每日安全扫描日报
日期 · 2026-09-18 (UTC,覆盖当日 00:00–24:00 新增入库的插件)
72
当日新增
0
严重
14
需注意
58
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @KSF1216/chinese-script-policy Harness-neutral Traditional Chinese enforcer and offline converter (skill / DSH bundle / CLI). Checks one script axis one way at a time plus two filter axes: Cantonese colloquialisms and Japanese-only kanji and words. Converts 繁↔簡, 粵語→書面語, 日文→中文, each opt-in, plus an optional wording preference. Single-file offline HTML, no runtime deps. | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-18 00:13 |
| @anthonyyu-verkada/dsh-mcp-client-plus DSH MCP client bridge with OAuth 2.1, bounded connect/discovery timeouts, environment-indirected secrets, optional indefinite reconnection, and a mcp_status diagnostic tool | 需注意 | warn | 0/3/8 | 0/0 | 2026-09-18 00:13 |
| @YJLTF/dsh-vision-tool 一个 DSH 插件:为纯文本主模型补上识图能力。它把图片理解委托给你配置的一个小参数多模态模型,再把结果以文本形式交还给主模型;当活跃模型自身支持图片输入时,插件完全退避,原生多模态体验不受任何影响。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @dingchenhui0618-arch/dsh-imagegen-skill Bundled imagegen skill for DSH: generate or edit raster images from the agent through any OpenAI-compatible GPT Image endpoint. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 02:14 |
| @maxesisnclaw/dsh-download-button Download button for delivered-file cards in DSH / 给交付物文件卡片加下载按钮 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 02:14 |
| @VDERR/echocat-skill-panel-3.0 DSH 技能调用审计 + 应用内 skill 管理器 | 需注意 | warn | 0/2/10 | 0/0 | 2026-09-18 02:14 |
| @tianyaojiudi-prog/dsh-djy-xttsc DSH 插件:把一段可在设置页随时改写的文字,作为全局系统提示词段注入到所有会话,含子代理与工作流内部子代理;文本与开关即时生效,无需重启。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @LLYlab/DBS DBS (DSH BGM service) — 独立于 DET 的 DSH 音乐播放器插件:本地音乐库 + 浮动播放器 + AI 依任务控制播放。A standalone DSH BGM player plugin: local music library, floating player, AI-driven playback. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 04:13 |
| @jackchen13755/dsh-source-control VS Code 式源代码管理面板(DSH 原生右侧栏标签):改动/暂存/提交/diff/分支切换与合并/抓取拉取推送/冲突清单/Git worktree,适配 DSH 0.1.6 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @shkzhang/dsh-file-link-menu | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @HaydenSmith1121/dsh-connect-trae-plus dsh-connect-trae 加固分支(基于上游 dingminhua/dsh-connect-trae v2.0.4):插件自身启动失败时不再牵连整个 Harness。源码仓。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @jerry-l3/dsh-plugin-skill-picker DSH 编辑器插件:在「+」按钮右侧新增 Skill 选择按钮,为下一条消息选择 Skill(不选/单选/多选),并支持把本地 md/txt 文件注册为仅当前会话可用的临时 Skill | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @camplus360/agent-memory-bridge | 需注意 | warn | 0/2/22 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-session-ctxmenu DSH plugin: right-click a session/project row in the sidebar to open its Rename/Fork/Archive menu | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 04:13 |
| @afterrealism/dsh-conn-dot DSH plugin: green/red connection dot beside the sidebar brand showing WebSocket + liveness-probe health of dsh web | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 04:13 |
| @DWJZ/dsh-allow DSH 权限记忆插件:把某类命令加进允许列表,之后同类命令不再询问。 / Remember sandbox-escalation approvals so the same command prefix stops asking. | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-restart | 需注意 | warn | 0/3/4 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-session-cleanup Archived-session cleanup for the dsh web client: per-row delete and delete-all over the real session logs | 需注意 | warn | 0/10/53 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-excel-viewer Spreadsheet preview for the DSH web client: xlsx / xlsm / xls / csv / tsv open as a read-only grid | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-ark-plans Volcengine Ark Agent Plan and Coding Plan model routes for DSH, with a session-header quota pill | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 06:13 |
| @qilin-zhu/dsh-model-relay 把DSH里已经配好的模型中转出去,让其他项目可以使用。 | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-18 06:13 |
| @The-five-stooges/dsh-deepseek-usage DSH plugin: DeepSeek balance row in the sidebar footer plus a popover with locally estimated usage charts and a per-model cost table | 需注意 | warn | 0/1/9 | 0/0 | 2026-09-18 06:13 |
| @DWJZ/dsh-balance DSH 余额查询插件:用 /balance 命令在会话里查看 DeepSeek 账户余额。 / DeepSeek account balance as the /balance command. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-opencode-go-plus OpenCode Go model provider for DSH - a maintained fork that keeps the model catalog reachable and configures itself from Settings > Models | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @HaydenSmith1121/dsh-memory Session-end memory for DSH: distils each turn into durable notes and recalls them per workspace | 需注意 | warn | 0/2/3 | 0/0 | 2026-09-18 06:13 |
