每日安全扫描日报
日期 · 2026-09-23 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
79
当日新增
0
严重
29
需注意
50
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @AFAP/dsh-desktop-notify Desktop notifications for the DSH web GUI: a system toast when a tool needs authorization, a question or plan review is waiting, or a turn finishes. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 02:13 |
| @banana770/dsh-work-badge Tiny click-through badge for DSH: shows at a glance whether Beijing time (UTC+8) is inside the peak window - Mon-Fri 09:00-12:00 / 14:00-18:00 - or off-peak. Bilingual: Chinese and English UI text. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 02:13 |
| @hongxin/dsh-tvision Turbo Vision-style character-cell window manager for DSH agents | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 02:13 |
| @njjpro/dsh-remote-workspace Device-workspace federation plugin for the dsh web GUI: pair into another DSH instance and browse its projects and sessions from the local sidebar, with each peer session opening in the local center column through a loopback embed proxy. | 需注意 | warn | 0/7/8 | 0/0 | 2026-09-23 02:13 |
| @virzs/dsh-plugin-data-mask Paste-time data masking plugin for DSH: sensitive values are masked before they reach the composer | 需注意 | warn | 0/10/40 | 0/0 | 2026-09-23 02:13 |
| @lycheelink/dsh-workbench Enterprise Agent Workbench for DSH | 需注意 | warn | 0/2/0 | 0/0 | 2026-09-23 04:13 |
| @LovelyDazai/dsh-model-menu-search Allow user search model in the DSH model list. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 04:13 |
| @banana770/dsh-model-select-collapse DSH web UI plugin: collapsible per-provider groups in the model selector. English + Chinese docs. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 04:13 |
| @sweet-boby/dsh-session-isolation DSH plugin for per-session working directories: keep parallel agent sessions from overwriting each other. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 04:13 |
| @minivv/dsh-activity-bell DSH 侧边栏活动铃铛：会话完成给角标，一键切换最近活动列表 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 04:13 |
| @exoticknight/dsh-system1 System One foundation and Cordis plugin for DSH | DSH 的 System One 基础能力与 Cordis 插件 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 04:13 |
| @Juntiantan/dsh-permission-gate UI-level access gate + process-wide agent tool brake for DSH. Shared 60-min idle lock. NOT authentication — pair it with a real boundary. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-23 04:13 |
| @zdz6215591/dsh-theme-doubao 豆包主题 — DSH Web 客户端主题插件。 | 需注意 | warn | 0/5/11 | 0/0 | 2026-09-23 04:13 |
| @xianyu9n/dsh-exp-ops Remote experiment operations for DSH: a credential-reference server registry, signal/GPU/rollout watchers that wake the agent instead of polling, box metrics, and one right-sidebar panel with live configuration. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 06:13 |
| @1959377950-dotcom/dsh-workspace-archive-all DSH Web plugin: Archive-All action on every workspace folder menu in the sidebar (Ungrouped included). Running / open / blank / subagent sessions are skipped. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 06:13 |
| @pbwheel/dsh-workbuddy-expert 把 WorkBuddy 专家装进 DSH：专家市场一键导入 · 会话选择器随时切换 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-23 06:13 |
| @Xixixiao2007/dsh-mail-digest 把每轮回答压成一条详略得当的摘要发到邮箱，并支持邮件回信作答或续接对话（DSH 插件） | 需注意 | warn | 0/2/10 | 0/0 | 2026-09-23 06:13 |
| @loyalchiiina/dsh-lobsterai-daddy LobsterAIDaddy — draggable floating ball + slide-in drawer embedding the LobsterDaddy multi-account console in DSH, with a loopback-only same-origin reverse proxy, live status dot, account badge and a resizable persisted drawer. 把 LobsterDaddy 多账号控制台变成 DSH 界面悬浮球：可拖拽摆位并记忆，抽屉内嵌完整网页控制台，免退出并行登录/自动签到/积分额度/一键切号。 | 需注意 | warn | 0/3/11 | 0/0 | 2026-09-23 06:13 |
