每日安全扫描日报
日期 · 2026-09-10 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
96
当日新增
1
严重
17
需注意
78
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| dsh-tts-flash 给 DSH 的语音朗读插件：AI 回复流式 TTS 朗读，思考等待期还有趣味语音短语反馈。Edge TTS 开箱即用，支持任意 OpenAI 兼容云端引擎。 | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-10 00:13 |
| plugin-effort-slider Notched reasoning-effort slider grouped with the model picker for DSH — native styling, themeable, i18n | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 00:13 |
| dsh-link-collect DSH bundle（DSH 插件）：链接收藏 —— 把收藏的链接（标题/简介/图标/标签/正文）持久化为本地 Markdown 收藏夹，带 Web 侧栏页面。 | 需注意 | warn | 0/5/21 | 0/0 | 2026-09-10 02:13 |
| dsh-plugin-proxy-env DSH plugin: inject proxy environment variables at startup and self-check the whole proxy chain | 需注意 | warn | 0/2/13 | 0/0 | 2026-09-10 02:13 |
| dsh-claude-compat DSH 插件，兼容claude的skill、rules加载规则，mcp配置 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-10 02:13 |
| dsh-steer | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 04:13 |
| dsh-loop-continue | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-memorix-panel Memorix memory panel for the DSH Web GUI: browse every project and memory, read full details, archive/restore and create memories — writes go through the official memorix CLI. | 需注意 | warn | 0/1/4 | 0/0 | 2026-09-10 04:13 |
| dsh-web-auth | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-10 04:13 |
| dsh-agent-bridge 飞书机器人 → DSH 会话桥：在指定工作区开真会话，用 DSH 现有模型+插件执行任务并回传结论 — DSH bundle。 | 需注意 | warn | 0/2/3 | 0/0 | 2026-09-10 04:13 |
| dsh-unitverse Unit conversion plugin for DSH: one `convert` tool plus a locale-aware Web view, covering 10 categories (length, area, volume, time, angle, speed, temperature, pressure, energy/heat, power) with 80+ units. 单位换算 DSH 插件：十大类 80+ 单位，convert 工具与 Web 视图均支持中英文。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-10 04:13 |
| dsh-plugin-forge 插件工坊：在任意工作区按 dph 格式快速脚手架 DSH 本地插件，并维护踩坑经验库持续修正开发 — DSH bundle。 | 需注意 | warn | 0/6/2 | 0/0 | 2026-09-10 04:13 |
| dsh-notes DSH bundle（DSH 插件）：笔记 —— 按目录分组的本地 Markdown 笔记，带 Web 侧栏页面，读取根/分组下的 AGENTS 等规则 md 作为写作上下文。 | 需注意 | warn | 0/2/15 | 0/0 | 2026-09-10 04:13 |
| dsh-sysbrief 系统理解简报工作流：解析 PRD/PDF、分批追问澄清目标系统并沉淀 BRIEF.md，最终打包可上传交付物 — DSH bundle。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-es DSH 使用 Everything(es.exe) 工具进行 NTFS 全盘搜索，使用 POSIX 风格路径进行交互，兼容 MSYS(git bash) 路径。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-agent-group-panel 飞书多助手机器人控制台：开启/关闭/重连守护进程、状态与最近动态、直达任务工作区 — DSH bundle。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-10 04:13 |
| tolten-image-attach Attach an image to the DSH composer and the session model switches itself to a vision model — then restores your previous model when the image is removed. Material Design 3 button, native file picker, thumbnails. MIT. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-agnes-media | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-10 04:13 |
| dsh-gpt-image 控制已登录的网页版 ChatGPT 生成图片并下载到本地 — DSH bundle 插件。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 04:13 |
| dsh-tidewatch DSH 动态插件：悬浮面板显示 DeepSeek API 高峰/低谷时段、倒计时与账户余额 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 04:13 |
| dsh-preset-md 给 DSH 助手赋予人格、灵魂与长期记忆：用 Markdown 定义伙伴的身份、性格、准则与记忆，自动写日记、自动更新记忆。Give your DSH assistant a soul, personality, and long-term memory. | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-10 04:13 |
| dsh-lexiforge DSH 语言模组（LangPack）框架插件：以 ZIP 配置包提供 A/B/C 三种处理引擎与复合管线、术语检索增强、流拦截与安全安装机制，内置市场分发与风险免责闸门。LexiForge is a community LangPack framework plugin for DSH. | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-10 06:13 |
| dsh-process-panel dsh 侧栏「进程任务」面板：启动/停止/重启长时后台进程 + 实时日志，AI 侧配 sv_* 工具。A process panel plugin for DSH. | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-10 06:13 |
| dsh-files-pane In-browser files pane for the DSH Web GUI: a Session View tab that browses the host's files and reads them in place. · DSH 网页「文件」视图标签：两栏目录导航 + 就地阅读文件 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-10 08:13 |
| dsh-stack Enforced safety rails for stacked PRs in DSH — every sync, land, and cleanup is guarded, and "tests passed" is proven per commit with SHA-bound validation records. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-10 08:13 |
