每日安全扫描日报
日期 · 2026-09-19 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
81
当日新增
0
严重
36
需注意
45
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @tynr426/dsh-relationship | 需注意 | warn | 0/6/8 | 0/3 | 2026-09-19 02:13 |
| @appthin/dsh-skills-manager-plus 在 DSH 设置界面的左侧边栏新增「技能与命令」页面， 可直接查看、启用/停用、编辑、删除与添加技能，还能把常用的提示词保存为命令， 在输入框输入 `/` 即可快速调用。Adds a *Skills & Commands* page to the left sidebar of the Settings screen, where you can view, enable/disable, edit, delete and add skills, and save frequent prompts as `/commands` that you invoke by typing `/`. | 需注意 | warn | 0/1/9 | 0/0 | 2026-09-19 02:13 |
| @buberlo/dsh-jev Jev-powered decision layer for DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 02:13 |
| @wild-River2016/dsh-canvas-xiaohe DSH 插件 - 小禾画布 AI 创作助手 | 需注意 | warn | 0/2/4 | 0/0 | 2026-09-19 04:13 |
| @HaydenSmith1121/dsh-wallpaper-engine Wallpaper Engine Steam Workshop browser for DSH: anonymous search & browse the workshop from a sidebar panel, steam:// subscribe deep-links, Steam login detection. | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-19 04:13 |
| @Stellight/dsh-chat-rail DSH 中文插件：对话区右缘的网页版风格导航竖线——每条人类消息一根短横线，靠近展开可跳转的消息列表，并支持回溯更早的历史 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-19 04:13 |
| @iimaguest/dsh-sandbox-escalation-guard DSH plugin: stops the sandbox escalation fields being advertised to a model when the calling session cannot grant them, fixing the retry loop known models fall into at danger-full-access. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-19 04:13 |
| @shkzhang/dsh-appearance DSH外观设置 | 低风险 | pass | 0/0/8 | 0/0 | 2026-09-19 04:13 |
| @jianjianzhu/dsh-model-switcher Visual custom-provider presets and model switching for DSH Web. | 需注意 | warn | 0/6/6 | 0/0 | 2026-09-19 06:13 |
| @CharlesXu-HQ/dsh-dream-rsi Experimental replay-based exploration-policy plugin for DSH | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-19 06:13 |
| @meihaoyidian/life-workbench dsh插件：个人工作台插件 | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-19 06:13 |
| @isayrhythm/dsh-plugin-repo-snapshot DSH plugin: encrypted workspace repo snapshots (including .git) backed up to your own local folder or Aliyun OSS, with a built-in settings page. | 需注意 | warn | 1/0/8 | 0/0 | 2026-09-19 06:13 |
| @wupup/dsh-custom-style dsh web custom style plugin | 低风险 | pass | 0/0/13 | 0/0 | 2026-09-19 06:13 |
| @BaiZhi967/dsh-plugin-zcode-import DSH 会话导入插件：按工作区浏览本地 ZCode 的会话，勾选或整工作区导入 DSH · Import local ZCode conversations into DSH | 需注意 | warn | 0/1/9 | 0/0 | 2026-09-19 06:13 |
| @BotHarness/dsh-skill Full-stack DSH plugin development skill — generated mirror of BotHarness/BotHarness. Install: npx skills add BotHarness/dsh-skill | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 06:13 |
| @syx2bzd/dsh-ricewhale DSH Web 界面的「鲸鱼女仆」物理挂件：拖拽投掷、撞边回弹、撒币吃分连击，每吃满 500 个 token 冒一碗白饭。 | 需注意 | warn | 1/7/11 | 0/0 | 2026-09-19 06:13 |
| @Hotsteel2901/dsh-frutiger-aero 🫧 Frutiger Aero skin for DSH: glass over a living sky-and-water wallpaper, aqua gloss, light + dark. Rebuilds the phone layout too — drawer, dock, edge swipes, keyboard-aware composer. 玻璃质感皮肤，电脑端与手机端都适配。 | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-19 06:13 |
| @hj01857655/dsh-theme-studio dsh plugin: customize UI theme with presets, accent colors, density, radius, fonts, and custom CSS | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-19 08:13 |
| @Hwayn-pixel/dsh-image-skin Universal image skin for the DSH web UI - replace large UI regions and corner stickers with your own images, GIFs, or videos, from a settings submenu. | 需注意 | warn | 0/1/10 | 0/0 | 2026-09-19 08:13 |
| @bigscientist/LLM-for-novel-with-history-and-superheroines | 需注意 | warn | 0/3/3 | 0/3 | 2026-09-19 08:13 |
| @hdhgsysh/dsh-connect-qoder Bridge local Qoder / Qoder CN models into DSH | 需注意 | warn | 0/5/15 | 0/0 | 2026-09-19 08:13 |
