每日安全扫描日报
日期 · 2026-09-14 (UTC,覆盖当日 00:00–24:00 新增入库的插件)
82
当日新增
1
严重
30
需注意
51
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| dsh-imgnav Click-to-zoom lightbox with arrow-key paging for DSH conversation images: ← prev / → next / Esc close, edge hints | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-wide-conversation DSH web client plugin: pins the conversation column to a configurable percentage of its width (default full width) instead of the built-in 680-920px reading measure. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-better-display DSH 沉浸式阅读视图(fork):执行步骤自动折叠 + MCP-App 交互沙箱,深度适配 dsh-retrace 撤回/重发节点展示 | 需注意 | warn | 0/6/1 | 0/0 | 2026-09-14 00:13 |
| subscription-logins dsh plugin: store and switch ChatGPT/Claude OAuth and Z.AI Coding Plan credentials in a Logins settings page | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| herdr-themes dsh plugin: the 18 herdr themes as Settings > Themes with live swatch cards and persistent selection | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| skill-mcp-manager dsh plugin: manage dsh skills and MCP servers from Settings > Skills & MCP, hot-reloaded without restarting the GUI | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-14 00:13 |
| configurable-subagents dsh plugin: default sub-agent provider, model, and reasoning effort plus per-delegation overrides | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| web-search-searxng dsh plugin: SEARXNG-backed web search provider for the dsh web_search tool (host-only, no Settings UI) | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 00:13 |
| context-before-user dsh plugin: keep injected runtime context and skill context as user-role turns before the human request | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| dsh-hyper-tools DSH plugin: keeps Charm Hyper model requests under the gateway's 10 MiB body cap by replacing the oldest images (newest survive) and retrying when the gateway rejects the body. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| system-prompt-editor dsh plugin: edit the assembled system prompt of every new session (custom text, persona, tool guidance) with live preview | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 00:13 |
| dsh-model-orchestrator Model routing for DSH, with a standing capability-to-model assignment table, per-route reasoning levels, and a user-triggered sync that researches public model prices. 为 DSH 提供模型路由:可持久化的「能力→模型」分工表、按路由的推理档位,以及手动触发、由模型联网核对公开价格的同步。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-14 00:13 |
| clear-session-history dsh plugin: clear session history from disk (workspace/all/session) with scoped, confirmed deletes | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-14 00:13 |
| dsh-code-poem dsh 插件 · 代码如诗:4598 条古诗词/成语/龙文鞭影典故随机成笺,随会话事件自动浮现 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-14 00:13 |
| yammory-system Cross-session user-profile memory for DSH: remembers who you are and how much you know, so the agent speaks at your level. Approval-gated, auditable, local SQLite. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 02:16 |
| dsh-better-uiux Better UIUX for DSH: one Settings section with switches for live terminal output streaming and custom CSS injection | 需注意 | warn | 0/4/12 | 0/0 | 2026-09-14 02:16 |
| dsh-multi-end | 需注意 | warn | 0/2/8 | 0/0 | 2026-09-14 02:16 |
| dsh-deepseek-web DSH 插件:侧边栏内嵌[chat.deepseek.com](https://chat.deepseek.com)网页版对话,无需 API Key,不消耗 DSH 会话 Token,支持 Web 与 Electron 桌面端。 | 需注意 | warn | 0/4/14 | 0/0 | 2026-09-14 02:16 |
| dsh-plugin-bootreport DSH 启动自报账本:web 启动时落一行「本进程加载了哪些插件构建」,判据 lib mtime vs 进程起点,一条命令答全生态「构建是否生效 / 谁需重启」 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-14 02:16 |
| yanxu-dsh-plugin | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-browser-panel A shared browser inside the DSH host: the AI drives it with browser_panel_* tools, and you watch or take over the same tab in the DSH Web UI — logins, 2FA, QR codes included. | 需注意 | warn | 0/4/11 | 0/0 | 2026-09-14 04:13 |