| @AristotleAsborg/repo-autopilot-plugin 把 repo-autopilot 的只读检查注册成 DSH 工具|doctor / drill / acceptance / compare|只读、零凭证、零写入 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 06:13 |
| @cccc12138/dsh-read-aloud A speaker button beside the Like button: read any DSH reply aloud with the browser's own speech engine. · 在点赞旁加一个小喇叭,朗读 DSH 的回复。 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 08:13 |
| @jackchen13755/dsh-file-tree DSH 原生右侧栏文件面板:工作区文件树 + 官方预览(着色)+ 一键 @文件 引用到输入框,适配 DSH 0.1.6 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @weifa860504-droid/dsh-greet-signoff 开场语与收尾语:每次回复固定开场/收尾,并在上下文接近上限时提示换新会话(DSH Web 插件) | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-devspace DevSpace nodes and remote-directory mirror Workspaces for the DSH: manage N MCP endpoints, adopt a remote directory as a local Workspace, and move files both ways | 需注意 | warn | 0/4/6 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-mcp-manager MCP server management for the DSH: register, edit, enable, disable and hot-mount MCP servers, with global defaults and per-project overrides | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-agents-md-manager AGENTS.md management for the DSH: every instruction level a Session loads in precedence order (user-global first, then project root to cwd), editable in place from a Settings page or from the model | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-auto-archive Auto-archive for DSH: archive sessions idle beyond a threshold, with full archived-session management UI · DSH 自动归档插件 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-skill-manager Skill management for the DSH: browse, author, toggle and delete skills across project and user roots, from a Settings page or from the model | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @usssserd/my-dsh-plugin DSH插件test | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @lifecoder1988/dsh-secrets-manager Project secret management for the DSH: monorepo .env discovery, comment-preserving edits, and a DSH_ENV_FILES pointer your shell commands can source | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-18 08:13 |
| @hoyyang/dsh-glm-mode GLM Mode: fully tuned coding agent preset for zhipuai/glm-5.3-flash in DSH — PTC presentation, guard family, isolated compaction | 低风险 | pass | 0/0/8 | 0/0 | 2026-09-18 08:13 |
| @wzn16/dsh-task-capsule DSH cockpit duo: session-header task capsule + task notification card (sound/system notify) · DSH 任务胶囊与通知插件 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 08:13 |
| @cn-scuo-oo/dsh-session-auto-title DSH plugin: re-title a session after every turn in the MMDD|类型|主题 convention | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 08:13 |
| @kovey/dsh-engineering-suite Engineering suite for DSH: seven plugins covering roles, specifications, test design, quality gates, evidence, audit trail and pipeline orchestration | 需注意 | warn | 0/2/0 | 0/0 | 2026-09-18 08:13 |
| @Cumeskey/dsh-ssh-remote-tunnel | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-18 08:13 |
| @Qihang-He/dsh-nyanko-sensei Nyanko-sensei desktop pet plugin for DSH Web: a round calico cat that idles, naps, wanders, reacts to clicks with a voice line, and follows agent activity. DSH 桌宠插件:娘口三三/猫咪老师。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @mingzhicode/dsh-interactive-terminal Persistent Bash terminals for DSH, letting humans take over and continue model-started sessions through an xterm.js UI. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @curtainsmall/dsh-reckoner Electrical & electronics calculation plugin for the DSH. 面向 DSH 的电气电子计算插件。 | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/wechat-agent-router | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 10:13 |
| @let-mi-think/agent-manager | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-codex-provider Codex (ChatGPT) model provider for DSH - serves the ChatGPT subscription models the Codex CLI uses, over OAuth session credentials instead of an API key | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @jiawei322/dsh-pi-catalog-sync Sync the pi.dev model catalog into DSH llm-pi-ai provider routes through the official settings seam — no source patch — including mixed-protocol routes like OpenRouter, where new models land on a companion route while the built-in route stays untouched. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @xmzd-S/dsh-youdaonote dsh plugin about youdaonote | 需注意 | warn | 2/2/2 | 0/0 | 2026-09-18 10:13 |
