每日安全扫描日报
日期 · 2026-09-12 (UTC,覆盖当日 00:00–24:00 新增入库的插件)
84
当日新增
0
严重
29
需注意
55
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| dsh-locale-tr Turkish (Türkçe) language pack for DSH — client plugin registering the tr UI locale. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 00:14 |
| dsh-restart-btn DSH 重启按钮插件:设置页一键重启 dsh web,复用桌面启动器机制(node + lib/bin.js、日志重定向、TCP 就绪轮询),修复非 ASCII 路径下计划任务静默失败的问题。 | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-12 00:14 |
| dsh-typst-preview Live Typst preview in the DSH Web UI's native right Sidebar, rendered by a per-file tinymist preview server proxied over the app origin. | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-12 02:14 |
| dsh-keep-going Restart DSH, then carry on: the answer in progress finishes, DSH closes in an orderly way, and every conversation the restart interrupted is woken. | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-12 02:14 |
| dsh-usage-dock DSH web plugin: per-session CNY cost pill that renders into the composer's shipped statistics row | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-12 02:14 |
| dsh-plugins DSH web plugins: a model-generated next prompt in the composer, and an integrated terminal for chat code blocks. | 需注意 | warn | 0/3/3 | 0/0 | 2026-09-12 02:14 |
| dsh-price-phase DSH Web GUI 峰谷时段徽标:显示 DeepSeek API 当前处于高峰还是空闲时段(周一至周五 9-12/14-18 为高峰,周末全天半价),含距下次切换的倒计时 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 02:14 |
| dsh-wayfinder-ui DSH plugin: spawns one live session per ready Wayfinder task and draws the dependency map in the chat GUI | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 02:14 |
| dsh-luna-preset DSH 的「露娜模式」agent preset:魔界小恶魔人设 + 六层情感引擎(emotion_sense),能力等同内置 standard preset | 需注意 | warn | 0/3/0 | 0/3 | 2026-09-12 02:14 |
| dsh-imgview DSH 对话内图片卡插件:show_image 工具 + 同源图片路由 + 可点击放大灯箱卡片 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 02:14 |
| dsh-zhihu 知乎 CLI 连接插件 for DSH:包装本机 pyzhihu-cli 为 zhihu_* 工具(18 个,写操作默认关闭),附 Web 可视化入口(侧栏「知」球 + 设置页卡片) | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-llm-balance-siderbar DSH plugin for querying LLM service provider usage: reads each configured provider's remaining balance or subscription quota and shows it in an always-visible card in the web GUI | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-conversation-bindings Peer communication, supervision, and tool guardrails between conversations in one DSH process. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-header-balance DSH Web GUI 会话页头部余额芯片:经宿主侧 Remote 用你的 API Key 查询 DeepSeek 账户余额,点击跳转充值,悬停可见赠送/充值拆分。API Key 不进浏览器。 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-12 04:12 |
| dsh-AGE dsh-AGE 是一个**无聊插件**,用来在 deepseek-harness 的网页界面里模拟「安全组件扫描时卡顿」的体验。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 04:12 |
| dsh-notify DSH plugin: Windows desktop notifications + sound when an agent turn finishes or the harness is waiting for you. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-12 04:12 |
| dsh-session-topics Sidebar topic grouping plugin for DSH - client-only, zero host-service dependency, with offline smoke tests. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-12 04:12 |
| dsh-prompt-boost-pro Enhance the composer draft before sending: a sparkle button in the DSH web GUI rewrites your prompt in a structured or light mode, with an original-versus-enhanced preview. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-deepseek-tide DSH Web GUI plugin: DeepSeek API peak/valley pricing indicator in the session header | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-openspec 把 OpenSpec(规范驱动开发)接入 DSH:内置六个 agent skill,并从插件自身依赖解析 openspec CLI,无需全局安装、无需按项目拷贝 .agents/skills | OpenSpec (spec-driven development) for DSH: six bundled agent skills + CLI resolution from the plugin dependency. No global install. | 需注意 | warn | 0/2/8 | 0/0 | 2026-09-12 04:12 |
| dsh-restart One-click restart for DSH: a web button (plus a dsh_restart agent tool) hands the relaunch to a detached helper, the page reconnects by itself, and a recovery console shows the boot errors when the new host fails | 需注意 | warn | 0/2/6 | 0/0 | 2026-09-12 04:12 |
| dsh-model-fold Model picker grouped by source for DSH: source list with a slide-in side panel (or inline fold) for each provider's models | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-12 04:12 |