| @IvenKooLab/loci-dsh 🧠 loci second brain as a DSH web plugin — search / ask / remember your local knowledge base from the sidebar | 需注意 | warn | 0/2/17 | 0/0 | 2026-09-19 10:13 |
| @masknull/dsh-qoder-connect 将 Qoder（国内版 / 国际版）的模型以个人访问令牌（PAT）接入 DSH —— 双变体独立配置、侧栏额度展示、上下文窗口一键切换。|Qoder CN & international models for DSH via PAT. 支持 DSH 0.1.5-rc.1+。 | 需注意 | warn | 0/3/12 | 0/0 | 2026-09-19 10:13 |
| @jianjianzhu/dsh-harness-ui Full-page Harness console for the DSH Web GUI: sessions, plugins, market, MCP, skills and usage in one shell. | 低风险 | pass | 0/0/12 | 0/0 | 2026-09-19 10:13 |
| @YerenChina/dsh-memory-webdav-sync 把 DSH 的记忆文件双向同步到任意 WebDAV 服务器（带设置界面） | 需注意 | warn | 0/4/16 | 0/0 | 2026-09-19 10:13 |
| @AbsoluteMikhail/dsh-locale-ru Полная русская локализация веб-интерфейса DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @YUsaltyfish/dsh-fish-sound-notify DSH bundle: a Windows system sound when the agent asks a question /a turn ends/a permission request | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-19 10:13 |
| @2404723600/dsh-router-loomy DSH plugin: Loomy (iFlyTek) OpenAI-compatible supplier for dsh-router | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-19 10:13 |
| @AloneFu/dsh-calendar-plugin | 需注意 | warn | 0/3/15 | 0/0 | 2026-09-19 10:13 |
| @Qulierm/orbital-agents Paired Endeavour and Challenger agents for DSH. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @HFUT-zhengjiahao/dsh-balance DeepSeek API balance, conversation token usage, and CNY cost estimation for DSH | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-19 10:13 |
| @ZZJQ678/dsh-model-picker 按渠道商（Provider）分组、可折叠的 DSH 模型选择器：替换聊天输入框右下角原生选择器。仅在 DSH 桌面版实测通过，Web 版未测试。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @HFUT-zhengjiahao/dsh-process-control Local-only stop and restart controls for DSH — a sidebar plugin with loopback-only process routes | 需注意 | warn | 0/2/6 | 0/0 | 2026-09-19 10:13 |
| @hfdsdfgr/dsh-balance-bar DSH Web plugin: live account balance as a colour-banded vertical progress bar on the right edge of the GUI, with an animated wave above the threshold. | 需注意 | warn | 0/1/11 | 0/0 | 2026-09-19 10:13 |
| @huxin7735-collab/dsh-maintainer-doc-guard Keeps a long agent turn answerable to the user's actual request: a standing maintainer-document reminder, two pre-execute gates, an objective anchor quoting your latest instruction, and a nudge stage that corrects before it blocks. | 需注意 | warn | 0/2/5 | 0/0 | 2026-09-19 10:13 |
| @1622352030/ansys-agent-bridge MCP server driving Ansys SpaceClaim headlessly through PyAnsys Geometry, plus a DSH plugin bundle. Guards the operations that report success without changing geometry. | 需注意 | warn | 0/2/0 | 0/0 | 2026-09-19 10:13 |
| @yq1930/dsh-skin-asuka-p01 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 10:13 |
| @ubik-dsh/deepseek-mods DSH mods: an editable system prompt in the chat header, a Russian language pack, and a mod manager in Settings. Bilingual docs, one-command install. | 需注意 | warn | 0/2/20 | 0/0 | 2026-09-19 10:13 |
| @rezon-aki/dsh-memory-steward 记忆管家：为 dsh-memory-evolve 补上记忆入库之后的生命周期闭环——预算看门狗、整理到期提醒、待审批队列与审批 Tab、带备份执行。只读观测记忆文件，写入一律回调上游官方 HTTP API。 | 需注意 | warn | 0/4/15 | 0/0 | 2026-09-19 12:13 |
| @wwwort/dsh-win-computer-use Windows-native computer use for DSH: one batch tool runs a whole find/click/type/wait/screenshot sequence in a single model round trip, and drives windows without taking your focus or pointer. | 需注意 | warn | 0/5/4 | 0/0 | 2026-09-19 12:13 |
| @tcgbp/dock-flash Extensible quick-control panel for DSH Web — switch registry, skin manager, standalone or with dock-base. | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-19 12:13 |
