每日安全扫描日报

日期 · 2026-09-18 (UTC,覆盖当日 00:00–24:00 新增入库的插件)

72
当日新增
0
严重
14
需注意
58
低风险
插件风险扫描结论C/W/I清单审计收录时间
@KSF1216/chinese-script-policy
Harness-neutral Traditional Chinese enforcer and offline converter (skill / DSH bundle / CLI). Checks one script axis one way at a time plus two filter axes: Cantonese colloquialisms and Japanese-only kanji and words. Converts 繁↔簡, 粵語→書面語, 日文→中文, each opt-in, plus an optional wording preference. Single-file offline HTML, no runtime deps.
需注意warn0/1/70/02026-09-18 00:13
@anthonyyu-verkada/dsh-mcp-client-plus
DSH MCP client bridge with OAuth 2.1, bounded connect/discovery timeouts, environment-indirected secrets, optional indefinite reconnection, and a mcp_status diagnostic tool
需注意warn0/3/80/02026-09-18 00:13
@YJLTF/dsh-vision-tool
一个 DSH 插件:为纯文本主模型补上识图能力。它把图片理解委托给你配置的一个小参数多模态模型,再把结果以文本形式交还给主模型;当活跃模型自身支持图片输入时,插件完全退避,原生多模态体验不受任何影响。
低风险pass0/0/00/02026-09-18 02:14
@dingchenhui0618-arch/dsh-imagegen-skill
Bundled imagegen skill for DSH: generate or edit raster images from the agent through any OpenAI-compatible GPT Image endpoint.
低风险pass0/0/00/02026-09-18 02:14
@maxesisnclaw/dsh-download-button
Download button for delivered-file cards in DSH / 给交付物文件卡片加下载按钮
低风险pass0/0/10/02026-09-18 02:14
@VDERR/echocat-skill-panel-3.0
DSH 技能调用审计 + 应用内 skill 管理器
需注意warn0/2/100/02026-09-18 02:14
@tianyaojiudi-prog/dsh-djy-xttsc
DSH 插件:把一段可在设置页随时改写的文字,作为全局系统提示词段注入到所有会话,含子代理与工作流内部子代理;文本与开关即时生效,无需重启。
低风险pass0/0/00/02026-09-18 04:13
@LLYlab/DBS
DBS (DSH BGM service) — 独立于 DET 的 DSH 音乐播放器插件:本地音乐库 + 浮动播放器 + AI 依任务控制播放。A standalone DSH BGM player plugin: local music library, floating player, AI-driven playback.
低风险pass0/0/30/02026-09-18 04:13
@jackchen13755/dsh-source-control
VS Code 式源代码管理面板(DSH 原生右侧栏标签):改动/暂存/提交/diff/分支切换与合并/抓取拉取推送/冲突清单/Git worktree,适配 DSH 0.1.6
低风险pass0/0/10/02026-09-18 04:13
@shkzhang/dsh-file-link-menu
低风险pass0/0/00/02026-09-18 04:13
@HaydenSmith1121/dsh-connect-trae-plus
dsh-connect-trae 加固分支(基于上游 dingminhua/dsh-connect-trae v2.0.4):插件自身启动失败时不再牵连整个 Harness。源码仓。
低风险pass0/0/00/02026-09-18 04:13
@jerry-l3/dsh-plugin-skill-picker
DSH 编辑器插件:在「+」按钮右侧新增 Skill 选择按钮,为下一条消息选择 Skill(不选/单选/多选),并支持把本地 md/txt 文件注册为仅当前会话可用的临时 Skill
低风险pass0/0/00/02026-09-18 04:13
@camplus360/agent-memory-bridge
需注意warn0/2/220/02026-09-18 04:13
@afterrealism/dsh-session-ctxmenu
DSH plugin: right-click a session/project row in the sidebar to open its Rename/Fork/Archive menu
低风险pass0/0/00/02026-09-18 04:13
@afterrealism/dsh-conn-dot
DSH plugin: green/red connection dot beside the sidebar brand showing WebSocket + liveness-probe health of dsh web
低风险pass0/0/10/02026-09-18 04:13
@DWJZ/dsh-allow
DSH 权限记忆插件:把某类命令加进允许列表,之后同类命令不再询问。 / Remember sandbox-escalation approvals so the same command prefix stops asking.
需注意warn0/1/50/02026-09-18 06:13
@DWJZ/dsh-restart
需注意warn0/3/40/02026-09-18 06:13
@HaydenSmith1121/dsh-session-cleanup
Archived-session cleanup for the dsh web client: per-row delete and delete-all over the real session logs
需注意warn0/10/530/02026-09-18 06:13
@HaydenSmith1121/dsh-excel-viewer