| dsh-solpi Four harness efficiency mechanisms (Action Fusion, ObservationPack, Evidence-Preserving Reducer, Online Context Compact) as a DSH bundle | 需注意 | warn | 0/2/1 | 0/0 | 2026-09-14 04:13 |
| compliance-skills Mechanical-check AI agent skills for contracts, invoices, tender/bidding documents and ad copy: every finding is recomputable evidence, fully offline, no model, no network. 合同、票据、招投标与广告文案的机械核对型 AI 技能(免费版源码)。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-approval-ai-review AI-reviewed auto-approval for DSH: safe tool asks granted automatically, risky ones escalated with the review attached | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-web-fetch-moli | 需注意 | warn | 0/4/11 | 0/0 | 2026-09-14 04:13 |
| dsh-geometry-knowledge 几何论(共扼谱几何 CSG)知识库插件 for DSH:纯离线 BM25 检索 251 篇文章 + 869 条真理,31 个 geo_* 工具,开箱即用。Conjugate Spectral Geometry knowledge base plugin for DSH. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 04:13 |
| dsh-session-reattach DSH 宿主插件:把游离(未分组)会话按 cwd 归位到匹配的工作区 —— 只改工作区归属记录,不碰会话文件;支持拖拽与 /reattach 命令(默认 dry-run)| DSH host plugin: re-attach ungrouped sessions to their matching workspace by cwd — ownership bookkeeping only, never rewriting session logs | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 04:13 |
| dsh-web-companion Chrome side panel that puts the DSH agent next to the page you are reading — read it, or let the agent work it. Built on DSH; not affiliated with or endorsed by DeepSeek. | 需注意 | warn | 0/7/12 | 0/0 | 2026-09-14 04:13 |
| dsh-weixin-channel 微信通道插件 for DSH:把微信消息接成 DSH 会话(文本/图片/文件/语音/视频双向,出站可推文档) | 需注意 | warn | 0/6/21 | 0/0 | 2026-09-14 04:13 |
| dsh-ide-git DSH plugin: an IDE-grade Git tool window as a native dsh-better-sidebar tab — branch tree, commit graph, changes, commit details, JetBrains-style actions, in the right sidebar and the bottom panel. | DSH 插件:IDE 级 Git 工具窗口,以 dsh-better-sidebar 原生 Tab 挂载——分支树 / 提交图谱 / 变更与提交详情 / JetBrains 风格操作,右侧栏与底部面板双布局自适应。 | 需注意 | warn | 0/1/21 | 0/0 | 2026-09-14 04:13 |
| dsh-plugins 自研 dsh 插件合集 · dsh-btw: 划选引用 / btw 临时会话 / 新上下文 / Provider 高级配置 | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-14 04:13 |
| dsh-memory-md 简单的纯依赖MD文件的记忆插件,实现思路参考CodeBuddy和WorkBuddy的实现 | 需注意 | warn | 0/1/4 | 0/0 | 2026-09-14 04:13 |
| dsh-fight-scene-director DSH ??:? Codex ?? fight-scene-director(??? AI ????????????)??? DSH ????,???? Seedance 2.0 / 2.5?MiniMax H3 ?????????? | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-improve-prompt 输入框一键增强提示词:直接替换 + 一键撤回,带保真闸(硬事实零丢失)与长度闸(防膨胀)。DSH plugin. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-farm-dispatch 子代理派发规范(吝啬农场主模式)全局化插件 for DSH — syncs cordis-async preset + AGENTS.md dispatch rules. dsh plugin add ready. | 需注意 | warn | 0/3/0 | 0/3 | 2026-09-14 06:13 |
| dsh-asset-library DSH 素材库插件:会话内容一键保存 + 自动采集,按时间/类型/会话/项目四轴归纳,本地 Markdown 存储,零运行时依赖。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 06:13 |
| dsh-caps-beacon Caps Lock LED status beacon for DSH — solid while agents work, blinking when your approval or answer is needed | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-14 06:13 |
| Arknights-flavor-theme Arknights theme skin for DSH. 适用于 DSH 的明日方舟主题皮肤。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-noname-kit DSH无名杀插件 无名杀扩展开发工坊:AI 按规范写武将技能与卡牌(确认协议/校验门禁/区块化写入) | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-14 06:13 |
| dsh-prompt-only-forge dsh-prompt-only-forge — 点输入框右座 ✨ 把「打磨提示词」写进输入栏(当前草稿自动嵌进 <内容> 位置),不发送、不联网、不调模型 | 需注意 | warn | 0/4/10 | 0/0 | 2026-09-14 06:13 |
| agent-skills-cn Bilingual (EN/CN) agent skills: email deliverability audit, competitor recon, resume localization CN→EN, delivery checklist — battle-tested domain workflows as open SKILL.md files. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-outbound-proxy DSH plugin: set a global outbound proxy from Settings | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-14 06:13 |