| dsh-live-model-catalog DSH 插件:让 llm-pi-ai 路由(含自定义服务商)的模型目录与推理档位跟着端点更新——补上新模型与 contextWindow/maxTokens/input/reasoningEfforts,端点给出推理信息即写入思考档位,并修好「获取可用模型」按钮;只走官方 settings 接缝,不打补丁、可卸载。| DSH plugin: keeps llm-pi-ai routes (hand-written and custom providers included) in step with their own /models: new models, capabilities, reasoning levels, live fetch button. No patching. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 04:12 |
| dsh-remote-ssh-worktree A DSH plugin that runs the harness's file, shell, and terminal tools inside a git worktree on a remote machine over SSH. The remote agent installs itself: it ships as a static Rust binary from GitHub Releases, listens on a random loopback port, and updates when the plugin does. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 04:12 |
| dsh-consumer-audit Audit a DSH profile for capabilities nothing consumes, and record completion claims with the evidence that supports them. | 需注意 | warn | 0/2/16 | 0/0 | 2026-09-12 04:12 |
| dsh-weixin-minigame Preview, develop, and debug (through logs and screenshots) WeChat Mini Games inside the dsh Web GUI | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-12 04:12 |
| dsh-project-handbook DSH plugin that generates a company-grade project handover and onboarding handbook from repository evidence. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 06:11 |
| dsh-doctor DSH 诊断插件:把 home、进程、端口、大 session、版本问题收成一份可粘贴的报告。不替代 Desktop / TUI。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-safety-restart Safe, seamless restart for DSH: the agent can restart the host itself and resume afterwards. Four gates (restart-loop breaker, other sessions mid-turn, unresolvable profile bundles, unavailable app.relaunch) refuse with a reason instead of forcing it. | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-12 06:11 |
| dsh-clock-context Give your DSH agent a clock: injects the current date and time into the runtime context on every turn, so the agent can read the time instead of inferring it. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-open-terminal dsh-TUI /term: open a system terminal in a workspace folder — blank opens the working-directory root, a fragment fuzzy-matches folders. | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-12 06:11 |
| dsh-web-search-order DSH plugin: ordered web-search provider fallback (omp-style webSearchOrder) over the providers already registered in ctx.web | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_report ZA Research report stage — academic paper writing for asset pricing + ML/DL research. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-plugin-screenshot-ask DSH 截图提问插件:原生框选截图直接进输入框,全程不落盘(DSH plugin, Windows) | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-12 06:11 |
| ZA_data ZA Research data stage — data discovery and quality assessment for asset pricing + ML/DL research. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_literature ZA Research literature stage — search, synthesis, and citation-chain tracking for asset pricing + ML/DL research. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_ppt ZA Research PPT stage — presentation generation (Beamer/Quarto) from the paper. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| ZA_analysis ZA Research analysis stage — end-to-end model training and estimation for asset pricing + ML/DL research. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 06:11 |
| dsh-voice-input Voice input for DSH: a microphone seat in the composer and a Web settings page that transcribes through the browser or any OpenAI-compatible /audio/transcriptions endpoint, with a fully offline local Whisper server included. | 需注意 | warn | 0/9/15 | 0/0 | 2026-09-12 06:11 |
| dsh-rule-lens 规则透镜(RuleScope Lens)— DSH 本地插件:AGENTS.md/rules 加载可视化、预算治理、硬拦截、Lint、遵守率 | Rule visibility, budget governance & hard guards for DSH | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-creative-studio Portable AI image-retouching and video-editing skill pack for DSH: matting with quality tiers, inpainting retouch, text/logo compositing, batch platform exports, footage review, timeline editing. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-plugin-migration-workbuddy Migrate WorkBuddy sessions, memories, MCP drafts, and automation tasks into DSH — preview-first, read-only on the source | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 06:11 |