Spreadsheet preview for the DSH web client: xlsx / xlsm / xls / csv / tsv open as a read-only grid
低风险pass0/0/50/02026-09-18 06:13
@HaydenSmith1121/dsh-ark-plans
Volcengine Ark Agent Plan and Coding Plan model routes for DSH, with a session-header quota pill
低风险pass0/0/30/02026-09-18 06:13
@qilin-zhu/dsh-model-relay
把DSH里已经配好的模型中转出去,让其他项目可以使用。
低风险pass0/0/50/02026-09-18 06:13
@The-five-stooges/dsh-deepseek-usage
DSH plugin: DeepSeek balance row in the sidebar footer plus a popover with locally estimated usage charts and a per-model cost table
需注意warn0/1/90/02026-09-18 06:13
@DWJZ/dsh-balance
DSH 余额查询插件:用 /balance 命令在会话里查看 DeepSeek 账户余额。 / DeepSeek account balance as the /balance command.
低风险pass0/0/20/02026-09-18 06:13
@HaydenSmith1121/dsh-opencode-go-plus
OpenCode Go model provider for DSH - a maintained fork that keeps the model catalog reachable and configures itself from Settings > Models
低风险pass0/0/00/02026-09-18 06:13
@HaydenSmith1121/dsh-memory
Session-end memory for DSH: distils each turn into durable notes and recalls them per workspace
需注意warn0/2/30/02026-09-18 06:13
@AristotleAsborg/repo-autopilot-plugin
把 repo-autopilot 的只读检查注册成 DSH 工具|doctor / drill / acceptance / compare|只读、零凭证、零写入
低风险pass0/0/00/02026-09-18 06:13
@cccc12138/dsh-read-aloud
A speaker button beside the Like button: read any DSH reply aloud with the browser's own speech engine. · 在点赞旁加一个小喇叭,朗读 DSH 的回复。
低风险pass0/0/30/02026-09-18 08:13
@jackchen13755/dsh-file-tree
DSH 原生右侧栏文件面板:工作区文件树 + 官方预览(着色)+ 一键 @文件 引用到输入框,适配 DSH 0.1.6
低风险pass0/0/10/02026-09-18 08:13
@weifa860504-droid/dsh-greet-signoff
开场语与收尾语:每次回复固定开场/收尾,并在上下文接近上限时提示换新会话(DSH Web 插件)
低风险pass0/0/90/02026-09-18 08:13
@lifecoder1988/dsh-devspace
DevSpace nodes and remote-directory mirror Workspaces for the DSH: manage N MCP endpoints, adopt a remote directory as a local Workspace, and move files both ways
需注意warn0/4/60/02026-09-18 08:13
@lifecoder1988/dsh-mcp-manager
MCP server management for the DSH: register, edit, enable, disable and hot-mount MCP servers, with global defaults and per-project overrides
低风险pending0/0/00/02026-09-18 08:13
@lifecoder1988/dsh-agents-md-manager
AGENTS.md management for the DSH: every instruction level a Session loads in precedence order (user-global first, then project root to cwd), editable in place from a Settings page or from the model
低风险pending0/0/00/02026-09-18 08:13
@wzn16/dsh-auto-archive
Auto-archive for DSH: archive sessions idle beyond a threshold, with full archived-session management UI · DSH 自动归档插件
低风险pass0/0/20/02026-09-18 08:13
@lifecoder1988/dsh-skill-manager
Skill management for the DSH: browse, author, toggle and delete skills across project and user roots, from a Settings page or from the model
低风险pending0/0/00/02026-09-18 08:13
@usssserd/my-dsh-plugin
DSH插件test
低风险pass0/0/00/02026-09-18 08:13
@lifecoder1988/dsh-secrets-manager
Project secret management for the DSH: monorepo .env discovery, comment-preserving edits, and a DSH_ENV_FILES pointer your shell commands can source
低风险pass0/0/40/02026-09-18 08:13
@hoyyang/dsh-glm-mode
GLM Mode: fully tuned coding agent preset for zhipuai/glm-5.3-flash in DSH — PTC presentation, guard family, isolated compaction