| dsh-drawio Standalone DSH plugin: preview .drawio (mxGraph XML) diagrams in the Web Sidebar. Does not bundle @deepseek-ai/* and does not use the harness build scripts. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 06:13 |
| dsh-rewind Undo what an agent did to a directory: content-addressed snapshots, one-command rewind, and an undo you can undo. Works in any folder — git or not. DSH plugin + skill, zero dependencies. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-14 06:13 |
| dsh-schedule-panel DSH ????:????? + schedule ??,???????;???????????(?? Typert Remote ?? + ??? ctx.remote) | 需注意 | warn | 0/4/16 | 0/0 | 2026-09-14 06:13 |
| competitor-recon Competitor research skill: complaint-driven recon with cited evidence from reviews, forums, and issue trackers — comparison table plus copy-worthy and skip lists. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-optimize Long-session resource control for DSH: measures the context every request carries, warns at configurable thresholds, can run the harness compaction engine over budget, and contains offscreen chat rows behind a toggle. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-14 08:15 |
| resume-localize-cn2en Resume localization skill (CN to EN): demographic fields stripped, duties become quantified outcomes, one spelling variant, ATS-parsable, full change log. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-lan-link Persistent token-gated LAN access for DSH Web | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-14 08:15 |
| dsh-courseware create pptx file based on template.pptx and a outline file | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-vision-3090-fix DSH LLM adapter that caps images per request to 1, for self-hosted vLLM backends that reject prompts with more than one image | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 08:15 |
| email-deliverability-audit Email deliverability audit skill: four sequential DNS gates classify addresses as sendable/risky/dead — every verdict traces to a query run that session. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-runninghub-api A plugin that integrates runninghub cloud ComfyUI workflows: a settings card for your API key and workflow library, seven `runninghub_*` tools for agents, a sha256 media upload cache, a local concurrency gate with FIFO queueing and timeouts, background tasks with completion notifications, and a durable task ledger with automatic restart recovery. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-14 08:15 |
| dsh-default-prompt | 需注意 | warn | 0/5/4 | 0/0 | 2026-09-14 08:15 |
| dsh-cliproxyapi Native Codex and Antigravity subscription accounts inside DSH, based on CLIProxyAPI | 需注意 | warn | 0/2/9 | 0/0 | 2026-09-14 08:15 |
| delivery-checklist Delivery checklist skill: verify deliverables by opening the real file — row/dedup counts, placeholder scan, baseline diff — and log every batch. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| self-evolving-router-dsh Self-evolving deterministic rule objects before DSH model calls | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-14 08:15 |
| dsh-gme-workflow GME Test Agent workflow tools for DSH: pick interfaces, generate and repair tests autonomously in a local Python backend, poll until review, decide with consent. | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-14 08:15 |
| mcp-cap What can this MCP server actually do — and has it changed since you trusted it? Inspect its declared capabilities, seal them in a lock file, and get told when a later version can do more. Never invokes a tool; gives the server a minimal environment. | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-14 08:15 |
| banbo-dsh | 需注意 | warn | 0/2/1 | 0/2 | 2026-09-14 08:15 |
| dsh-storyboard Doubao-style end-of-chat storyboard card for DSH: lightweight, zero-dependency HTML/SVG visual summary at the end of substantive chats | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-14 08:15 |