| @winston-hoo/dsh-spec-ponytail DietrichGebert/ponytail — 懒惰 senior 模式,hook注入,迁移成dsh | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @fu827707013/dsh-model-health-probe DSH 模型健康检查:会话视图页签,选定供应商/协议/模型/路由后手动发真实裸 HTTP 请求,一屏看耗时、TTFT、状态、token 与三层诊断链。 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-18 10:13 |
| @wmw343/dsh-resume-expert 引导式简历生成插件:对话式四阶段 + A4 PDF 直出,双宿主验证 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 10:13 |
| @HaydenSmith1121/dsh-wallhaven-wallpaper DSH 插件:从 wallhaven.cc 搜图并铺成 GUI 背景,图片全由宿主端取回(支持代理,浏览器无需能访问 wallhaven),可一键下载原图。零运行时依赖。 | 需注意 | warn | 0/2/10 | 0/0 | 2026-09-18 10:13 |
| @ajceee/dsh-subscription-overlay | 低风险 | pass | 0/0/16 | 0/0 | 2026-09-18 10:13 |
| @asxiuxiu/dsh-quick-open DSH Web GUI plugin: VSCode-style Ctrl+P quick open — indexed workspace file search, sidebar editor open, conversation reference insert | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-18 10:13 |
| @Noob-stupid/dsh-plugin-gating-hub DSH 插件管理面板:一键启用/停用插件 + GitHub dsh-plugin 插件市场+自定义插件索引/市场,带插件详情与一键安装,一键框架升级自动回滚,插件升级门控 | Plugin manager & marketplace for DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @rebornace/dsh-tracescope 基于 Git 代码差异智能缩减手工测试范围,支持 Web / 移动端操作录制与崩溃日志采集,依托 DSH AI 自动生成可复现缺陷流程,实现变更驱动的手工测试闭环提效插件。A DSH native test assistant plugin. It intelligently narrows manual test scope via Git diff, records web & mobile operation tracks and crash logs, and generates reproducible bug steps through AI analysis to close manual testing workflow efficiently. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 10:13 |
| @yumusb/dsh-opencode-go-plus | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-18 12:13 |
| @GooDAnDReaDY/dsh-session-search DSH agent tool (session_search) for full-text search across historical sessions | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @neufagents/dsh-healthcheck Runtime health check for DSH: session-library scan + crash-tail inspection. Read-only. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @Lukeknow0/dsh-markdown-link-preview Preview DSH Markdown output links inside Better Sidebar instead of an external app. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-18 12:13 |
| @Arcadia822/dsh-tmp-hook One-time ephemeral webhook plugin for DSH sessions: mint a single-use callback URL, then wake the requesting agent session with the delivered payload. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @NEVSTOP-LAB/dsh-import-vscode-ai-files Load VSCode/Copilot AI configuration (.github/copilot-instructions.md, .github/instructions, .github/skills) into DSH sessions. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @athif23/dsh-shell-select DSH plugin: one model-facing shell tool whose shell (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish, sh) is a user setting, with a Web settings card and a fail-closed refusal when the sandbox cannot confine it. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @elmersky/dsh-plugin-trellis-workflow Trellis workflow enforcement for the DSH: per-turn workflow state injection and a trellis-start entry gate, replacing the session-start and user-prompt hooks dsh does not ship. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @yukitakasama/dsh-context-lens Single-session context anatomy for the DSH Web GUI: attribution, headroom planning, and a context x trajectory timeline — not another usage ledger. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-18 12:13 |
| @KylinQ01/dsh-startup-animation 🌸 给 DSH 的开机动画 + 主界面壁纸:多层动效 + 鼠标视差,两张图可在设置里自由更换并实时预览 | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-18 12:13 |
| @leolee9086/dsh-tool-cordis-local DSH 独立创造模式工具集:不注册进程级 inspect provider,让创造模式预设可以被复制 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @OnTheWay111/dsh-plugin-path-completion DSH path completion(DSH @文件名自动补齐和发现) | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-18 12:13 |
| @wuuuuu123-32/physics-lab-report | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @frederico-kluser/dsh-worktree-jump DSH plugin: a web-UI button that creates a git worktree and moves the conversation into it (session fork with the worktree as cwd) | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-18 12:13 |
| @whyself/Amadeus Amadeus: a web workspace for DSH with cloud and web agents, online code editing, PDF/Office/Markdown/LaTeX previews, TeX compilation, file management, and an integrated terminal. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-18 12:13 |
静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。
历史日报归档
33 期2026-09-18当前72 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么?
这份日报覆盖 2026-09-18 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的?
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计?
日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。
来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于