| @Furdavus/dsh-uyghurche-ui DSH Web 界面维吾尔语（UEY）语言包：官方 locale API 注册 ئۇيغۇرچە，1,069 条界面文案（逐 key 英文回退）+ 全界面 RTL 镜像 + Intl 本地化 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @shenA2024/whale-persona 多宿主人设引擎：一份 config.json 让 DSH 与 ZCode 共用同一套人设、工作契约、思维链语言与长期记忆；记忆由 AI 提议、人工确认后才生效（代码强制）。A persona engine for AI coding harnesses (DSH + ZCode). | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-19 12:13 |
| @Shadoso-w/dsh-cli-mode Command-line mode for the DSH web GUI: a composer line starting with ！ or ! runs as a real command in the session workspace instead of being sent to the model. | 需注意 | warn | 2/1/8 | 0/0 | 2026-09-19 12:13 |
| @happyDABAI7/JiaFangTool OCR，语音识别，ai问答 | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-19 12:13 |
| @ewoowe/dsh-plugin-graph-plugin Plugin dependency graph for DSH: which plugin provides the services every other plugin injects, read from the live Cordis runtime. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-19 12:13 |
| @john-walks-slow/dsh-wait-subagent wait_subagent tool for DSH: block until a background continuable subagent settles and return its stop reason and closing message — event-driven, zero polling. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @dhdbvcg/opencodeAI | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @wywincl/data-analysis-agent data analysis agent for everyone | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @Jaylor-Wang/dsh-tool-antigravity | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 12:13 |
| @EPCN-fla/dsh-vscode-bridge Cordis plugin bridging the dsh-vscode extension to native DSH services (workspace grouping, session titles, archive, agent presets, permission presets) over a token-authenticated local JSON-RPC socket. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-19 12:13 |
| @Yazzyk/dsh-file-shield DSH 插件：在 Web GUI 里点选文件或目录，屏蔽 agent 对它们的读取、搜索、写入与编辑，使机密内容与敏感词不进入对话（含敏感词导致请求 400 的场景）。Blocks an agent from reading/searching/writing/editing chosen files, keeping their contents out of the conversation. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-19 14:13 |
| @Archer76/dsh-memory-evolve-suite DSH 长期记忆插件（dsh-memory-evolve 的再分发构建）：分层记忆・待办・技能自进化・外部 CLI 调度，另内置 3 份记忆运维技能与 14 个配套脚本 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @Meowrium/dsh-copy-file-path dsh plugin: adds 复制相对路径 / 复制绝对路径 (copy relative / absolute path) to the delivered-file card menu of the DSH web UI. / dsh Web 交付文件卡片菜单增加复制相对路径与复制绝对路径。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @YouHui1/dsh-sessions-diagnosis Diagnose and repair DSH sessions that stopped opening after a harness upgrade — from the CLI, from an agent tool, or from a dashboard in the DSH web UI. | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-19 14:13 |
| @karottc/dsh-plugin-workspace-sorted 让 DSH 的 **工作区（Workspace）** 按「最近使用」排序的宿主（Host）插件。 侧边栏自带的「排序方式：手动排序 / 最近更新」只作用于**会话**；工作区分组的顺序永远是 Host 注册表的持久顺序。本插件让最近有活动的那个工作区排到最前面。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-19 14:13 |
| @Voyage-He/dsh-novel-studio | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-19 14:13 |
| @yaodongH/dsh-better-summary DSH Web 插件：Codex 风格的改动汇总卡片，替换对话末尾的产出 chip 行。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @ewoowe/dsh-plugin-dependency-graph-plugin Plugin dependency graph for DSH: which plugin provides the services every other plugin injects, read from the live Cordis runtime. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @senyayume/dsh-edit-diff DSH 插件：在文件变更工具卡片上重绘行级 diff（相同行只渲染一次 + 行内字符高亮），覆盖 run_code(PTC) 与 str_replace_editor，轮末给出改动汇总卡，并可在资源管理器中定位或复制路径。 | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-19 14:13 |
| @MoseeVision/dsh-quick-archive DSH plugin: one-click archive button on every sidebar session row, beside the session menu / 侧边栏会话行的一键归档按钮 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 14:13 |
| @YuMS/dsh-duet | 低风险 | pass | 0/0/8 | 0/0 | 2026-09-19 14:13 |
