每日安全扫描日报

日期 · 2026-09-12 (UTC,覆盖当日 00:00–24:00 新增入库的插件)

84
当日新增
0
严重
29
需注意
55
低风险
插件风险扫描结论C/W/I清单审计收录时间
dsh-locale-tr
Turkish (Türkçe) language pack for DSH — client plugin registering the tr UI locale.
低风险pass0/0/00/02026-09-12 00:14
dsh-restart-btn
DSH 重启按钮插件:设置页一键重启 dsh web,复用桌面启动器机制(node + lib/bin.js、日志重定向、TCP 就绪轮询),修复非 ASCII 路径下计划任务静默失败的问题。
需注意warn0/3/70/02026-09-12 00:14
dsh-typst-preview
Live Typst preview in the DSH Web UI's native right Sidebar, rendered by a per-file tinymist preview server proxied over the app origin.
低风险pass0/0/90/02026-09-12 02:14
dsh-keep-going
Restart DSH, then carry on: the answer in progress finishes, DSH closes in an orderly way, and every conversation the restart interrupted is woken.
需注意warn0/1/20/02026-09-12 02:14
dsh-usage-dock
DSH web plugin: per-session CNY cost pill that renders into the composer's shipped statistics row
低风险pass0/0/50/02026-09-12 02:14
dsh-plugins
DSH web plugins: a model-generated next prompt in the composer, and an integrated terminal for chat code blocks.
需注意warn0/3/30/02026-09-12 02:14
dsh-price-phase
DSH Web GUI 峰谷时段徽标:显示 DeepSeek API 当前处于高峰还是空闲时段(周一至周五 9-12/14-18 为高峰,周末全天半价),含距下次切换的倒计时
低风险pass0/0/00/02026-09-12 02:14
dsh-wayfinder-ui
DSH plugin: spawns one live session per ready Wayfinder task and draws the dependency map in the chat GUI
低风险pass0/0/20/02026-09-12 02:14
dsh-luna-preset
DSH 的「露娜模式」agent preset:魔界小恶魔人设 + 六层情感引擎(emotion_sense),能力等同内置 standard preset
需注意warn0/3/00/32026-09-12 02:14
dsh-imgview
DSH 对话内图片卡插件:show_image 工具 + 同源图片路由 + 可点击放大灯箱卡片
低风险pass0/0/00/02026-09-12 02:14
dsh-zhihu
知乎 CLI 连接插件 for DSH:包装本机 pyzhihu-cli 为 zhihu_* 工具(18 个,写操作默认关闭),附 Web 可视化入口(侧栏「知」球 + 设置页卡片)
低风险pass0/0/00/02026-09-12 04:12
dsh-llm-balance-siderbar
DSH plugin for querying LLM service provider usage: reads each configured provider's remaining balance or subscription quota and shows it in an always-visible card in the web GUI
低风险pass0/0/20/02026-09-12 04:12
dsh-conversation-bindings
Peer communication, supervision, and tool guardrails between conversations in one DSH process.
低风险pass0/0/20/02026-09-12 04:12
dsh-header-balance
DSH Web GUI 会话页头部余额芯片:经宿主侧 Remote 用你的 API Key 查询 DeepSeek 账户余额,点击跳转充值,悬停可见赠送/充值拆分。API Key 不进浏览器。
低风险pass0/0/40/02026-09-12 04:12
dsh-AGE
dsh-AGE 是一个**无聊插件**,用来在 deepseek-harness 的网页界面里模拟「安全组件扫描时卡顿」的体验。
低风险pass0/0/10/02026-09-12 04:12
dsh-notify
DSH plugin: Windows desktop notifications + sound when an agent turn finishes or the harness is waiting for you.
需注意warn0/1/00/02026-09-12 04:12
dsh-session-topics
Sidebar topic grouping plugin for DSH - client-only, zero host-service dependency, with offline smoke tests.
低风险pass0/0/30/02026-09-12 04:12
dsh-prompt-boost-pro
Enhance the composer draft before sending: a sparkle button in the DSH web GUI rewrites your prompt in a structured or light mode, with an original-versus-enhanced preview.
低风险pass0/0/20/02026-09-12 04:12
dsh-deepseek-tide
DSH Web GUI plugin: DeepSeek API peak/valley pricing indicator in the session header
低风险pass0/0/00/02026-09-12 04:12