| @jackovibe/dsh-settings-order DSH Web 设置左列自由排序插件：拖动 / Alt+↑↓ / ↑↓ 按钮，宿主持久，跨浏览器生效（Free ordering for the DSH Web Settings navigation） | 低风险 | pass | 0/0/15 | 0/0 | 2026-09-23 06:13 |
| @jianghu-lao-yao/sh-volume-knob | 需注意 | warn | 0/1/16 | 0/0 | 2026-09-23 06:13 |
| @YevheniiMiachyn/dsh-tts-live Live sentence-level TTS for DSH with early speech, ordered streaming, barge-in cancellation, and custom WAV provider fixes. | 需注意 | warn | 0/3/1 | 0/0 | 2026-09-23 06:13 |
| @LiHeng99/dsh-starbridge-client StarBridge (星桥) gateway client for DSH — address or platform-account sign-in, chat / feedback / knowledge-base tools, and Web UI panels. Ships with no baked-in gateway address. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 06:13 |
| @YIRC99/dsh-jev-context | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 06:13 |
| @lphuxhuq/dsh-vietnamese-lang | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 06:13 |
| @zhang0098/dsh-telegram-channel Telegram mobile remote for DSH sessions (Martty/ACP-compatible fork of hi-wenw/dsh-telegram-channel): bind a chat to a live session, plain text = followup, /model /last /sessions. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @xchannel1987/dsh-sdd-progress-xc DSH web plugin: right-sidebar tab showing SDD task progress (todos) and ledger (sdd/progress.md) for the current session. 在右侧边栏展示当前会话的 SDD 任务进度与进度台账。 | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-23 08:13 |
| @fufuyin/dsh-prompt-workbench Prompt rewrite workbench for DSH: four rewrite modes, cancellable streaming output, and a token-level before/after diff. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-23 08:13 |
| @fengchang618gmail/dsh-course-subtitles DSH plugin: fetch course/video captions (DeepLearning.AI, YouTube, Bilibili, Coursera), rebuild whole sentences, translate EN/ZH, auto-generate section headings, publish one Feishu doc per lesson. Also exports a course outline. Zero hardcoded keys - everything comes from env or the harness credential store. | 需注意 | warn | 0/4/11 | 0/0 | 2026-09-23 08:13 |
| @ginkgonine/dsh-server-hub A persistent multi-server switcher for DSH Web | 需注意 | warn | 0/8/14 | 0/0 | 2026-09-23 08:13 |
| @passerby325799/dsh-trans-md Keeps DSH chat replies short: final replies over 15 lines are written to a Markdown file in the workspace, leaving a digest and file path in chat. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @exoticknight/dsh-plugin-template One sentence to an AI agent: create, release and list a DSH plugin. DSH 插件模板与 AI 操作手册 | 需注意 | warn | 0/1/14 | 0/0 | 2026-09-23 08:13 |
| @jipika/dsh-memory Two-layer long-term memory for DSH: global + per-project markdown, live re-read, zero extra LLM cost, with a Settings panel. 给 DSH 的两层长期记忆。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 08:13 |
| @yicun0316/dsh-claude-slider DSH / DSH 推理强度滑块插件：Claude 风格拖拽滑块 + 23 种 Canvas 粒子动效 + 客制动效自由组合 + 配色与图标自定义。Claude-style reasoning-effort slider plugin for DSH. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @yvhcel888/dsh-slide-gauge DSH 滑动测量仪挂件：右下角拖动角色显示状态，边界彩蛋，记住上次位置 · DSH plugin | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 08:13 |
| @Neptune810/dsh-power-button A draggable one-press stop button for the DSH Web GUI. / DSH 一键结束服务按钮。 | 需注意 | warn | 0/4/11 | 0/0 | 2026-09-23 08:13 |
| @XiaoBinGan/dsh-mermaid-fence Render settled ```mermaid fences in the dsh Web GUI chat as SVG diagrams — hardened output, source toggle, and a code-block fallback that never loses the source. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @LeoEthanZ/dsh-beyond-glass A three-column glass UI for deepseek-harness, delivered as installable packages instead of a fork. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 08:13 |