| report-link-verification Link verification skill: fetch every URL in a deliverable for real, retry bot walls, fix or cut failures — links in file must equal links in table. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| project-handoff Project handoff skill: a dated handoff.md per project — current state, decisions with reasons, pitfalls as symptom/cause/fix — so any fresh session resumes without archaeology. CN/EN. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 08:15 |
| dsh-missher-brain Shared, bounded recall coordination for DSH Memory and MSE providers. | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-14 10:13 |
| dsh-codex-adapter ChatGPT-powered coding, image generation and web search for DSH. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 10:13 |
| dsh-missher-enhance Independent enhancement bundle for DSH: usage, sessions, model helpers, documents and piano navigation. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-token-billing 给DSH Web GUI用的会话token计费插件:在会话标题栏显示本次会话的实时花费,点开可以看输入 / 缓存命中 / 缓存写入 / 输出 / 推理的分项、按模型的账单,以及当前用的是高峰还是空闲时段价。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-window-pin 一个小巧且轻量的置顶工具 | 需注意 | warn | 0/4/0 | 0/0 | 2026-09-14 10:13 |
| tirol-dsh-language-set [DSH] plugin, that separately controls the AI’s response language and thinking language through system prompt injection. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-labrador A Labrador | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-14 10:13 |
| dsh-llm-antigravity Antigravity route for DSH: local Antigravity CLI (agy) as an LLM provider | 需注意 | warn | 0/2/9 | 0/0 | 2026-09-14 10:13 |
| dsh-web-close DeepSeek-Harness插件,用于关闭dsh的web进程 | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-14 10:13 |
| dsh-reasoning-mode | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-14 10:13 |
| dsh-lost-and-found DSH plugin: local file recall - watch the folders you choose, index what appeared (name/type/size/appeared-at/location/origin) into a local SQLite database, then search by keyword/time/type/folder with a live read-only fallback scan. 文件快速寻回:DSH 本地文件记忆索引,忘了文件放哪问一句就能找回;每个目录各有独立增量锚点,新加入的目录首扫回填历史;只读,绝不修改、移动或删除你的文件。 | 需注意 | warn | 0/2/2 | 0/0 | 2026-09-14 12:14 |
| dsh-fonttune DSH 字体插件:正文/代码字体族、全局字号偏移、字重,以及西文/中文分栏选择。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 12:14 |
| dsh-plugin-h3-hip DSH Host plugin for h3-hip.c (--serve, protocol v1alpha) | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-14 12:14 |
| dsh-just-chat One-click native conversations with independent workspaces for DSH | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 12:14 |
| ctx-budget What will your agent's context cost before it runs? Audit instruction files, skills, MCP tool schemas and memory per source — with duplication, always-on versus on-demand costs, and a budget you can enforce in CI. Reads files and nothing else. | 严重 | fail | 2/0/1 | 0/0 | 2026-09-14 12:14 |
| DLT DLT (DeepSeek Light Tool) - a permanent DSH plugin: per-turn CNY cost, DeepSeek account balance, native PDF/Word/Excel/CSV read-write tools and right-sidebar previews, a hardcoded compiler/runtime registry with direct run/build tools, and a runtime master switch (DLT manager). | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-14 12:14 |
| dsh-momo-learning 墨墨背单词的 DSH 插件:本地学习镜像 MCP 工具 + 每日出题 Skill | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-14 12:14 |
| dsh-plugin-tic80 DSH plugin for TIC-80 fantasy console: full console capabilities, conversational code, music, map, and sprite generation by LLM, with native & live web execution. | 需注意 | warn | 1/5/0 | 0/0 | 2026-09-14 12:14 |
| OmaSeek OmaSeek: the Omarchy spirit and aesthetic. Now in DSH | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-14 12:14 |
静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。
历史日报归档
30 期2026-09-14当前82 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么?
这份日报覆盖 2026-09-14 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。
风险等级是如何划分的?
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计?
日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。
来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于