dsh-openspec
把 OpenSpec(规范驱动开发)接入 DSH:内置六个 agent skill,并从插件自身依赖解析 openspec CLI,无需全局安装、无需按项目拷贝 .agents/skills | OpenSpec (spec-driven development) for DSH: six bundled agent skills + CLI resolution from the plugin dependency. No global install.
需注意warn0/2/80/02026-09-12 04:12
dsh-restart
One-click restart for DSH: a web button (plus a dsh_restart agent tool) hands the relaunch to a detached helper, the page reconnects by itself, and a recovery console shows the boot errors when the new host fails
需注意warn0/2/60/02026-09-12 04:12
dsh-model-fold
Model picker grouped by source for DSH: source list with a slide-in side panel (or inline fold) for each provider's models
低风险pass0/0/30/02026-09-12 04:12
dsh-live-model-catalog
DSH 插件:让 llm-pi-ai 路由(含自定义服务商)的模型目录与推理档位跟着端点更新——补上新模型与 contextWindow/maxTokens/input/reasoningEfforts,端点给出推理信息即写入思考档位,并修好「获取可用模型」按钮;只走官方 settings 接缝,不打补丁、可卸载。| DSH plugin: keeps llm-pi-ai routes (hand-written and custom providers included) in step with their own /models: new models, capabilities, reasoning levels, live fetch button. No patching.
低风险pass0/0/20/02026-09-12 04:12
dsh-remote-ssh-worktree
A DSH plugin that runs the harness's file, shell, and terminal tools inside a git worktree on a remote machine over SSH. The remote agent installs itself: it ships as a static Rust binary from GitHub Releases, listens on a random loopback port, and updates when the plugin does.
低风险pass0/0/00/02026-09-12 04:12
dsh-consumer-audit
Audit a DSH profile for capabilities nothing consumes, and record completion claims with the evidence that supports them.
需注意warn0/2/160/02026-09-12 04:12
dsh-weixin-minigame
Preview, develop, and debug (through logs and screenshots) WeChat Mini Games inside the dsh Web GUI
低风险pass0/0/40/02026-09-12 04:12
dsh-project-handbook
DSH plugin that generates a company-grade project handover and onboarding handbook from repository evidence.
低风险pass0/0/20/02026-09-12 06:11
dsh-doctor
DSH 诊断插件:把 home、进程、端口、大 session、版本问题收成一份可粘贴的报告。不替代 Desktop / TUI。
低风险pass0/0/00/02026-09-12 06:11
dsh-safety-restart
Safe, seamless restart for DSH: the agent can restart the host itself and resume afterwards. Four gates (restart-loop breaker, other sessions mid-turn, unresolvable profile bundles, unavailable app.relaunch) refuse with a reason instead of forcing it.
需注意warn0/3/70/02026-09-12 06:11
dsh-clock-context
Give your DSH agent a clock: injects the current date and time into the runtime context on every turn, so the agent can read the time instead of inferring it.
低风险pass0/0/00/02026-09-12 06:11
dsh-open-terminal
dsh-TUI /term: open a system terminal in a workspace folder — blank opens the working-directory root, a fragment fuzzy-matches folders.
需注意warn0/1/20/02026-09-12 06:11
dsh-web-search-order
DSH plugin: ordered web-search provider fallback (omp-style webSearchOrder) over the providers already registered in ctx.web
低风险pass0/0/00/02026-09-12 06:11
ZA_report
ZA Research report stage — academic paper writing for asset pricing + ML/DL research.
