每日安全扫描日报

日期 · 2026-09-14 (UTC,覆盖当日 00:00–24:00 新增入库的插件)

82
当日新增
1
严重
30
需注意
51
低风险
插件风险扫描结论C/W/I清单审计收录时间
dsh-imgnav
Click-to-zoom lightbox with arrow-key paging for DSH conversation images: ← prev / → next / Esc close, edge hints
低风险pass0/0/00/02026-09-14 00:13
dsh-wide-conversation
DSH web client plugin: pins the conversation column to a configurable percentage of its width (default full width) instead of the built-in 680-920px reading measure.
低风险pass0/0/00/02026-09-14 00:13
dsh-better-display
DSH 沉浸式阅读视图(fork):执行步骤自动折叠 + MCP-App 交互沙箱,深度适配 dsh-retrace 撤回/重发节点展示
需注意warn0/6/10/02026-09-14 00:13
subscription-logins
dsh plugin: store and switch ChatGPT/Claude OAuth and Z.AI Coding Plan credentials in a Logins settings page
低风险pass0/0/30/02026-09-14 00:13
herdr-themes
dsh plugin: the 18 herdr themes as Settings > Themes with live swatch cards and persistent selection
低风险pass0/0/30/02026-09-14 00:13
skill-mcp-manager
dsh plugin: manage dsh skills and MCP servers from Settings > Skills & MCP, hot-reloaded without restarting the GUI
需注意warn0/2/70/02026-09-14 00:13
configurable-subagents
dsh plugin: default sub-agent provider, model, and reasoning effort plus per-delegation overrides
低风险pass0/0/30/02026-09-14 00:13
web-search-searxng
dsh plugin: SEARXNG-backed web search provider for the dsh web_search tool (host-only, no Settings UI)
低风险pass0/0/20/02026-09-14 00:13
context-before-user
dsh plugin: keep injected runtime context and skill context as user-role turns before the human request
低风险pass0/0/00/02026-09-14 00:13
dsh-hyper-tools
DSH plugin: keeps Charm Hyper model requests under the gateway's 10 MiB body cap by replacing the oldest images (newest survive) and retrying when the gateway rejects the body.
低风险pass0/0/00/02026-09-14 00:13
system-prompt-editor
dsh plugin: edit the assembled system prompt of every new session (custom text, persona, tool guidance) with live preview
低风险pass0/0/30/02026-09-14 00:13
dsh-model-orchestrator
Model routing for DSH, with a standing capability-to-model assignment table, per-route reasoning levels, and a user-triggered sync that researches public model prices. 为 DSH 提供模型路由:可持久化的「能力→模型」分工表、按路由的推理档位,以及手动触发、由模型联网核对公开价格的同步。
低风险pass0/0/10/02026-09-14 00:13
clear-session-history
dsh plugin: clear session history from disk (workspace/all/session) with scoped, confirmed deletes
低风险pass0/0/50/02026-09-14 00:13
dsh-code-poem
dsh 插件 · 代码如诗:4598 条古诗词/成语/龙文鞭影典故随机成笺,随会话事件自动浮现
低风险pending0/0/00/02026-09-14 00:13
yammory-system
Cross-session user-profile memory for DSH: remembers who you are and how much you know, so the agent speaks at your level. Approval-gated, auditable, local SQLite.
低风险pass0/0/30/02026-09-14 02:16
dsh-better-uiux
Better UIUX for DSH: one Settings section with switches for live terminal output streaming and custom CSS injection
需注意warn0/4/120/02026-09-14 02:16
dsh-multi-end
需注意warn0/2/80/02026-09-14 02:16
dsh-deepseek-web
DSH 插件:侧边栏内嵌[chat.deepseek.com](https://chat.deepseek.com)网页版对话,无需 API Key,不消耗 DSH 会话 Token,支持 Web 与 Electron 桌面端。
需注意warn0/4/140/02026-09-14 02:16
dsh-plugin-bootreport
DSH 启动自报账本:web 启动时落一行「本进程加载了哪些插件构建」,判据 lib mtime vs 进程起点,一条命令答全生态「构建是否生效 / 谁需重启」
低风险pass0/0/10/02026-09-14 02:16
yanxu-dsh-plugin
低风险pass0/0/00/02026-09-14 04:13
dsh-browser-panel
A shared browser inside the DSH host: the AI drives it with browser_panel_* tools, and you watch or take over the same tab in the DSH Web UI — logins, 2FA, QR codes included.
需注意warn0/4/110/02026-09-14 04:13
dsh-solpi