| dsh-session-kit Manage DSH conversations from inside a conversation: new_conversation, rename_session, list_sessions, read_session, archive_session model tools plus official-slot UI actions | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-10 08:13 |
| dsh-zhouli 《周礼》插件：给 DSH 提供带稳定坐标（篇序.职官序）的全文检索工具，含职官员额／职掌索引与 Kanripo 两本互校勘记，并附一套依六官法度行事的 agent 预设。引文可核，不凭记忆。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-plugin-tokensmarket Token Market provider bundle for DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-totp 为 DSH 加一道由你掌控的访问验证。An access-verification step for DSH, under your control. | 需注意 | warn | 0/1/13 | 0/0 | 2026-09-10 08:13 |
| dsh-plugins Personal dsh plugins for the DSH web profile (agent-monitor, quick-notes) | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-10 08:13 |
| dsh_BetterInput | 需注意 | warn | 0/3/14 | 0/0 | 2026-09-10 08:13 |
| dsh-token-usage 实时 Token 用量仪表盘 · Real-time token usage dashboard for DSH — live totals, filters by model/day/month/project, smooth trend chart. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-10 08:13 |
| dsh_plugin 用Harmess搞的自用插件合集 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-10 08:13 |
| dsh-plugin-preset-default-guard Repairs a stale agent-presets.default so New Session stops failing silently after a preset rename (DSH plugin). | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-pr-watch DSH plugin: reports what changed in your authored pull requests since your last check — merged, closed, or gone stale. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 08:13 |
| dsh-tps-meter 一款搭配 DSH 客户端的悬浮窗小工具，实时监测并显示会话的实时与平均 Token 输出速率（tokens/s） | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-10 08:13 |
| dsh-keyless-search 免 API key 的多引擎搜索 provider for DSH (ctx.web)：真实浏览器 Google + 国际版 Bing + 中文 Bing，带代理自动探测、语言感知与浏览器空闲回收 | 需注意 | warn | 0/1/4 | 0/0 | 2026-09-10 10:13 |
| dsh-effort-slider 为 DSH 添加支持 Off、Low、High、Max 档位的可拖动推理强度滑块。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-wecom DSH plugin: WeCom (WeChat Work) smart-robot integration over the long-connection (WebSocket) API. Per-session agents, idempotent msgid dedup, stream/markdown replies, media download/upload, whitelist, welcome/feedback events. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-10 10:13 |
| dsh-auto-continue dsh plugin: auto-continue after quota/rate-limit reset + peak/valley idle-task suspend/resume, with composer toggles and a status line. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 10:13 |
| dsh-prompt-refine DSH 提示词优化插件 —— 发送前点一下 ✨,模型结合上下文给出「补丁式」建议,勾选回填,不抢发送权。 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-10 10:13 |
| dsh-fork-relink DSH fork 伴随插件:fork 后自动重链子 agent 记录到新会话 / Auto-relink subagent records to a forked DSH session. Co-developed with AI. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-10 10:13 |
| dsh-plugin-gpt-load DSH plugin: serve every gpt-load model from one provider group, each model on its own wire protocol (OpenAI Chat Completions or Anthropic Messages), synced from /api/models | 需注意 | warn | 0/4/7 | 0/0 | 2026-09-10 10:13 |
| dsh-update-status Read-only DSH Web version status and release-channel guidance plugin | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-upgrade-guard DSH 升级安全网：宿主升级后自动巡检插件兼容性，支持修复/禁用；宿主启动失败时由宿主外 supervisor 自动救援或回滚到上一个宿主版本。 | 需注意 | warn | 0/2/9 | 0/0 | 2026-09-10 10:13 |
| dsh-rollback TRAE-style conversation rollback plugin for DSH | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-10 10:13 |
| dsh-quick-replies dsh-quick-replies | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 10:13 |
| dsh-chat-interaction Abstract interaction layer between DSH and IM platforms (Feishu, WeCom, ...). Channel-agnostic hub with proven interaction patterns (dedupe, instant ack, wait-reply, followup wakeup, scoring-based model routing, approval gate) plus pluggable adapters for Feishu and WeCom. | 需注意 | warn | 0/7/1 | 0/0 | 2026-09-10 10:13 |
| dsh-tweaks 让 DSH更顺手的一套小改动：prompt-history / model-capabilities / turn-file-revert 三个独立插件 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 10:13 |
