每日安全扫描日报
日期 · 2026-09-11 (UTC,覆盖当日 00:00–24:00 新增入库的插件)
31
当日新增
0
严重
12
需注意
19
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| dsh-mcp-lazy Lazy MCP gateway for DSH: one stable proxy tool instead of N tool schemas, servers connect on first use and idle out, metadata cached to disk. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-11 00:14 |
| dsh-backup-migrator Plugin environment backup and migration for DSH | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-11 00:14 |
| dsh-skill-recommender Session-profile skill recommender for DSH | 需注意 | warn | 0/1/9 | 0/0 | 2026-09-11 00:14 |
| dsh-aliyun-mcp Alibaba Cloud OpenAPI MCP connection for DSH | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-11 00:14 |
| dsh-goofish-mcp Xianyu (Goofish) read-only monitoring MCP for DSH | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-11 00:14 |
| dsh-feishu-mcp Feishu (Lark) OpenAPI MCP connection for DSH | 需注意 | warn | 0/3/10 | 0/0 | 2026-09-11 00:14 |
| dsh-zsxq Knowledge Planet (zsxq) integration for DSH | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-11 00:14 |
| dsh-plugins Independent DSH plugins: cost metrics + browser_use tool. One pnpm monorepo, independently installable and vendable. | 需注意 | warn | 0/1/11 | 0/0 | 2026-09-11 00:14 |
| dsh-npm NPM registry management for DSH | 需注意 | warn | 0/3/8 | 0/0 | 2026-09-11 00:14 |
| QQ.dsh-qqbot 基于DSH-QQBOT项目的dsh-qqbotGPT优化版本 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 00:14 |
| dsh-wallpaper-position dsh-dream-skin satellite: per-image wallpaper position (X/Y px) settings row. Vibe-coded. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-11 02:13 |
| dsh-whale-tools dsh-whale-widget satellite: replace the whale mascot with any image (auto cutout) + restart button + heartbeat. Vibe-coded. | 需注意 | warn | 0/5/8 | 0/0 | 2026-09-11 02:13 |
| dsh-local-dba A local database-administration (DBA) plugin for [DSH](https://github.com/deepseek-ai/deepseek-harness). It ships as a Cordis plugin bundle that registers a set of `db_*` model-facing tools, letting the agent query, inspect schema, run DDL/DML, back up/restore and analyze slow queries against **MySQL / MariaDB** and **PostgreSQL**. | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-11 02:13 |
| dsh-sakurafrp dsh-mobile satellite: manage the SakuraFrp phone-desktop link from DSH UI (status, gateway toggle, pairing QR, devices, self-heal). Vibe-coded. | 需注意 | warn | 0/9/15 | 0/0 | 2026-09-11 02:13 |
| dsh-imagegen-zhenzhen DSH image-generation plugin with native support for zhenzhen-image style async task gateways (submit + poll), including multi-reference image-to-image. Fork of @dickpy/dsh-imagegen. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-11 02:13 |
| dsh-newwindows ⚡ Summary-free context window rollover, model-authored notes, and scoped history lookup plugin for DSH. Inspired by OpenAI Codex. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 02:13 |
| dsh-provider-headers Per-provider request headers in the DSH Models settings page, with per-conversation ${sessionId} expansion. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-11 02:13 |
| dsh-reveal-fix Fix DSH's "reveal in file manager" silently doing nothing on Windows. User-space plugin — survives dsh upgrades, no core files patched. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-11 02:13 |
| dsh-task-board DSH Web GUI 的任务看板插件:侧边栏入口 + 五列看板,任务经 DSH 会话真实执行,host 端持久化并跨设备实时同步。Task board plugin for the DSH web GUI. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 02:13 |
| dsh_superpowers Superpowers for the DSH: a dsh plugin that registers the Superpowers skills as a skill catalog and injects the using-superpowers bootstrap into the system prompt. | 需注意 | warn | 0/5/13 | 0/0 | 2026-09-11 02:13 |
| dsh-find-plugin Find DSH plugins from inside the agent - live GitHub dsh-plugin topic search + the curated awesome-dsh-plugin list, with token auth, rate-limit resilience and offline fallback. Fork of awesome-dsh-plugin/dsh-find-plugin. | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-desk DSH 插件管家:用人话说明每个插件是做什么的,一键停用/启用(热生效),安全卸载。Settings → Plugins → 插件管家 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-11 04:13 |
| dsh-livebench-panel DSH web plugin: a LiveBench tab in the Trajectory view. Run LiveBench evaluations against every model configured in the DSH and read scores in place. | 需注意 | warn | 0/3/6 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-use-images 再dsh里面可以使用图片api | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-11 04:13 |
| dsh-loomy-connect Use the models that ship with the Loomy desktop app inside DSH — no API key. Also adds a Settings card showing the signed-in account and Loomy credits (permanent + daily gift). | 需注意 | warn | 0/3/16 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-reasoning-efforts 给 DSH 的第三方中转模型补上「推理等级」选择器 —— 和官方模型在聊天框里的体验完全一致。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| dsh-bg-new DSH 网页界面换背景:侧栏「壁纸」按钮弹出右侧抽屉,支持系统预设/纯色/渐变/图片/视频,滚轮+拖动小图同时管缩放与定位,毛玻璃质感,本地媒体伺服不走云端。DSH web background & wallpaper plugin with drawer UI, glassmorphism and local media serving. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-11 04:13 |
| dsh-clipboard-menu Adds a right-click cut/copy/paste/select-all menu to DSH composer inputs. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-11 04:13 |
| dsh-research-kit dsh-research-kit 是一个 浏览器侧 DSH 插件:它维护科研资源目录、把工作流和用户参数组装成可编辑 Prompt,并由 DSH 当前会话负责实际发送与执行。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| dsh-plugin-session-delete 删除dsh的会话内容 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-11 04:13 |
| ai-memory Personal AI memory semantic layer SDK (Rust + SQLite) — short/mid/long-term memory with hybrid recall | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-11 04:13 |
静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。
历史日报归档
27 期2026-09-11当前31 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么?
这份日报覆盖 2026-09-11 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。
风险等级是如何划分的?
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计?
日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。
来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于