Four harness efficiency mechanisms (Action Fusion, ObservationPack, Evidence-Preserving Reducer, Online Context Compact) as a DSH bundle
需注意warn0/2/10/02026-09-14 04:13
compliance-skills
Mechanical-check AI agent skills for contracts, invoices, tender/bidding documents and ad copy: every finding is recomputable evidence, fully offline, no model, no network. 合同、票据、招投标与广告文案的机械核对型 AI 技能(免费版源码)。
低风险pass0/0/00/02026-09-14 04:13
dsh-approval-ai-review
AI-reviewed auto-approval for DSH: safe tool asks granted automatically, risky ones escalated with the review attached
低风险pass0/0/00/02026-09-14 04:13
dsh-web-fetch-moli
需注意warn0/4/110/02026-09-14 04:13
dsh-geometry-knowledge
几何论(共扼谱几何 CSG)知识库插件 for DSH:纯离线 BM25 检索 251 篇文章 + 869 条真理,31 个 geo_* 工具,开箱即用。Conjugate Spectral Geometry knowledge base plugin for DSH.
低风险pass0/0/00/02026-09-14 04:13
dsh-session-reattach
DSH 宿主插件:把游离(未分组)会话按 cwd 归位到匹配的工作区 —— 只改工作区归属记录,不碰会话文件;支持拖拽与 /reattach 命令(默认 dry-run)| DSH host plugin: re-attach ungrouped sessions to their matching workspace by cwd — ownership bookkeeping only, never rewriting session logs
低风险pass0/0/20/02026-09-14 04:13
dsh-web-companion
Chrome side panel that puts the DSH agent next to the page you are reading — read it, or let the agent work it. Built on DSH; not affiliated with or endorsed by DeepSeek.
需注意warn0/7/120/02026-09-14 04:13
dsh-weixin-channel
微信通道插件 for DSH:把微信消息接成 DSH 会话(文本/图片/文件/语音/视频双向,出站可推文档)
需注意warn0/6/210/02026-09-14 04:13
dsh-ide-git
DSH plugin: an IDE-grade Git tool window as a native dsh-better-sidebar tab — branch tree, commit graph, changes, commit details, JetBrains-style actions, in the right sidebar and the bottom panel. | DSH 插件:IDE 级 Git 工具窗口,以 dsh-better-sidebar 原生 Tab 挂载——分支树 / 提交图谱 / 变更与提交详情 / JetBrains 风格操作,右侧栏与底部面板双布局自适应。
需注意warn0/1/210/02026-09-14 04:13
dsh-plugins
自研 dsh 插件合集 · dsh-btw: 划选引用 / btw 临时会话 / 新上下文 / Provider 高级配置
低风险pass0/0/50/02026-09-14 04:13
dsh-memory-md
简单的纯依赖MD文件的记忆插件,实现思路参考CodeBuddy和WorkBuddy的实现
需注意warn0/1/40/02026-09-14 04:13
dsh-fight-scene-director
DSH ??:? Codex ?? fight-scene-director(??? AI ????????????)??? DSH ????,???? Seedance 2.0 / 2.5?MiniMax H3 ??????????
低风险pass0/0/00/02026-09-14 06:13
dsh-improve-prompt
输入框一键增强提示词:直接替换 + 一键撤回,带保真闸(硬事实零丢失)与长度闸(防膨胀)。DSH plugin.
低风险pass0/0/00/02026-09-14 06:13
dsh-farm-dispatch
子代理派发规范(吝啬农场主模式)全局化插件 for DSH — syncs cordis-async preset + AGENTS.md dispatch rules. dsh plugin add ready.
需注意warn0/3/00/32026-09-14 06:13
dsh-asset-library
DSH 素材库插件:会话内容一键保存 + 自动采集,按时间/类型/会话/项目四轴归纳,本地 Markdown 存储,零运行时依赖。
低风险pass0/0/20/02026-09-14 06:13
dsh-caps-beacon
Caps Lock LED status beacon for DSH — solid while agents work, blinking when your approval or answer is needed
需注意warn0/1/00/02026-09-14 06:13
Arknights-flavor-theme
Arknights theme skin for DSH. 适用于 DSH 的明日方舟主题皮肤。
低风险pass0/0/00/02026-09-14 06:13
dsh-noname-kit
DSH无名杀插件 无名杀扩展开发工坊:AI 按规范写武将技能与卡牌(确认协议/校验门禁/区块化写入)
低风险pass0/0/50/02026-09-14 06:13
dsh-prompt-only-forge
dsh-prompt-only-forge — 点输入框右座 ✨ 把「打磨提示词」写进输入栏(当前草稿自动嵌进 <内容> 位置),不发送、不联网、不调模型
需注意warn0/4/100/02026-09-14 06:13
agent-skills-cn
Bilingual (EN/CN) agent skills: email deliverability audit, competitor recon, resume localization CN→EN, delivery checklist — battle-tested domain workflows as open SKILL.md files.
低风险pass0/0/00/02026-09-14 06:13
dsh-outbound-proxy
DSH plugin: set a global outbound proxy from Settings
低风险pass0/0/60/02026-09-14 06:13
dsh-drawio
Standalone DSH plugin: preview .drawio (mxGraph XML) diagrams in the Web Sidebar. Does not bundle @deepseek-ai/* and does not use the harness build scripts.