| dsh-session-notice DSH 会话 Bark 通知插件:会话头部按钮切换「会通知」状态(持久化),轮次停止时经 Bark 推送到手机;设置页配 server/key 并提供 ping→push→register 三步连通测试 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-live-data 实时数据聚合插件(10 个工具 / 8 个免密钥公开接口):汇率、天气、npm、GitHub、PyPI、B站、A股、大盘、金价(元/克)、IP 归属地。All-in-one live-data plugin for DSH. | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-12 08:12 |
| dsh-qqbot-dafeiyu QQ Bot IM channel plugin for DSH: per-peer sessions, image generation, TTS voice replies, attachments. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 08:12 |
| dsh-office-toolkit DSH 宿主插件:给 AI 智能体增加读写 Word/Excel 的工具(docx/xlsx/xls/doc/rtf/odt,纯 JS 跨平台)| DSH host plugin: Word/Excel read & write tools for AI agents | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-12 08:12 |
| dsh-conversation-link DSH对话互通插件:同一进程里的对话可以互相发现、直接发消息、盯进度、设护栏——不用先绑定,也不用开子代理。多对话协作 / 跨会话通信 / 监工。Peer messaging, supervision & tool guards between conversations. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 08:12 |
| dsh-network Let DSH access the internet seamlessly. | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-12 08:12 |
| dsh-plugins-hub Third-party plugin hub for DSH — official/community grouped plugin list inside Settings → Plugins, with update checks, one-click update, uninstall, and live enable/disable. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-astrbot-ingress HTTP ingress plugin: let AstrBot (QQ / OneBot / official IM) drive a local DSH agent | 需注意 | warn | 0/3/6 | 0/0 | 2026-09-12 08:12 |
| dsh-image-settings User-tunable inline image display for dsh web sessions: larger, auto-unrolled read_image tool view with an Image settings card | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 08:12 |
| dsh-deepseek-web DSH 插件:把 chat.deepseek.com 网页版接进 DSH(deepseek_web_ask / deepseek_web_analyze_lines / deepseek_web_status + 一键登录面板)。纯 Node,MIT License。 | 需注意 | warn | 0/4/9 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-codex-ui Codex-style sidebar skin for the DSH Web GUI: a Projects + Recents browser, a New chat row that starts a session without picking a project and allocates its own working directory, and a draft composer that writes nothing until you send. | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-12 08:12 |
| dsh-api-balance DSH 桌面插件:在桌面角落常驻一个置顶小窗,实时显示 DeepSeek API 余额与本次开机消耗的 token。七套配色、可用自己的图片当背景、× 收进托盘。 | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-12 08:12 |
| dsh-turn-chime DSH Web 插件:任务完成后播放提示音(可开关、可调音量、可上传自己的音频;内置提示音由脚本合成) | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-12 08:12 |
| dsh-session-title-refresh DSH 会话标题插件:在会话菜单中根据对话内容重新总结标题,零运行时依赖 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-multi-root-workspace DSH 外部插件:把工作区可写范围从一个主根扩展为「主根 + N 个附加根」,不改上游任何包。Out-of-tree DSH plugin widening the workspace sandbox scope to a primary root plus N additional roots, with a root registry, a /workspace-folders command and a browser panel. | 低风险 | pass | 0/0/15 | 0/0 | 2026-09-12 08:12 |
| dsh-devops GitLab + Kubernetes monitoring plugin for DSH — track CI/CD pipelines and K8s cluster health in one place. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-12 08:12 |
| dsh-tunnel-plugin 把本机的 DSH Web GUI 安全地发布到公网, 让你在外面用浏览器就能用家里那台机器。 | 需注意 | warn | 1/10/28 | 0/0 | 2026-09-12 08:12 |
| dsh-plugin-tool-management 一站式管理 DSH 的 MCP 服务与 Skills:工具级开关、密钥打码、技能回收站 | Unified MCP & skills manager for DSH: per-tool toggles, secret masking, skill trash | 需注意 | warn | 0/5/8 | 0/0 | 2026-09-12 10:12 |
| dsh-usage-stats DSH 用量统计插件:本地 SQLite 账本,按天 / 服务商 / 模型统计 token 用量 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 10:12 |
| dsh-experience-map dsh-experience-map | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-team-rooms Team rooms for DSH: persistent shared rooms across independent sessions - a message bus, a shared task board and a timeline. Extracted from dsh-background-agents, whose background-agent half is superseded by DSH's native continuable subagents. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-ppt-maker DSH web plugin: adds a PPT 制作 entry to the composer + menu that kicks off a bundled, self-contained PPT workflow prompt. One menu pick, one short message, no repeated approval prompts. | 需注意 | warn | 1/0/3 | 0/0 | 2026-09-12 10:12 |
