每日安全扫描日报

日期 · 2026-09-11 (UTC,覆盖当日 00:00–24:00 新增入库的插件)

31
当日新增
0
严重
12
需注意
19
低风险
插件风险扫描结论C/W/I清单审计收录时间
dsh-mcp-lazy
Lazy MCP gateway for DSH: one stable proxy tool instead of N tool schemas, servers connect on first use and idle out, metadata cached to disk.
低风险pass0/0/40/02026-09-11 00:14
dsh-backup-migrator
Plugin environment backup and migration for DSH
需注意warn0/1/20/02026-09-11 00:14
dsh-skill-recommender
Session-profile skill recommender for DSH
需注意warn0/1/90/02026-09-11 00:14
dsh-aliyun-mcp
Alibaba Cloud OpenAPI MCP connection for DSH
低风险pass0/0/60/02026-09-11 00:14
dsh-goofish-mcp
Xianyu (Goofish) read-only monitoring MCP for DSH
低风险pass0/0/30/02026-09-11 00:14
dsh-feishu-mcp
Feishu (Lark) OpenAPI MCP connection for DSH
需注意warn0/3/100/02026-09-11 00:14
dsh-zsxq
Knowledge Planet (zsxq) integration for DSH
低风险pass0/0/60/02026-09-11 00:14
dsh-plugins
Independent DSH plugins: cost metrics + browser_use tool. One pnpm monorepo, independently installable and vendable.
需注意warn0/1/110/02026-09-11 00:14
dsh-npm
NPM registry management for DSH
需注意warn0/3/80/02026-09-11 00:14
QQ.dsh-qqbot
基于DSH-QQBOT项目的dsh-qqbotGPT优化版本
低风险pass0/0/00/02026-09-11 00:14
dsh-wallpaper-position
dsh-dream-skin satellite: per-image wallpaper position (X/Y px) settings row. Vibe-coded.
低风险pass0/0/50/02026-09-11 02:13
dsh-whale-tools
dsh-whale-widget satellite: replace the whale mascot with any image (auto cutout) + restart button + heartbeat. Vibe-coded.
需注意warn0/5/80/02026-09-11 02:13
dsh-local-dba
A local database-administration (DBA) plugin for [DSH](https://github.com/deepseek-ai/deepseek-harness). It ships as a Cordis plugin bundle that registers a set of `db_*` model-facing tools, letting the agent query, inspect schema, run DDL/DML, back up/restore and analyze slow queries against **MySQL / MariaDB** and **PostgreSQL**.
需注意warn0/2/70/02026-09-11 02:13
dsh-sakurafrp
dsh-mobile satellite: manage the SakuraFrp phone-desktop link from DSH UI (status, gateway toggle, pairing QR, devices, self-heal). Vibe-coded.
需注意warn0/9/150/02026-09-11 02:13
dsh-imagegen-zhenzhen
DSH image-generation plugin with native support for zhenzhen-image style async task gateways (submit + poll), including multi-reference image-to-image. Fork of @dickpy/dsh-imagegen.
低风险pass0/0/10/02026-09-11 02:13
dsh-newwindows
⚡ Summary-free context window rollover, model-authored notes, and scoped history lookup plugin for DSH. Inspired by OpenAI Codex.
低风险pass0/0/00/02026-09-11 02:13
dsh-provider-headers
Per-provider request headers in the DSH Models settings page, with per-conversation ${sessionId} expansion.
低风险pass0/0/10/02026-09-11 02:13
dsh-reveal-fix
Fix DSH's "reveal in file manager" silently doing nothing on Windows. User-space plugin — survives dsh upgrades, no core files patched.
需注意warn0/1/00/02026-09-11 02:13
dsh-task-board
DSH Web GUI 的任务看板插件:侧边栏入口 + 五列看板,任务经 DSH 会话真实执行,host 端持久化并跨设备实时同步。Task board plugin for the DSH web GUI.
低风险pass0/0/00/02026-09-11 02:13
dsh_superpowers
Superpowers for the DSH: a dsh plugin that registers the Superpowers skills as a skill catalog and injects the using-superpowers bootstrap into the system prompt.
需注意warn0/5/130/02026-09-11 02:13
dsh-find-plugin
Find DSH plugins from inside the agent - live GitHub dsh-plugin topic search + the curated awesome-dsh-plugin list, with token auth, rate-limit resilience and offline fallback. Fork of awesome-dsh-plugin/dsh-find-plugin.
低风险pass0/0/60/02026-09-11 04:13
dsh-plugin-desk
DSH 插件管家:用人话说明每个插件是做什么的,一键停用/启用(热生效),安全卸载。Settings → Plugins → 插件管家
低风险pass0/0/40/02026-09-11 04:13
dsh-livebench-panel
DSH web plugin: a LiveBench tab in the Trajectory view. Run LiveBench evaluations against every model configured in the DSH and read scores in place.
需注意warn0/3/60/02026-09-11 04:13
dsh-plugin-use-images
再dsh里面可以使用图片api
低风险pass0/0/10/02026-09-11 04:13
dsh-loomy-connect
Use the models that ship with the Loomy desktop app inside DSH — no API key. Also adds a Settings card showing the signed-in account and Loomy credits (permanent + daily gift).
需注意warn0/3/160/02026-09-11 04:13
dsh-plugin-reasoning-efforts
给 DSH 的第三方中转模型补上「推理等级」选择器 —— 和官方模型在聊天框里的体验完全一致。
低风险pass0/0/00/02026-09-11 04:13
dsh-bg-new
DSH 网页界面换背景:侧栏「壁纸」按钮弹出右侧抽屉,支持系统预设/纯色/渐变/图片/视频,滚轮+拖动小图同时管缩放与定位,毛玻璃质感,本地媒体伺服不走云端。DSH web background & wallpaper plugin with drawer UI, glassmorphism and local media serving.
低风险pass0/0/30/02026-09-11 04:13
dsh-clipboard-menu
Adds a right-click cut/copy/paste/select-all menu to DSH composer inputs.
低风险pass0/0/30/02026-09-11 04:13
dsh-research-kit
dsh-research-kit 是一个 浏览器侧 DSH 插件:它维护科研资源目录、把工作流和用户参数组装成可编辑 Prompt,并由 DSH 当前会话负责实际发送与执行。
低风险pass0/0/00/02026-09-11 04:13
dsh-plugin-session-delete
删除dsh的会话内容
低风险pass0/0/00/02026-09-11 04:13
ai-memory
Personal AI memory semantic layer SDK (Rust + SQLite) — short/mid/long-term memory with hybrid recall
低风险pass0/0/10/02026-09-11 04:13

静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。

历史日报归档

27 期
← 返回安全报告

这份日报覆盖什么?

这份日报覆盖 2026-09-11 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。

风险等级是如何划分的?

风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。

为什么这不是完整安全审计?

日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。

来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于

这页有帮助吗?