来风险档位发生变化的插件。
为什么这不是背书？
报告里的每一行都来自公开仓库元数据与启发式规则命中，而非人工审计或运行时验证。误报与漏报都有可能，因此风险标记是一个在安装前检查插件的理由，而不是检查的替代品。
来源：dsh.so 安全标准 · 维护：dsh.so · 发布于