每日安全扫描日报
日期 · 2026-09-21 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
65
当日新增
0
严重
23
需注意
42
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @yueyexiayu/dsh-shengcheng DSH desktop plugin: generate images with logged-in Grok/GPT accounts, and videos with Grok | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 02:13 |
| @corlinniu/dsh-daily-chat 给DSH增加日常聊天功能 | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-21 02:13 |
| @hi-wenw/dsh-csv-viewer DSH Web CSV and TSV table viewer with search, sorting, raw mode, and virtualized rows | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 02:13 |
| @awol2005ex3/dsh-cas DSH 插件: 用于实现CAS SSO单点登录 | 低风险 | pass | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @shenbimicro233/dsh-reasoning-effort-inject | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-ecosystem-panel DSH plugin: read-only ecosystem health panel - bundle / patch / skill / upgrade / decoupling diagnosis in one view | DSH 插件：只读生态健康面板，六类体检一屏看完 | 需注意 | warn | 0/3/15 | 0/0 | 2026-09-21 04:14 |
| @zhy5/wxbridge DSH plugin: connect WeChat (official iLink/ClawBot) to DSH — live status settings panel + bundled bridge/keeper kernel | 需注意 | warn | 0/10/26 | 0/0 | 2026-09-21 04:14 |
| @hoyyang/dsh-best-ponytail Ponytail lazy-senior-dev ruleset for DSH: 7-rung minimal-code ladder, six skills (review/audit/debt/gain/help), /ponytail session command, optional always-on injection. MIT, upstream unmodified. | 低风险 | pass | 0/0/8 | 0/0 | 2026-09-21 04:14 |
| @arrow1031/dsh-qq-bot DSH plugin for QQ-Bot adataper | 需注意 | warn | 0/3/14 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-session-title-live DSH plugin: live session titles with state prefixes (running/done), pin-safe and fully configurable | DSH 插件：会话标题实时刷新 + 状态前缀，pin 安全、可配置 | 需注意 | warn | 0/1/11 | 0/0 | 2026-09-21 04:14 |
| @121212165/dsh-plugin-price-aware Make your coding agent know what it costs: live credits, per-model price, task pre-estimates, budget gate | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-21 04:14 |
| @haiting202-web/jiufeng-invest | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-21 04:14 |
| @deanzhang2026-max/dsh-lived-pet | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-21 04:14 |
| @kira905/dsh-diagnostic-tools DSH diagnostic tools: dependency-closure & decoupling checks + chat image attachment reconciliation. Zero deps, read-only, reproducible | DSH 诊断取证工具组：依赖闭包/解耦体检 + 会话图片附件对账，零依赖只读 | 需注意 | warn | 0/7/21 | 0/0 | 2026-09-21 04:14 |
| @HoodyHuo/dsh-plugin-glm-balance DSH Web GUI 插件：在输入框旁显示智谱 GLM（bigmodel.cn）套餐额度条 —— 小时/周额度、点击刷新、右键菜单，并自带「GLM 余额」设置分区（authorization、供应商 ID、自动刷新间隔，默认 30 分钟）。GLM coding-plan quota indicator for the DSH web GUI. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Mirfakk/dsh-plugin-usage DSH 额度面板：输入框下方实时显示本会话消费金额（官方峰谷分时计价）、token 用量与 DeepSeek 账户余额。 | 需注意 | warn | 0/3/5 | 0/0 | 2026-09-21 06:13 |
| @liuyuguo99/dsh-task-todo Todo & task manager for DSH: list / board / calendar / gantt, subtasks, recurrence; the same data is exposed to the agent as tools and a slash command. | 需注意 | warn | 0/6/22 | 0/0 | 2026-09-21 06:13 |
| @KyattoCat/dsh-skills-mcp-panel Skills & MCP panel for the DSH Web GUI: grouped by origin, searchable, hot-toggleable. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-21 06:13 |
| @why-did/dsh-tailscale-access Remote access for the DSH Web GUI via Tailscale or cloudflared — early-stage, read the notice first. | 需注意 | warn | 3/6/21 | 0/0 | 2026-09-21 06:13 |
| @mikugui/dsh-session-eater 会话清理（喂鱼）：把不要的会话拖到余额挂件的小胖鱼身上「吃掉」（移入回收站，可撤销）——DSH Web 插件 | 低风险 | pass | 0/0/18 | 0/0 | 2026-09-21 06:13 |
| @HoodyHuo/dsh-plugin-dracula-color-theme DSH Web GUI 主题插件：官方 Dracula 配色，覆盖 alias + specific 两层 design token 与 shiki 语法高亮，并可接管系统主题偏好。Official Dracula theme (draculatheme.com) for the DSH web GUI. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 06:13 |
| @zhangnan/dsh-chatgpt-oauth ChatGPT OAuth login and Codex usage for DSH | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-21 06:13 |