| @Suguyun/dsh-insight DSH浏览器伴侣：网页划词即解读、侧栏多轮追问，并让 dsh 智能体读取页面、抓取流量、驱动浏览器。Chrome/Edge MV3 扩展 + 配套 dsh host 插件。 | 需注意 | warn | 0/6/12 | 0/0 | 2026-09-23 10:13 |
| @wangzhuoyuan229-source/DeepSeekLauncher macOS desktop launcher for DSH — Chrome, custom transparent icon, and installation skill | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @liaowenqi123/dsh-meeting-coordinator DSH 多 Agent「会议室」插件：会议室会籍 + fork 上下文入场 + 主持人控场多轮讨论 + 会后各自压缩纪要并回到工作区继续干活。基于 dsh-std 元协议（Community v0.15）。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @Eapp1e/dsh-poker Texas Hold'em table for DSH: model-callable poker tools, six heuristic opponents, an optional coach, and a browser table whose buttons never post a chat message. | 需注意 | warn | 0/1/6 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-worktree Git worktree isolation for DSH: create a worktree, register it as its own project, and start the session inside it | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-memory Claude-compatible memory for DSH: a user-chosen memory directory with MEMORY.md index and topic files, the memory tool, and a settings page | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 10:13 |
| @boyl/dsh-sidebar-pins Codex-style pinned/recent sidebar panes for DSH, with one full row menu on every row (pins, unread, rename/fork/archive, reveal in Finder, guarded workspace delete). | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-23 10:13 |
| @TOP1Wu/dsh-session-isolation 为 DSH 提供工作区级会话隔离：同一工作区里多个会话各自写自己的产出目录，拒绝覆盖其他会话的文件。 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 10:13 |
| @zhang-guo-wen/dsh-ui-beautify Page beautification for DSH: ship open-source CJK webfonts and let the Web GUI pick its body font | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @victorygod/dsh-tavern-fengyue | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 10:13 |
| @jackovibe/dsh-codex-pin Codex 式会话置顶与归档风格的 DSH Web 插件（置顶=标记不是排序，宿主持久，零顺序改动） | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-23 10:13 |
| @JessenReinhart/dsh-snapcompact Bitmap-frame context compression plugin for DSH: deterministic pixel-font visual archiving of conversation history | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-23 10:13 |
| @yixiuzhemu/Skills-Manager Skills管理 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-23 10:13 |
| @chinazkk/dsh-console DSH 控制台插件：主视图「控制台」标签页，真 PTY 交互终端（iTerm 风格多标签），vim/top/ctrl+c 全支持。 | 需注意 | warn | 0/3/12 | 0/0 | 2026-09-23 10:13 |
| @luxus0946/dsh-uuyc UU Remote (uuyc-cli) Windows remote-control plugin for DSH - device management & remote terminal execution. Everything is a Plugin. | 需注意 | warn | 0/3/2 | 0/0 | 2026-09-23 10:13 |
| @dpwgc/dsh-coding-workflow 一个 DSH 编程工作流模式预设(Preset)，用于更好地约束LLM进行编程工作。 | 需注意 | warn | 0/3/0 | 0/3 | 2026-09-23 10:13 |
| @2huy4n/roleplaytimer 每隔一段时间主动唤醒会话中的AI，以此达到更沉浸式的角色扮演体验。 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 12:13 |
| @SciF-Lin/dsh-browsercontrol-mcp Real browser control for DSH: mounts Playwright MCP as native tools so the agent drives a browser you actually use. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 12:13 |
| @harde1/dsh-xcodebuild Xcode build, test, archive, run and log streaming for DSH: build/test/clean/archive/run an iOS or macOS project, with a live filterable build log and simulator and USB device log channels. macOS only. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 12:13 |
| @Gnatnaituy/dsh_sidebar_element_picker A browser panel in DSH's right sidebar: browse a site through a per-origin loopback proxy, pick elements into [label][DOMn] references, with tabs, page zoom, phone/tablet viewport preview and saved logins. | 需注意 | warn | 0/2/14 | 0/0 | 2026-09-23 12:13 |
