每日安全扫描日报
日期 · 2026-09-15 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
67
当日新增
2
严重
32
需注意
33
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| dsh-plugin-youcom You.com search + fetch provider plugin for DSH, plus a research-focused agent preset | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-15 00:13 |
| dsh-novel-launcher 在 DSH 界面放一个悬浮球：点开本地书单，用你自己的阅读器打开，窗口自动归位。 | 需注意 | warn | 0/4/3 | 0/0 | 2026-09-15 02:13 |
| DSHSwitch DSH 插件 — 在 DSH Web GUI 聊天输入框左侧添加可自定义的 switch 快捷按钮。 | 需注意 | warn | 0/1/6 | 0/0 | 2026-09-15 02:13 |
| DSH_Launch_Console DSH 的桌面外壳：静默启动 DSH 服务，并用锁定式窗口承载其 Web UI。 | 需注意 | warn | 0/3/4 | 0/0 | 2026-09-15 02:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-15 02:13 |
| deepseek-harness-enterprise Enterprise deployment template for DSH | 需注意 | warn | 0/16/10 | 0/0 | 2026-09-15 02:13 |
| dsh-memory-core DSH 记忆插件：四通道检索 + 演化闭环 + 分层治理；SQLite 单一事实源，替代 dsh-memory-evolve 的记忆/待办/技能三域 | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-fishpai 公众号排版工作台，长在 DSH 的右侧栏里。人在侧栏改字、加批注与占位；模型用块级 diff 看懂你改了什么、想要什么；成品仍由你复制粘贴进公众号编辑器。 | 需注意 | warn | 0/1/4 | 0/0 | 2026-09-15 02:13 |
| dsh-reasoning-merge | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 02:13 |
| dsh-wsl-im dsh plugin: Feishu / WeCom aibot / DingTalk Stream / QQ Gateway bridge into dsh agents (WSL) | 需注意 | warn | 0/1/13 | 0/0 | 2026-09-15 02:13 |
| dsh-community-plugins Unofficial DSH context guard and SearXNG search adapter maintained by xoykor | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-15 02:13 |
| dsh-plugin-devkit DevKit for DSH plugins — runtime inspector (/debug), isolated debug-boot, host contract tests without a browser, and client slot preview. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-15 02:13 |
| dsh-model-search dsh-plugin | 需注意 | warn | 0/4/21 | 0/0 | 2026-09-15 04:13 |
| dsh-model-picker-plus | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-15 04:13 |
| dsh-tavily-web DSH Tavily plugin: key-pooled web search (tavily_search) + page fetch (web_fetch) | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 04:13 |
| dsh-strata-custom A customized dsh-strata for the DSH Web GUI: the transcript's scrollbar becomes a to-scale, colour-coded map of the whole session. Derivative work of jsdvjx/dsh-strata (MIT). | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-find-plugins Find DSH plugins across several community catalogs, ranked by relevance × trust × freshness instead of stars alone. 跨多个社区目录查找 DSH 插件，按相关度 × 可信度 × 新鲜度排序，而不是只看 star。 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-web-search-nokey 给 DSH 的免 key 搜索插件，也可以修复接 Trae / WorkBuddy 积分时 web_search 恒 401。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-15 04:13 |
| dsh-font DSH plugin: customize the Web GUI fonts (interface font, code font, and font sizes) from Settings | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-15 04:13 |
| dsh-qboson-ising-solver A DSH Agent Tool for solving Ising problems with QBoson Kaiwu/SPQC. | 需注意 | warn | 0/1/10 | 0/0 | 2026-09-15 04:13 |
| dsh-cust-search Custom Web Search plugin for DSH, replacing web-search-deepseek with multi-engine sequential fallback. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-sidebar-ratio DSH plugin: sidebar widths as a window ratio, plus one shared right-side panel across a parent session group (parent -> subagents) | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-15 06:13 |
| dsh-theme-newsprint 报纸衬线 · Newsprint Serif — DSH 主题插件：暖白报纸 + 纯黑中性灰 + 衬线正文 + 报纸排版笔画 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| dsh-wechat | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-15 06:13 |
| dsh-compact-agents | 需注意 | warn | 0/2/11 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-tofu-box | 需注意 | warn | 0/3/17 | 0/0 | 2026-09-15 06:13 |