| dsh-edu The educational version of DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-image-guard DSH plugin: trims historical images to the provider image budget before sending, learns the image cap from HTTP 400 responses, and retries with fewer images. Reduces vision-token usage and prevents image-heavy sessions from failing. | 需注意 | warn | 0/3/9 | 0/0 | 2026-09-12 10:12 |
| dsh-mermaid-comm DSH plugin: Make AI default to Mermaid diagrams in development conversations — prompt guidance, mermaid_validate syntax check, and output safety gate. Rendering via dsh-mermaid. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-longtext-input DSH 长文本输入插件:把超长正文写进工作区 .dsh-longtext/ 下的 md 文件,输入框只留一个 @ 引用,保持聊天界面简洁。支持 Wallpaper Engine 毛玻璃。 | 需注意 | warn | 0/3/1 | 0/0 | 2026-09-12 10:12 |
| dsh-composer-tabs 按照插件分类添加tab页到技能菜单里 | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-12 10:12 |
| dsh-hmos-skills HarmonyOS (鸿蒙) development skills for DSH — 39 official hmos-* skill bundles ported to the DSH skill registry: ArkTS/ArkUI, multi-device adaptation, Kit integration, and DFX crash/leak analysis. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| Orderzx A live, stealth-capable, autonomous Chrome inside your DSH conversation — set-of-marks vision, Chrome-for-Android desktop-view parity, human takeover, 4-tier CAPTCHA handoff, standalone panel for any device (dsh-browser plugin). | 需注意 | warn | 0/2/5 | 0/0 | 2026-09-12 10:12 |
| dsh-later DSH 会话内定时发送插件 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 10:12 |
| dsh-image-router DSH plugin: digest prompt images through a vision model and expose a describe_image tool — without ever changing the session's model. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-plugin-vllm-ascend-profiler DSH plugin: parse vLLM-Ascend / Ascend NPU profiling artifacts, visualize Host/Device swimlanes plus cost shares, and emit structured, phase-aware optimization advice with Markdown/PDF export. | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-12 12:12 |
| dsh-token-live Composer readouts for the DSH: CJK-weighted draft token count, session spend at official peak/idle rates, context occupancy, and what the same usage would have cost on the costliest other model; client-only, with no host half and no credential access. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-ide-lite Lightweight IDE-in-the-sidebar plugin for the dsh web GUI: workspace file tree, agent-change review (accept/reject + undo), full editing with diff and rendered markdown, plus an integrated terminal view. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-launch-in-one-click A DSH plugin for Windows: writes a self-contained one-click launcher, and refuses to start a second instance when the target port already serves one. / 一个 Windows 专用的 DSH 插件:写入自包含的一键启动器;目标端口已有 Harness 实例时拒绝启动第二个。 | 需注意 | warn | 0/3/15 | 0/0 | 2026-09-12 12:12 |
| dsh-delete-session Real deletion for DSH Web conversations: a session-row menu action and a Workspaces-header batch dialog; removes each session's log directory and projection cache. 给 DSH Web 侧栏补上真正的会话删除:右键菜单删单条、区头批量删多条,删掉日志目录与投影缓存。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-12 12:12 |
| dsh-mobile-topbar DSH plugin: turns the sidebar into a compact top bar on mobile screens to save space | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| dsh-project-memory | 需注意 | warn | 0/1/6 | 0/0 | 2026-09-12 12:12 |
| dsh-tidecost | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-12 12:12 |
| I-am-Yuike 一个猫娘人格扮演插件(伪破限),去除dsh强制加入的附加提示词,只附带工具链和猫娘基准人格的插件 | 需注意 | warn | 0/3/3 | 0/3 | 2026-09-12 12:12 |
| Thalamus θάλαμος —— 荷马史诗里屋子里最深处的那个房间,也是大脑中接住情绪的那枚丘脑。AI 陪伴微信机器人:DSH 插件,让一个独立的微信号成为一个有性格、有生活、对你特殊的她。 | 需注意 | warn | 0/4/8 | 0/0 | 2026-09-12 12:12 |
| dsh-opencodego 在DSH中支持opencode支持GO订阅,包括模型获取以及能力设置、请求头自适应等 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-12 12:12 |
静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。
历史日报归档
28 期2026-09-12当前84 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么?
这份日报覆盖 2026-09-12 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。
风险等级是如何划分的?
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计?
日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。
来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于