低风险pass0/0/00/02026-09-12 06:11
dsh-plugin-screenshot-ask
DSH 截图提问插件:原生框选截图直接进输入框,全程不落盘(DSH plugin, Windows)
需注意warn0/3/70/02026-09-12 06:11
ZA_data
ZA Research data stage — data discovery and quality assessment for asset pricing + ML/DL research.
低风险pass0/0/00/02026-09-12 06:11
ZA_literature
ZA Research literature stage — search, synthesis, and citation-chain tracking for asset pricing + ML/DL research.
低风险pass0/0/00/02026-09-12 06:11
ZA_ppt
ZA Research PPT stage — presentation generation (Beamer/Quarto) from the paper.
低风险pass0/0/00/02026-09-12 06:11
ZA_analysis
ZA Research analysis stage — end-to-end model training and estimation for asset pricing + ML/DL research.
低风险pass0/0/00/02026-09-12 06:11
dsh-voice-input
Voice input for DSH: a microphone seat in the composer and a Web settings page that transcribes through the browser or any OpenAI-compatible /audio/transcriptions endpoint, with a fully offline local Whisper server included.
需注意warn0/9/150/02026-09-12 06:11
dsh-rule-lens
规则透镜(RuleScope Lens)— DSH 本地插件:AGENTS.md/rules 加载可视化、预算治理、硬拦截、Lint、遵守率 | Rule visibility, budget governance & hard guards for DSH
低风险pass0/0/10/02026-09-12 06:11
dsh-creative-studio
Portable AI image-retouching and video-editing skill pack for DSH: matting with quality tiers, inpainting retouch, text/logo compositing, batch platform exports, footage review, timeline editing.
低风险pass0/0/10/02026-09-12 06:11
dsh-plugin-migration-workbuddy
Migrate WorkBuddy sessions, memories, MCP drafts, and automation tasks into DSH — preview-first, read-only on the source
低风险pass0/0/10/02026-09-12 06:11
dsh-session-notice
DSH 会话 Bark 通知插件:会话头部按钮切换「会通知」状态(持久化),轮次停止时经 Bark 推送到手机;设置页配 server/key 并提供 ping→push→register 三步连通测试
低风险pass0/0/10/02026-09-12 08:12
dsh-live-data
实时数据聚合插件(10 个工具 / 8 个免密钥公开接口):汇率、天气、npm、GitHub、PyPI、B站、A股、大盘、金价(元/克)、IP 归属地。All-in-one live-data plugin for DSH.
低风险pass0/0/70/02026-09-12 08:12
dsh-qqbot-dafeiyu
QQ Bot IM channel plugin for DSH: per-peer sessions, image generation, TTS voice replies, attachments.
低风险pass0/0/00/02026-09-12 08:12
dsh-office-toolkit
DSH 宿主插件:给 AI 智能体增加读写 Word/Excel 的工具(docx/xlsx/xls/doc/rtf/odt,纯 JS 跨平台)| DSH host plugin: Word/Excel read & write tools for AI agents
需注意warn0/1/10/02026-09-12 08:12
dsh-conversation-link
DSH对话互通插件:同一进程里的对话可以互相发现、直接发消息、盯进度、设护栏——不用先绑定,也不用开子代理。多对话协作 / 跨会话通信 / 监工。Peer messaging, supervision & tool guards between conversations.
低风险pass0/0/20/02026-09-12 08:12
dsh-network
Let DSH access the internet seamlessly.
需注意warn0/1/20/02026-09-12 08:12
dsh-plugins-hub
Third-party plugin hub for DSH — official/community grouped plugin list inside Settings → Plugins, with update checks, one-click update, uninstall, and live enable/disable.
低风险pass0/0/10/02026-09-12 08:12
dsh-astrbot-ingress
HTTP ingress plugin: let AstrBot (QQ / OneBot / official IM) drive a local DSH agent
需注意warn0/3/60/02026-09-12 08:12
dsh-image-settings
User-tunable inline image display for dsh web sessions: larger, auto-unrolled read_image tool view with an Image settings card