| dsh-animation-studio 给 DSH做的教学动画制作工作台插件：一套内置在教学会话里的"教学视频 agent"。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 06:13 |
| computer-use DSH computer-use 插件：让 agent 自己看屏幕、自己操作鼠标键盘（截屏/窗口/鼠标/键盘 6 工具），用于自主开发-验证-迭代闭环 | 需注意 | warn | 0/2/0 | 0/0 | 2026-09-15 06:13 |
| dsh-plugin-workbuddy-gateway Use a WorkBuddy subscription as a model provider in DSH: supervises the local OpenAI-compatible gateway and manages it from the settings page. | 需注意 | warn | 0/9/24 | 0/0 | 2026-09-15 08:13 |
| dsh-custom-headers Per-model custom request headers for DSH: define named header profiles in Settings → Plugins → Plugin configuration, pick one per model in the provider's model catalog, and every call to that model carries those headers. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-port-manager Native DSH sidebar app: every listening port on this machine, the app behind it, and one-click port actions. | 需注意 | warn | 0/2/12 | 0/0 | 2026-09-15 08:13 |
| dsh-llm-provider dsh LLM provider plugin: self-maintained pi-ai bridge, model selector, provider quota/billing and settings UI for DSH | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-memory Layered memory plugin for DSH: strictly separated project/global memory, host-driven recall before tasks and continuous learning after them. | 严重 | fail | 1/1/0 | 0/0 | 2026-09-15 08:13 |
| visualize | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 08:13 |
| dsh-sidebar-plus 基于 DSH 官方侧边栏的文件视图增强插件，提供源码视图、就地编辑、行号切换、搜索和字体缩放功能。A file-view enhancement plugin that extends the official DSH sidebar, providing source view, in-place editing, line-number toggle, search, and font zoom. | 需注意 | warn | 2/1/10 | 0/0 | 2026-09-15 08:13 |
| dsh-computer-use_codex-style Codex-style Computer Use for DSH: the official window2 13-method desktop surface plus Chromium automation, a visible overlay with Esc interrupt, per-app approvals and bundled skills. Windows, MIT, no Codex required. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 08:13 |
| dsh-left-panel Git worktree-aware workspace browser for the DSH Web sidebar: repositories group their worktrees, and worktree workspaces are registered and unregistered automatically. | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-15 08:13 |
| dsh-agent-mailbox DSH 跨 agent 信箱插件：mailbox_send/check/reply/list/done/broadcast + task_create/list，桥接 agent-mailbox，零依赖 Node 22 | 需注意 | warn | 0/2/0 | 0/0 | 2026-09-15 08:13 |
| dsh-skin-xuyuanwu | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-15 08:13 |
| dsh-plugin-usage DSHWeb 用量与费用看板插件：余额、今日/本周/本月/累计消费、API 请求次数、token 明细与趋势图，按 DeepSeek 官方峰谷价估算，数据从本地会话日志全量重建 | 需注意 | warn | 0/6/17 | 0/0 | 2026-09-15 10:13 |
| dsh-git-vcs DSH Web GUI 的 Git 版本管理插件：右侧栏新增「版本管理」页，功能与界面参照 IntelliJ IDEA 的 Version Control 工具窗（本地变更 / 提交 / 历史 / 分支 / 命令 / 贮藏）。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-mobile-keys DSH 移动端热键模式插件：自动检测移动端，Ctrl+Enter 发送 / Enter 换行；设置面板开关。Mobile hotkey mode plugin for DSH. | 需注意 | warn | 0/5/4 | 0/0 | 2026-09-15 10:13 |
| dsh-snippets | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-15 10:13 |
| dsh-deepseek-cost-watch DeepSeek off-peak alert, account balance and live Session cost estimate for the DSH Web UI | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-15 10:13 |
| dsh-model-metadata DSH plugin: match custom-gateway models to the model metadata they should have (context window, output cap, reasoning levels, vision) by bare model name — nothing written to your settings | 需注意 | warn | 0/5/18 | 0/0 | 2026-09-15 10:13 |
| dsh-yoimiya-theme | 需注意 | warn | 0/3/9 | 0/0 | 2026-09-15 10:13 |