| dsh-cooldown-retry Patient auto-retry for DSH — reads the retry delay out of an upstream 429 capacity-cooldown message and waits it out, instead of giving up after two fast retries. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-sidebar-image-zoom dsh plugin: zoomable, pannable image preview for the right-sidebar document pane (wheel zoom anchored at cursor, drag pan, fit / 1:1). / dsh 右侧边栏图片预览缩放插件 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-zen-spoof | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-10 12:13 |
| dsh-session-pilot Pilot your DSH conversations from inside a conversation: new_conversation, rename_session, list_sessions, read_session, archive_session model tools plus official-slot UI actions | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-10 12:13 |
| dsh-price-monitor Session cost monitor for DSH — a dsh-better-sidebar tab (that sidebar is required; this package ships no UI of its own) showing per-turn, per-attempt token cost priced by official or manual plans | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| cordis-plugin-graph DSH/Cordis Web plugin: a zoomable relation graph of every loaded plugin (dependencies, resolved providers, Loader-tree nesting) as a Settings tab next to 'Plugin list'. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| moqian-dsh-plugin-list DSH插件清单：收录 9 个开源 dsh-plugin —— 工具安全守卫、实时日志转发、会话复盘导出、Obsidian 长期记忆、学术文献检索、TODO 扫描、桌面通知提醒、飞花令、热梗弹幕。附仓库地址、npm 包名与安装命令。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-ssh-workspace-manager DSH web plugin: SSH hosts, workspace bindings, remote exec/sync/compose | 严重 | fail | 1/0/1 | 0/0 | 2026-09-10 12:13 |
| dsh-wei-sitecontrol Site controller for DSH: register websites/HTTP services and manage their lifecycle, git, and release-based SSH deploys — with server probing, stored deploy scripts, rollback and scheduled publishing. | 需注意 | warn | 4/15/16 | 0/0 | 2026-09-10 12:13 |
| dsh-archived-sessions DSH 设置面板新增「已归档会话」页：列出全部已归档会话并一键恢复。Settings page listing archived sessions with one-click restore. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 12:13 |
| dsh-brand 方便魔改作者轻量化自定义商标 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-10 12:13 |
| dsh-peak-balance Peak/off-peak billing clock with live DeepSeek balance and per-turn cost above the dsh-tui prompt, plus an optional flashing peak-hour warning frame. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-10 12:13 |
| DSH-runner-rlm-tools-bsl Плагин DSH: MCP-сервер rlm-tools-bsl (анализ кода 1С) запускается и останавливается вместе с DSH | 需注意 | warn | 0/4/7 | 0/0 | 2026-09-10 12:13 |
| dsh-code-security | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-10 13:14 |
| dsh-resume-turn DSH 断点续接插件：模型回复因网络中断/超时半途失败时，自动把已生成的部分输出带进下一轮，让模型从中断处继续，而不是从零全量重跑。DSH plugin: on a mid-stream network failure, auto-resume the turn from its partial output instead of restarting from scratch. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-llm-opencode-go OpenCode Go models as a DSH provider, with session-affinity headers, a live model catalog, and a Web settings card | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| vision-exp-tile DSH插件：800×800 无损切块 + 坐标标注 + 直连 DeepSeek 视觉 API 识别聚合，专治大图看不清 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-theme-inkstone | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-cost-pill DSH web plugin: session API cost + account balance, as a pill merged into the official composer stats row (费用 · 余额 · 缓存命中). | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| DSH-Metafolder-Plugin DSH Metafolder Plugin — visual meta-folders for the DSH sidebar workspaces, with drag and drop. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-notifications Desktop notifications and chimes for DSH Web | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-remote-dsh DSH plugin: a sidebar tab that takes over the whole page with another DSH instance's Web GUI, plus a remote session-state badge. 在侧边栏顶部加一个「远程」标签，整页切到另一台主机上的 DSH。 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-tradewatcher DSH web plugin: 盯盘 market-dashboard sidebar tab — three quote strips with hover intraday charts, watchlist with industry alpha, ledger-driven portfolio P&L, A-share boards & detail drawer, host-side Eastmoney relay + read-only agent tools. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-update-audit Read-only update auditing for DSH profile plugins | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-markitdown Microsoft MarkItDown as a DSH tool: convert PDF, Word, Excel, PowerPoint, HTML, CSV, EPUB, or a URL into Markdown the model can read. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-chat-avatar 轻量级DSH聊天头像插件 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-upgrade-rc1 Version-locked upgrade corridor for DSH plugins: dsh-v0.1.5-alpha.1 -> dsh-v0.1.5-rc.1 (card + skill + zero-dependency scanner) | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-autostart Windows 专用 DSH 插件:一键开机自启 + 一键重启 DSH 服务,全程无控制台窗口 | Windows-only DSH plugin for boot autostart and one-click restart | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-skills-anywhere Your skills, anywhere. Live Agent Skills provider for DSH: every agent's skill dirs (Claude Code, Codex, Cursor, 60+ more), Claude Code plugin marketplaces, and any GitHub skill repo. Zero copies, zero symlinks. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugin-ops DSH plugin operations: pre-boot health gate, failure attribution, dependency governance, and a web panel — the startup-lifecycle guard for the dsh plugin ecosystem. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-plugins-store DSH plugin store - archived copies of the plugins installed in the local web profile, with manifest and profile snapshot | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 14:13 |
| dsh-web-whale-maid DSH Web plugin — Anime maid whale desktop pet with satiety system and real-time LLM interaction | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-model-tester DSH plugin: one-click model availability testing (available / TPS / first token / elapsed) in the Models settings page | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-cursor-agent 在DeepSeek Hareness中引入Cursor Hareness，获得和Cursor一致的速度与体验。非官方调用cursor api，可能引入账号风险，谨慎使用。 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-delete-chat | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-kaomoji Add Japanese kaomoji to DSH replies; prompt-injection plugin with a curated kaomojiya.org library. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-git-update-notifier 每天首次启动 dsh 时用 git 检测上游提交并在 Web GUI 中询问是否更新（适配源码 checkout，不改 npm 依赖） | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-vae-theme 《庐州月 · 许嵩》— DSH 国风水墨主题插件 | 夜色水墨长卷 · 金丝九宫格边框 · VAE 书法标志 · 全屏雨幕 · 国风歌词竖排轮播 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-context-assembler Assembled context for DSH: a context tree over the session surface with per-node assemble modes (full / key / off), agent-authored presets, and a panel that decides what the model actually sees. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-file-explorer Workspace file explorer docked in the DSH sidebar — lazy file tree, Settings toggle, drag-to-resize. Also shipped as a single-session Cordis dynamic plugin. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-cost-meter Session spend for the DSH Web client: a stats-line pill that prices the durable tokenUsage projection with user-configured per-bucket unit prices. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-adrian-agents-group-work Group work for the DSH: turn one session into a room with a chair and several member agents that message each other and share a task list. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-image-studio Inline image card for DSH conversations: a bottom-left edit button that annotates, erases through a generated RGBA mask, and crops or resizes, then hands the edit back to the agent. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-memory-plus | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-paperlens | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-villager-hmm Play a Minecraft villager hmm whenever the model hums inside its reasoning chain. DSH plugin. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
| dsh-remote-workspace Remote workspaces for DSH: run the agent on your server over SSH stdio. Zero file mirroring. | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-10 16:11 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
26 期2026-09-10当前96 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-10 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于