低风险pass0/0/00/02026-09-12 08:12
dsh-deepseek-web
DSH 插件:把 chat.deepseek.com 网页版接进 DSH(deepseek_web_ask / deepseek_web_analyze_lines / deepseek_web_status + 一键登录面板)。纯 Node,MIT License。
需注意warn0/4/90/02026-09-12 08:12
dsh-plugin-codex-ui
Codex-style sidebar skin for the DSH Web GUI: a Projects + Recents browser, a New chat row that starts a session without picking a project and allocates its own working directory, and a draft composer that writes nothing until you send.
低风险pass0/0/70/02026-09-12 08:12
dsh-api-balance
DSH 桌面插件:在桌面角落常驻一个置顶小窗,实时显示 DeepSeek API 余额与本次开机消耗的 token。七套配色、可用自己的图片当背景、× 收进托盘。
需注意warn0/1/30/02026-09-12 08:12
dsh-turn-chime
DSH Web 插件:任务完成后播放提示音(可开关、可调音量、可上传自己的音频;内置提示音由脚本合成)
低风险pass0/0/30/02026-09-12 08:12
dsh-session-title-refresh
DSH 会话标题插件:在会话菜单中根据对话内容重新总结标题,零运行时依赖
低风险pass0/0/20/02026-09-12 08:12
dsh-plugin-multi-root-workspace
DSH 外部插件:把工作区可写范围从一个主根扩展为「主根 + N 个附加根」,不改上游任何包。Out-of-tree DSH plugin widening the workspace sandbox scope to a primary root plus N additional roots, with a root registry, a /workspace-folders command and a browser panel.
低风险pass0/0/150/02026-09-12 08:12
dsh-devops
GitLab + Kubernetes monitoring plugin for DSH — track CI/CD pipelines and K8s cluster health in one place.
低风险pass0/0/10/02026-09-12 08:12
dsh-tunnel-plugin
把本机的 DSH Web GUI 安全地发布到公网, 让你在外面用浏览器就能用家里那台机器。
需注意warn1/10/280/02026-09-12 08:12
dsh-plugin-tool-management
一站式管理 DSH 的 MCP 服务与 Skills:工具级开关、密钥打码、技能回收站 | Unified MCP & skills manager for DSH: per-tool toggles, secret masking, skill trash
需注意warn0/5/80/02026-09-12 10:12
dsh-usage-stats
DSH 用量统计插件:本地 SQLite 账本,按天 / 服务商 / 模型统计 token 用量
低风险pass0/0/20/02026-09-12 10:12
dsh-experience-map
dsh-experience-map
低风险pass0/0/00/02026-09-12 10:12
dsh-team-rooms
Team rooms for DSH: persistent shared rooms across independent sessions - a message bus, a shared task board and a timeline. Extracted from dsh-background-agents, whose background-agent half is superseded by DSH's native continuable subagents.
低风险pass0/0/00/02026-09-12 10:12
dsh-ppt-maker
DSH web plugin: adds a PPT 制作 entry to the composer + menu that kicks off a bundled, self-contained PPT workflow prompt. One menu pick, one short message, no repeated approval prompts.
需注意warn1/0/30/02026-09-12 10:12
dsh-edu
The educational version of DSH
低风险pass0/0/00/02026-09-12 10:12
dsh-image-guard
DSH plugin: trims historical images to the provider image budget before sending, learns the image cap from HTTP 400 responses, and retries with fewer images. Reduces vision-token usage and prevents image-heavy sessions from failing.
需注意warn0/3/90/02026-09-12 10:12
dsh-mermaid-comm
DSH plugin: Make AI default to Mermaid diagrams in development conversations — prompt guidance, mermaid_validate syntax check, and output safety gate. Rendering via dsh-mermaid.
低风险pass0/0/00/02026-09-12 10:12
dsh-longtext-input
DSH 长文本输入插件:把超长正文写进工作区 .dsh-longtext/ 下的 md 文件,输入框只留一个 @ 引用,保持聊天界面简洁。支持 Wallpaper Engine 毛玻璃。
需注意warn0/3/10/02026-09-12 10:12
dsh-composer-tabs
按照插件分类添加tab页到技能菜单里
需注意warn0/1/20/02026-09-12 10:12