低风险pass0/0/80/02026-09-18 08:13
@wzn16/dsh-task-capsule
DSH cockpit duo: session-header task capsule + task notification card (sound/system notify) · DSH 任务胶囊与通知插件
低风险pass0/0/10/02026-09-18 08:13
@cn-scuo-oo/dsh-session-auto-title
DSH plugin: re-title a session after every turn in the MMDD|类型|主题 convention
低风险pass0/0/00/02026-09-18 08:13
@kovey/dsh-engineering-suite
Engineering suite for DSH: seven plugins covering roles, specifications, test design, quality gates, evidence, audit trail and pipeline orchestration
需注意warn0/2/00/02026-09-18 08:13
@Cumeskey/dsh-ssh-remote-tunnel
需注意warn0/3/70/02026-09-18 08:13
@Qihang-He/dsh-nyanko-sensei
Nyanko-sensei desktop pet plugin for DSH Web: a round calico cat that idles, naps, wanders, reacts to clicks with a voice line, and follows agent activity. DSH 桌宠插件:娘口三三/猫咪老师。
低风险pass0/0/00/02026-09-18 10:13
@mingzhicode/dsh-interactive-terminal
Persistent Bash terminals for DSH, letting humans take over and continue model-started sessions through an xterm.js UI.
低风险pass0/0/00/02026-09-18 10:13
@curtainsmall/dsh-reckoner
Electrical & electronics calculation plugin for the DSH. 面向 DSH 的电气电子计算插件。
低风险pending0/0/00/02026-09-18 10:13
@let-mi-think/wechat-agent-router
低风险pass0/0/30/02026-09-18 10:13
@let-mi-think/agent-manager
低风险pass0/0/40/02026-09-18 10:13
@HaydenSmith1121/dsh-codex-provider
Codex (ChatGPT) model provider for DSH - serves the ChatGPT subscription models the Codex CLI uses, over OAuth session credentials instead of an API key
低风险pass0/0/40/02026-09-18 10:13
@jiawei322/dsh-pi-catalog-sync
Sync the pi.dev model catalog into DSH llm-pi-ai provider routes through the official settings seam — no source patch — including mixed-protocol routes like OpenRouter, where new models land on a companion route while the built-in route stays untouched.
低风险pass0/0/10/02026-09-18 10:13
@xmzd-S/dsh-youdaonote
dsh plugin about youdaonote
需注意warn2/2/20/02026-09-18 10:13
@winston-hoo/dsh-spec-ponytail
DietrichGebert/ponytail — 懒惰 senior 模式,hook注入,迁移成dsh
低风险pass0/0/10/02026-09-18 10:13
@fu827707013/dsh-model-health-probe
DSH 模型健康检查:会话视图页签,选定供应商/协议/模型/路由后手动发真实裸 HTTP 请求,一屏看耗时、TTFT、状态、token 与三层诊断链。
低风险pass0/0/40/02026-09-18 10:13
@wmw343/dsh-resume-expert
引导式简历生成插件:对话式四阶段 + A4 PDF 直出,双宿主验证
低风险pass0/0/10/02026-09-18 10:13
@HaydenSmith1121/dsh-wallhaven-wallpaper
DSH 插件:从 wallhaven.cc 搜图并铺成 GUI 背景,图片全由宿主端取回(支持代理,浏览器无需能访问 wallhaven),可一键下载原图。零运行时依赖。
需注意warn0/2/100/02026-09-18 10:13
@ajceee/dsh-subscription-overlay
低风险pass0/0/160/02026-09-18 10:13
@asxiuxiu/dsh-quick-open
DSH Web GUI plugin: VSCode-style Ctrl+P quick open — indexed workspace file search, sidebar editor open, conversation reference insert
低风险pass0/0/50/02026-09-18 10:13
@Noob-stupid/dsh-plugin-gating-hub
DSH 插件管理面板:一键启用/停用插件 + GitHub dsh-plugin 插件市场+自定义插件索引/市场,带插件详情与一键安装,一键框架升级自动回滚,插件升级门控 | Plugin manager & marketplace for DSH
低风险pass0/0/00/02026-09-18 10:13
@rebornace/dsh-tracescope