| @Marquez807/dsh-experience-memory Cross-session experience memory for DSH: a lesson reaches the model only with a verifiable source, relevant ones are injected each turn, and what nobody uses is retired. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 06:13 |
| @wangxuewangxue98/dsh-motor-ai-l0 | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-21 06:13 |
| @ct-jaryn/dsh-plugin-baizhi-agent-toolkit Optional community BaizhiCloud Agent Toolkit MCP configuration bundle for DSH | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @mia-wong1016/dsh-codex-plus Codex (ChatGPT Plus/Pro) subscription for DSH: quota panel with one-click reset, subscription model routing, token upkeep. | 需注意 | warn | 0/2/6 | 0/0 | 2026-09-21 08:13 |
| @nightosong/gord-dsh-worktree | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-21 08:13 |
| @YLL-KB/dsh-video-to-notes Opt-in DSH skill bundle that turns course, lecture, tutorial, documentary, meeting, and talk videos into structured study notes. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @SugarFatFree/dsh-agent-extension DSH plugin for workspace commands, skills, and path-scoped rules. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 08:13 |
| @wanghuiym123/dsh-cherry-kb Knowledge-base and memory switch for dsh web — two composer controls and two settings pages, backed by 22 /dsh/kb/* routes. Requires the local 我的知识库 toolchain (记忆开关 / idx / cherry). | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @nengong-ai/dsh-keychain-credentials Pure JavaScript macOS Keychain provider for DSH ctx.credentials, supporting both refs and records without plaintext credential storage on disk. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-21 08:13 |
| @kenz1117/dsh-ui-composer-rainbow Rainbow marquee border for the DSH chat composer | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @1207627875/dsh-update-lens Read-only update checker for DSH: version comparison across npm and GitHub, in-app update notification, and breaking-change annotations on release notes. 只读更新检查 + 破坏性变更标注。 | 需注意 | warn | 1/4/15 | 0/0 | 2026-09-21 08:13 |
| @MrWeiCodes/dsh-loop-guard 为 DSH提供的思考循环守护插件：模型陷入「只想不做」的退化循环时自动打断，不必再手动中止 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @xydijkkk/dsh-voredteam dsh-voredteam｜DSH 插件形态的单模式安全作战系统：黑板（Fact/Intent/Hint）+ 六阶段六矩阵作业法 + 总控与 12 个专业子 agent + 作战面板（八泳道实时图 / 覆盖矩阵 / 按会话分类）。唯一门禁：禁 DDoS、禁爆破、模糊测试低频化。 | 需注意 | warn | 0/13/10 | 0/3 | 2026-09-21 08:13 |
| @sqzssg12138/dsh-service-runner 为 DSH 加上 IDEA 风格的工作区服务启停面板：多工作区隔离、Node/Java/Python/Docker 自动探测、实时日志与端口占用者处置。 | 需注意 | warn | 0/5/10 | 0/0 | 2026-09-21 08:13 |
| @wpeng77/dsh-llm-trace Wire-level LLM inspector for DSH: capture the raw HTTP request and response bodies of every model provider call, attributed per session, in a Conversation View tab and a loopback viewer page. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-21 08:13 |
| @Smallballoons01/retirement-calc 中国法定退休年龄与养老金测算：2025 渐进式延迟退休、退休倒计时、预计月养老金 —— 单文件网页计算器 + DSH 插件 + 跨工具 Agent Skill | 需注意 | warn | 0/1/9 | 0/0 | 2026-09-21 08:13 |
| @wjw99830/dsh-plugin-noema Focus code review on complexity changes after each coding task. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 08:13 |
| @TheYoungChen/dsh-annotate Annotate any web element — local or online — with DOM facts and your comments, straight into your DSH chat. Built-in sidebar browser, Codex-style review, no X-Frame-Options pain. / 直接在DSH中用“标记DOM”和你的“评论”来标注任何网页元素——无论是本地的还是在线的。内置侧边栏浏览器，无需担心X-Frame-Options | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-21 08:13 |
| @jack1545/dsh-weixin-reader WeChat Official Account article reader for DSH: parses mp.weixin.qq.com article bodies into clean Markdown | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 10:13 |
| @dreammaker2016/dsh-file-menu | 需注意 | warn | 0/3/2 | 0/0 | 2026-09-21 10:13 |
| @danbao/dsh-jev | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @chenjingchun/dsh-deepseek-balance-badge DeepSeek account balance badge for the DSH sidebar footer, with a settings card for the refresh period. The API key never reaches the browser. | 低风险 | pass | 0/0/11 | 0/0 | 2026-09-21 10:13 |