| @mustakimabdullah25-tech/dsh-screen-translator Universal on-screen translator for DSH Web UI: translates UI text, attributes, Shadow DOM, and iframes across 45+ languages. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-19 14:13 |
| @Pingze-github/dsh-cost-audit | 需注意 | warn | 0/5/19 | 0/0 | 2026-09-19 14:13 |
| @TaoYe599/dsh-notify Task completion and needs-you notifications for DSH — web notification while the page is open, native Windows toast when the browser is closed. · DSH 任务完成/待回复通知：页面开着弹网页通知，浏览器关掉由 Host 弹原生通知。 | 需注意 | warn | 0/3/4 | 0/0 | 2026-09-19 16:13 |
| @rsdgnchen/dsh-bottom-dock DSH Web 插件：把官方右侧栏 dock（终端/文件树/文档预览）整体搬到底部，仿 iOS 上滑横杠唤出、可拖拽调高。不改官方代码，只用官方 data-* 钩子重定位；探测不到官方结构时完全惰性。 | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-19 16:13 |
| @rinttt233/dsh-peak-brief DSH峰谷调度插件：高峰前 N 分钟自动生成仅供 AI 恢复用的简报并停自动续跑，高峰硬挡模型请求（带一键逃生），闲时自动注入简报继续任务。 | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-19 16:13 |
| @WoodSettler/dsh-local-proxy DSH plugin: discover this machine's HTTP proxy (explicit .env value, else the Windows system proxy) and make DSH use it - for the agent's in-process fetches and for every child process it spawns. | 需注意 | warn | 0/2/4 | 0/0 | 2026-09-19 16:13 |
| @PerryLink/dsh-plugin-upgrade-016 Corridor folded into dsh-plugin-upgrade 2.0.0 (never published under this name): its 0.1.5-rc.2 -> 0.1.6-alpha.2 card and E1-E5 scanner live in that package now. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 16:13 |
| @OzzyDeng-JunDeng/dsh-keyless-search Keyless web search for the DSH web_search tool — Tavily and Firecrawl no-key access, no account or configuration. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-19 16:13 |
| @imtokenxinluo/dsh-contract-check Zero-token contract check for DSH plugins — verifies output.render() / session-event vocabulary, warn-only. 无耗检查：DSH 插件契约体检，零 token 成本，只告警不拦截。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-19 18:13 |
| @xiazhi88/dsh-onecompany 一人公司 · DSH 多 agent 公司编排插件（CEO/项目群/大厅/@派活/审批/排班/工作日志） | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-19 18:13 |
| @JRJRJPRO/dsh-tree 把 对话分支 画成 可点击的树 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-19 18:13 |
| @reisen-ww/dsh-bonk-pet 敲盆宠物 · DSH 悬浮小鲸鱼插件：出错掉钢管、敲铁盆、讨白饭 | 需注意 | warn | 0/3/13 | 0/0 | 2026-09-19 18:13 |
| @lucagiftzek/dsh-mail DSH plugin for agent email tools: send, mass send (CSV-personalised), scheduled queue, inbox read, domains. Multi-provider: Lettermint, AgentMail, Resend, OVH SMTP, manual SMTP, local self-host. | 低风险 | pass | 0/0/14 | 0/0 | 2026-09-19 20:13 |
| @ufiredong/dsh-interviewer DSH 模拟面试面板 + 技能：真实模型当面试官，读简历层层追问、按证据打分并推导薪资区间。面试官是考官，不是助教。 | 需注意 | warn | 0/7/14 | 0/0 | 2026-09-19 20:13 |
| @ireza7/dsh-persian-rtl Persian (Farsi) RTL fix for DSH: automatic per-paragraph direction for assistant answers, thinking cells, tool cells and question boxes | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-19 20:13 |
| @zhuchuovo/dsh-swarm-orchestrator DSH 插件：并行子代理集群 —— 母代理把目标拆成切片，并发驱动多个独立子代理写代码，输入框上方实时显示每个子代理此刻在做什么，并发数与各切片模型可在设置页配置。 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-19 20:13 |
| @yangdongzhen590/dsh-knj-version-control KNJ version-control workbench for DSH: local changes, per-file and multi-file staging, confirmed commit/update/push, and readable Git failure output. | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-19 20:13 |
| @lldois/dsh-jev TypeSafe Jev System One semantic tool routing and typed decisions for DSH | 需注意 | warn | 2/0/4 | 0/0 | 2026-09-19 22:13 |
| @libre-webui/dsh-native-provider Use DSH providers in Libre WebUI over a private local connection. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-19 22:13 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
36 期2026-09-2165 新增0 严重23 需注意2026-09-20104 新增1 严重34 需注意2026-09-19当前81 新增0 严重36 需注意2026-09-1872 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-19 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于