低风险pass0/0/00/02026-09-14 06:13
dsh-rewind
Undo what an agent did to a directory: content-addressed snapshots, one-command rewind, and an undo you can undo. Works in any folder — git or not. DSH plugin + skill, zero dependencies.
需注意warn0/1/00/02026-09-14 06:13
dsh-schedule-panel
DSH ????:????? + schedule ??,???????;???????????(?? Typert Remote ?? + ??? ctx.remote)
需注意warn0/4/160/02026-09-14 06:13
competitor-recon
Competitor research skill: complaint-driven recon with cited evidence from reviews, forums, and issue trackers — comparison table plus copy-worthy and skip lists. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
dsh-optimize
Long-session resource control for DSH: measures the context every request carries, warns at configurable thresholds, can run the harness compaction engine over budget, and contains offscreen chat rows behind a toggle.
低风险pass0/0/30/02026-09-14 08:15
resume-localize-cn2en
Resume localization skill (CN to EN): demographic fields stripped, duties become quantified outcomes, one spelling variant, ATS-parsable, full change log. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
dsh-lan-link
Persistent token-gated LAN access for DSH Web
需注意warn0/1/50/02026-09-14 08:15
dsh-courseware
create pptx file based on template.pptx and a outline file
低风险pass0/0/00/02026-09-14 08:15
dsh-vision-3090-fix
DSH LLM adapter that caps images per request to 1, for self-hosted vLLM backends that reject prompts with more than one image
低风险pass0/0/20/02026-09-14 08:15
email-deliverability-audit
Email deliverability audit skill: four sequential DNS gates classify addresses as sendable/risky/dead — every verdict traces to a query run that session. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
dsh-runninghub-api
A plugin that integrates runninghub cloud ComfyUI workflows: a settings card for your API key and workflow library, seven `runninghub_*` tools for agents, a sha256 media upload cache, a local concurrency gate with FIFO queueing and timeouts, background tasks with completion notifications, and a durable task ledger with automatic restart recovery.
低风险pass0/0/10/02026-09-14 08:15
dsh-default-prompt
需注意warn0/5/40/02026-09-14 08:15
dsh-cliproxyapi
Native Codex and Antigravity subscription accounts inside DSH, based on CLIProxyAPI
需注意warn0/2/90/02026-09-14 08:15
delivery-checklist
Delivery checklist skill: verify deliverables by opening the real file — row/dedup counts, placeholder scan, baseline diff — and log every batch. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
self-evolving-router-dsh
Self-evolving deterministic rule objects before DSH model calls
低风险pass0/0/60/02026-09-14 08:15
dsh-gme-workflow
GME Test Agent workflow tools for DSH: pick interfaces, generate and repair tests autonomously in a local Python backend, poll until review, decide with consent.
需注意warn0/1/30/02026-09-14 08:15
mcp-cap
What can this MCP server actually do — and has it changed since you trusted it? Inspect its declared capabilities, seal them in a lock file, and get told when a later version can do more. Never invokes a tool; gives the server a minimal environment.
需注意warn0/1/30/02026-09-14 08:15
banbo-dsh
需注意warn0/2/10/22026-09-14 08:15
dsh-storyboard
Doubao-style end-of-chat storyboard card for DSH: lightweight, zero-dependency HTML/SVG visual summary at the end of substantive chats
低风险pass0/0/10/02026-09-14 08:15
report-link-verification