| @perdakovich/dsh-plugin-prompt-edit click the pencil, edit your text, enjoy | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @elanski/dsh-failover-continue Unified auto-continue + model failover plugin for DSH (RU/EN settings card) | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @argszero/cordis-plugin-tool-deadline-guard Deployment-level deadlines for dsh tool calls that declare none: mounted on the tools/execute waterfall, it turns a silently wedged tool call into a model-visible TOOL_DEADLINE_EXCEEDED. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @hirohana77/dsh-plugin-trajectory-tracker 让你更清楚地了解究竟是什么占据了你的等待耗时 ⏱️ DSH 实时时序轨迹与执行过程追踪插件 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @kenz1117/dsh-ui-rainbowspeak Rainbow marquee border for the DSH chat composer | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 10:13 |
| @vlln/evo-engineering 让 agent 把任意产物（文档、代码、skill）一轮轮改得更好：先定标准，再自动改进与独立评审，人类随时能看、能喊停、能回滚（DSH 插件） | 需注意 | warn | 0/4/3 | 0/0 | 2026-09-21 10:13 |
| @GJayun/dsh-goal-zcode-like | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-21 10:13 |
| @hgp005/dsh-winterskin 雪岭皮肤 — 把一张照片变成整个 DSH GUI 的底色，并把面板调成配套的玻璃质感主题。A photo skin for the DSH web GUI. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-21 10:13 |
| @Grant-Felix/dev-rules DSH个人插件：把你的项目开发规则交给 agent —— 右侧栏面板可视化维护（全局 + 按项目），并自动注入每个会话的系统提示。 | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-21 12:13 |
| @WONGIII/dsh-effort-dial A reasoning-effort dial for the DSH composer: a violet particle field with meteors, magnetic level anchors and an eased circular thumb. | 需注意 | warn | 0/12/11 | 0/0 | 2026-09-21 12:13 |
| @donyue7/dsh-aoci-panel DSH插件：在会话视图标签中展示项目的 AOCI 认知索引、治理状态与条目浏览 | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-opencode-go-path DSH plugin: declares the OpenCode Go route wire protocol, auto-adds DeepSeek V4.1 models, and attaches the x-opencode-session header | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-model-usage DSH plugin: model usage & account balance in the session header (OpenCode Go plan usage + DeepSeek account balance) | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @Gdenich/dsh-ru-ui Russian interface translation for DSH: 2581 strings across 49 namespaces, adds Русский to the language picker, activates on first run. Translation only. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kingzhz/dsh-global-rules Global AGENTS-style rules as many independent markdown files, with a settings GUI — fills the gap left by DSH's single hard-coded global AGENTS.md. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-composer-keys-setting DSH plugin: choose whether Enter / Shift+Enter / Ctrl/Cmd+Enter sends the message or inserts a line break | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-21 12:13 |
| @itchenshi/dsh-gui-last-session DSH plugin: reopen the conversation you were last in after a restart, without patching engine files | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-21 12:13 |
| @wowyuarm/dsh-context-continuity The context-continuity engine for DSH: a subject's context lived as one continuous timeline across many physical Sessions — rollover, checkpoints, and lineage. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @kai-GitHubaccount/dsh-usage-panel DeepSeek 余额 + Token 用量面板（DSH Web）：三级预警、自定义阈值、一键充值、缓存命中率 ｜ Balance & usage panel for DSH | 需注意 | warn | 0/1/13 | 0/0 | 2026-09-21 12:13 |
| @vianvio/dsh-plugin-drop-path DSH 客户端插件：把一个文件夹拖进 DSH，输入框里出现的是它的本机绝对路径（引用块），而不是一条传不上去的附件。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-21 12:13 |
| @PerryLink/dsh-laya Laya decision engine as a first-class Cordis service and model-visible tools for DSH. | 需注意 | warn | 0/3/8 | 0/0 | 2026-09-21 12:13 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
36 期2026-09-21当前65 新增0 严重23 需注意2026-09-20104 新增1 严重34 需注意2026-09-1981 新增0 严重36 需注意2026-09-1872 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-21 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于