基于 Git 代码差异智能缩减手工测试范围,支持 Web / 移动端操作录制与崩溃日志采集,依托 DSH AI 自动生成可复现缺陷流程,实现变更驱动的手工测试闭环提效插件。A DSH native test assistant plugin. It intelligently narrows manual test scope via Git diff, records web & mobile operation tracks and crash logs, and generates reproducible bug steps through AI analysis to close manual testing workflow efficiently.
低风险pass0/0/00/02026-09-18 10:13
@yumusb/dsh-opencode-go-plus
低风险pass0/0/40/02026-09-18 12:13
@GooDAnDReaDY/dsh-session-search
DSH agent tool (session_search) for full-text search across historical sessions
低风险pass0/0/00/02026-09-18 12:13
@neufagents/dsh-healthcheck
Runtime health check for DSH: session-library scan + crash-tail inspection. Read-only.
低风险pass0/0/00/02026-09-18 12:13
@Lukeknow0/dsh-markdown-link-preview
Preview DSH Markdown output links inside Better Sidebar instead of an external app.
低风险pass0/0/20/02026-09-18 12:13
@Arcadia822/dsh-tmp-hook
One-time ephemeral webhook plugin for DSH sessions: mint a single-use callback URL, then wake the requesting agent session with the delivered payload.
低风险pass0/0/00/02026-09-18 12:13
@NEVSTOP-LAB/dsh-import-vscode-ai-files
Load VSCode/Copilot AI configuration (.github/copilot-instructions.md, .github/instructions, .github/skills) into DSH sessions.
低风险pass0/0/10/02026-09-18 12:13
@athif23/dsh-shell-select
DSH plugin: one model-facing shell tool whose shell (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish, sh) is a user setting, with a Web settings card and a fail-closed refusal when the sandbox cannot confine it.
低风险pass0/0/30/02026-09-18 12:13
@elmersky/dsh-plugin-trellis-workflow
Trellis workflow enforcement for the DSH: per-turn workflow state injection and a trellis-start entry gate, replacing the session-start and user-prompt hooks dsh does not ship.
低风险pass0/0/00/02026-09-18 12:13
@yukitakasama/dsh-context-lens
Single-session context anatomy for the DSH Web GUI: attribution, headroom planning, and a context x trajectory timeline — not another usage ledger.
低风险pass0/0/10/02026-09-18 12:13
@KylinQ01/dsh-startup-animation
🌸 给 DSH 的开机动画 + 主界面壁纸:多层动效 + 鼠标视差,两张图可在设置里自由更换并实时预览
低风险pass0/0/60/02026-09-18 12:13
@leolee9086/dsh-tool-cordis-local
DSH 独立创造模式工具集:不注册进程级 inspect provider,让创造模式预设可以被复制
低风险pass0/0/00/02026-09-18 12:13
@OnTheWay111/dsh-plugin-path-completion
DSH path completion(DSH @文件名自动补齐和发现)
低风险pass0/0/30/02026-09-18 12:13
@wuuuuu123-32/physics-lab-report
低风险pass0/0/00/02026-09-18 12:13
@frederico-kluser/dsh-worktree-jump
DSH plugin: a web-UI button that creates a git worktree and moves the conversation into it (session fork with the worktree as cwd)
低风险pass0/0/00/02026-09-18 12:13
@whyself/Amadeus
Amadeus: a web workspace for DSH with cloud and web agents, online code editing, PDF/Office/Markdown/LaTeX previews, TeX compilation, file management, and an integrated terminal.
低风险pass0/0/20/02026-09-18 12:13

静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。

历史日报归档

33 期
← 返回安全报告

这份日报覆盖什么?

这份日报覆盖 2026-09-18 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。

风险等级是如何划分的?

风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。

为什么这不是完整安全审计?

日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。

来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于

这页有帮助吗?