| dsh-engineer-tools Engineering work-tools for DSH: a scoped git runner and a package-manager (npm/pnpm/yarn/bun) runner with structured output, plus an easy template to add more tools. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-workspace-promote DSH host plugin: promote the workspace you just submitted a task in to the top of the sidebar — once per submission, never during task execution. | 提交任务时把该工作区置顶，任务执行期间不重排。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-chicken-pet 🐔 A pixel chicken desktop pet for DSH — naps, paces, pecks and spins a basketball on its own, and reacts to your agent's work. Original procedurally-generated pixel art, no third-party assets. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-audio-read 让 AI Agent 听懂音频：转写、鸟种识别、语音情感、环境声与音乐分析。全部本地运行，不用大模型。DSH 技能。 | 需注意 | warn | 0/3/18 | 0/0 | 2026-09-15 10:13 |
| dsh-anchor ⚓ 定锚 · Anchor — DSH 会话指令定锚插件：为会话注入可自由组合的指令，并在压缩或长会话后自动重锚同一段原文 | 需注意 | warn | 1/0/1 | 0/0 | 2026-09-15 10:13 |
| dsh-plugin-followup 划词追问：选中回答文字右键追问，问答留在按会话独立的右侧面板，并从主对话隐藏该轮（DSH 插件） | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-task-engine Engineering workflow plugin for DSH: task stages, verification records, commit checks, and skill and rule management. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| open-source-first-skill Pragmatic Anti-Wheel-Reinvention Protocol for AI Coding Agents: Research First, Open-Source Ethics, and Tokenomics Advantage. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 10:13 |
| dsh-clinepass-deepseekv4.1 Cline Pass for DSH: one pi-ai provider route pinned to the DeepSeek upstream channel, key entered on Settings → Models. Share-only snapshot — 分享性质，非长期维护。 | 需注意 | warn | 0/5/4 | 0/0 | 2026-09-15 12:13 |
| dsh-lan 把只监听 127.0.0.1 的 dsh web 暴露到局域网，并带上移动端适配 —— 一个包，手机连上就能用（DSH 插件） | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-simple-restart | 需注意 | warn | 0/4/6 | 0/0 | 2026-09-15 12:13 |
| dsh-tool-guard Preset-agnostic global tool masking for DSH — presentation-layer filtering, execution-layer guard veto, self-protection gate and a WebUI editor. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-15 12:13 |
| self-evolving-router-dsh Self-evolving deterministic rule objects before DSH model calls | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-15 12:13 |
| dsh-session-colorful-unread-pin-jobs Colors every session title in the DSH sidebar by state — unread (blue running / green done), pinned (yellow), live background shell jobs (purple) — composed into one gradient; plus a "Model updated" sort mode and an unread settings section. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-15 12:13 |
| dsh-compose-panel | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-ds-tts 用 DeepSeek 官方朗读音色朗读 / 导出 / 接口化 | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-15 12:13 |
| dsh-attention-beep DSH 插件：任务结束或命令卡死时用本机人声提醒，自动中断卡住的 pwsh 调用并把「怎么继续」写回工具结果，并在 spawn 之前拦掉已知的性能陷阱写法。仅 Windows。 / Beeps + stuck-command watchdog + command guard for DSH. Windows only. | 需注意 | warn | 0/2/4 | 0/0 | 2026-09-15 12:13 |
| dsh-security 在 DSH 内等价重建 OpenAI codex-security 安全审计能力的原生插件 | 严重 | fail | 1/1/0 | 0/0 | 2026-09-15 12:13 |
| dsh-delete-session DSH 插件：在侧栏会话行的 ⋯ 菜单中增加「删除会话」（永久删除，不可恢复），不接管也不禁用任何官方插件行。 | DSH plugin: add a permanent "delete session" action to the sidebar session row menu, with zero official-row takeover. | 需注意 | warn | 0/2/6 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-audit Agent Skill for DSH：装第三方插件前的静态安全审计 —— 扫出 eval、patch 层 !!js、安装期脚本、开机自启、凭据复制、出网域名与提示词注入面。Audit third-party DSH plugins before installing. Works with DSH, Claude Code, Codex, Cursor & any Agent Skills compatible agent. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-15 12:13 |
| dsh-plugin-doctor Zero-dependency static + sandbox smoke detector for DSH plugins (R/K/D/CC layers) | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-15 13:52 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
31 期2026-09-15当前67 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-15 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在注册表中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于