dsh-hmos-skills
HarmonyOS (鸿蒙) development skills for DSH — 39 official hmos-* skill bundles ported to the DSH skill registry: ArkTS/ArkUI, multi-device adaptation, Kit integration, and DFX crash/leak analysis.
低风险pass0/0/00/02026-09-12 10:12
Orderzx
A live, stealth-capable, autonomous Chrome inside your DSH conversation — set-of-marks vision, Chrome-for-Android desktop-view parity, human takeover, 4-tier CAPTCHA handoff, standalone panel for any device (dsh-browser plugin).
需注意warn0/2/50/02026-09-12 10:12
dsh-later
DSH 会话内定时发送插件
低风险pass0/0/00/02026-09-12 10:12
dsh-image-router
DSH plugin: digest prompt images through a vision model and expose a describe_image tool — without ever changing the session's model.
低风险pass0/0/00/02026-09-12 12:12
dsh-plugin-vllm-ascend-profiler
DSH plugin: parse vLLM-Ascend / Ascend NPU profiling artifacts, visualize Host/Device swimlanes plus cost shares, and emit structured, phase-aware optimization advice with Markdown/PDF export.
需注意warn0/2/70/02026-09-12 12:12
dsh-token-live
Composer readouts for the DSH: CJK-weighted draft token count, session spend at official peak/idle rates, context occupancy, and what the same usage would have cost on the costliest other model; client-only, with no host half and no credential access.
低风险pass0/0/00/02026-09-12 12:12
dsh-ide-lite
Lightweight IDE-in-the-sidebar plugin for the dsh web GUI: workspace file tree, agent-change review (accept/reject + undo), full editing with diff and rendered markdown, plus an integrated terminal view.
低风险pass0/0/00/02026-09-12 12:12
dsh-launch-in-one-click
A DSH plugin for Windows: writes a self-contained one-click launcher, and refuses to start a second instance when the target port already serves one. / 一个 Windows 专用的 DSH 插件:写入自包含的一键启动器;目标端口已有 Harness 实例时拒绝启动第二个。
需注意warn0/3/150/02026-09-12 12:12
dsh-delete-session
Real deletion for DSH Web conversations: a session-row menu action and a Workspaces-header batch dialog; removes each session's log directory and projection cache. 给 DSH Web 侧栏补上真正的会话删除:右键菜单删单条、区头批量删多条,删掉日志目录与投影缓存。
低风险pass0/0/20/02026-09-12 12:12
dsh-mobile-topbar
DSH plugin: turns the sidebar into a compact top bar on mobile screens to save space
低风险pass0/0/00/02026-09-12 12:12
dsh-project-memory
需注意warn0/1/60/02026-09-12 12:12
dsh-tidecost
低风险pass0/0/00/02026-09-12 12:12
I-am-Yuike
一个猫娘人格扮演插件(伪破限),去除dsh强制加入的附加提示词,只附带工具链和猫娘基准人格的插件
需注意warn0/3/30/32026-09-12 12:12
Thalamus
θάλαμος —— 荷马史诗里屋子里最深处的那个房间,也是大脑中接住情绪的那枚丘脑。AI 陪伴微信机器人:DSH 插件,让一个独立的微信号成为一个有性格、有生活、对你特殊的她。
需注意warn0/4/80/02026-09-12 12:12
dsh-opencodego
在DSH中支持opencode支持GO订阅,包括模型获取以及能力设置、请求头自适应等
低风险pass0/0/30/02026-09-12 12:12

静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。

历史日报归档

28 期
← 返回安全报告

这份日报覆盖什么?

这份日报覆盖 2026-09-12 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。

风险等级是如何划分的?

风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。

为什么这不是完整安全审计?

日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。

来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于

这页有帮助吗?