Link verification skill: fetch every URL in a deliverable for real, retry bot walls, fix or cut failures — links in file must equal links in table. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
project-handoff
Project handoff skill: a dated handoff.md per project — current state, decisions with reasons, pitfalls as symptom/cause/fix — so any fresh session resumes without archaeology. CN/EN.
低风险pass0/0/00/02026-09-14 08:15
dsh-missher-brain
Shared, bounded recall coordination for DSH Memory and MSE providers.
低风险pass0/0/60/02026-09-14 10:13
dsh-codex-adapter
ChatGPT-powered coding, image generation and web search for DSH.
低风险pass0/0/20/02026-09-14 10:13
dsh-missher-enhance
Independent enhancement bundle for DSH: usage, sessions, model helpers, documents and piano navigation.
低风险pass0/0/00/02026-09-14 10:13
dsh-token-billing
给DSH Web GUI用的会话token计费插件:在会话标题栏显示本次会话的实时花费,点开可以看输入 / 缓存命中 / 缓存写入 / 输出 / 推理的分项、按模型的账单,以及当前用的是高峰还是空闲时段价。
低风险pass0/0/00/02026-09-14 10:13
dsh-window-pin
一个小巧且轻量的置顶工具
需注意warn0/4/00/02026-09-14 10:13
tirol-dsh-language-set
[DSH] plugin, that separately controls the AI’s response language and thinking language through system prompt injection.
低风险pass0/0/00/02026-09-14 10:13
dsh-labrador
A Labrador
需注意warn0/1/50/02026-09-14 10:13
dsh-llm-antigravity
Antigravity route for DSH: local Antigravity CLI (agy) as an LLM provider
需注意warn0/2/90/02026-09-14 10:13
dsh-web-close
DeepSeek-Harness插件,用于关闭dsh的web进程
低风险pass0/0/60/02026-09-14 10:13
dsh-reasoning-mode
低风险pass0/0/00/02026-09-14 10:13
dsh-lost-and-found
DSH plugin: local file recall - watch the folders you choose, index what appeared (name/type/size/appeared-at/location/origin) into a local SQLite database, then search by keyword/time/type/folder with a live read-only fallback scan. 文件快速寻回:DSH 本地文件记忆索引,忘了文件放哪问一句就能找回;每个目录各有独立增量锚点,新加入的目录首扫回填历史;只读,绝不修改、移动或删除你的文件。
需注意warn0/2/20/02026-09-14 12:14
dsh-fonttune
DSH 字体插件:正文/代码字体族、全局字号偏移、字重,以及西文/中文分栏选择。
低风险pass0/0/20/02026-09-14 12:14
dsh-plugin-h3-hip
DSH Host plugin for h3-hip.c (--serve, protocol v1alpha)
需注意warn0/1/70/02026-09-14 12:14
dsh-just-chat
One-click native conversations with independent workspaces for DSH
低风险pass0/0/20/02026-09-14 12:14
ctx-budget
What will your agent's context cost before it runs? Audit instruction files, skills, MCP tool schemas and memory per source — with duplication, always-on versus on-demand costs, and a budget you can enforce in CI. Reads files and nothing else.
严重fail2/0/10/02026-09-14 12:14
DLT
DLT (DeepSeek Light Tool) - a permanent DSH plugin: per-turn CNY cost, DeepSeek account balance, native PDF/Word/Excel/CSV read-write tools and right-sidebar previews, a hardcoded compiler/runtime registry with direct run/build tools, and a runtime master switch (DLT manager).
需注意warn0/2/70/02026-09-14 12:14
dsh-momo-learning
墨墨背单词的 DSH 插件:本地学习镜像 MCP 工具 + 每日出题 Skill
低风险pass0/0/10/02026-09-14 12:14
dsh-plugin-tic80
DSH plugin for TIC-80 fantasy console: full console capabilities, conversational code, music, map, and sprite generation by LLM, with native & live web execution.
需注意warn1/5/00/02026-09-14 12:14
OmaSeek
OmaSeek: the Omarchy spirit and aesthetic. Now in DSH
低风险pass0/0/20/02026-09-14 12:14

静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。

历史日报归档

30 期
← 返回安全报告

这份日报覆盖什么?

这份日报覆盖 2026-09-14 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。

风险等级是如何划分的?

风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。

为什么这不是完整安全审计?

日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。

来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于

这页有帮助吗?