| @azazo1/dsh-approve-prefix 按单命令前缀自动放行 DSH 沙箱提权请求, 含管道与链式的命令一律转人工审批. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 14:13 |
| @JD579g/dsh-mcp-hub DSH plugin: one-click MCP deployment + built-in MCP toolkit + doctor. Windows-first, connects without restarting. | 需注意 | warn | 0/3/21 | 0/0 | 2026-09-23 14:13 |
| @wuenna/dsh-deepseek-cost DSH plugin: DeepSeek-official cost accounting (session total + current turn) added to the built-in Token usage panel. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 14:13 |
| @Gnatnaituy/dsh-sidebar-browser A browser panel in DSH's right sidebar: browse a site through a per-origin loopback proxy, pick elements into [label][DOMn] references, with tabs, page zoom, phone/tablet viewport preview and saved logins. | 需注意 | warn | 0/2/14 | 0/0 | 2026-09-23 14:13 |
| @TACONailoong/dsh-plugin-smart-config DSH plugin for model smart configuration and parameter adaptation ported from ZCode | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-23 14:13 |
| @CJYLZS/dsh-browser Give dsh agent a real browser to use | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-23 14:13 |
| @Ztyss/dsh-draft-fold 长输入自动折叠为一张附件式摘要卡 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 14:13 |
| @anthony1x6000/dsh-searxng-search | 需注意 | warn | 0/11/23 | 0/0 | 2026-09-23 14:13 |
| @anthony1x6000/dsh-remote | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-23 14:13 |
| @ffyfox/dsh-zcode-project-memory ZCode 项目记忆的 DSH 非官方社区移植：项目级长效记忆插件。Unofficial community port of ZCode's project memory to DSH: project-scoped long-term memory plugin | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 14:13 |
| @wuenna/dsh-workspace-focus DSH plugin: an eye toggle that hides every workspace except the one holding the current session. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-23 14:13 |
| @DDDMUC/dsh-provider-hub DSH plugin: paste an API key to add a provider. 21 curated presets (OpenAI-compatible + Anthropic Messages) with per-app de-duplication and a custom endpoint form. | 低风险 | pass | 0/0/7 | 0/0 | 2026-09-23 14:13 |
| @MaybeMeibeMaybi/dsh-harmonyos-hiboard Push DSH task results to Huawei HarmonyOS assistant-today service cards. Compatible with dsh 0.1.5 / cordis 4. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 14:13 |
| @cup113/dsh-plugin-pyrun DSH插件：Python 快捷执行工具，源码经 stdin 直灌 `python -X utf8 -u -`，一步返回结果，全链路 UTF-8，支持后台作业与沙箱提权。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 16:13 |
| @jackie-cqz/dsh-jev-plugin DSH plugin for TypeSafe Jev: typed decisions, configurable guardrails, and Web UI result cards. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 16:13 |
| @1475505/miliastra-beyond-simulator 千星沙箱模拟器：Lua 驱动的 2D 奇域外置沙箱 ，支持 DSH、Web 和 MCP | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 16:13 |
| @JohnGD/dsh-office-preview Previews Word (.docx) and Excel (.xlsx) files in the DSH sidebar document pane — OOXML parsed in the browser, no Office, no network. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-23 16:13 |
| @hasan-aghayev/dsh-pet-companion Floating desktop pet for DSH with a growing local pet library | 需注意 | warn | 0/5/8 | 0/0 | 2026-09-23 16:13 |
| @rasyidmmz/dsh-ai-memory Memory bridge between DSH and ai-memory: finalizes DSH sessions so they become wiki pages every other harness ai-memory serves can read. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-23 18:13 |
| @ClearLeaf13/dsh-llamacpp-connect 把本地 llama.cpp 管理器里的模型接入 DSH — bring local llama.cpp manager models into DSH | 需注意 | warn | 0/3/9 | 0/0 | 2026-09-23 18:13 |
| @XGUIMAX/dsh-wrongbook DSH Tavern 错题库：按人物卡分类记下调试中踩过的坑，先查本卡、再跨卡。 / Per-card defect ledger for DSH Tavern. | 需注意 | warn | 1/8/10 | 0/0 | 2026-09-23 18:13 |
| @tokai-teiodh/dsh-script-cards Script-archive card panel for DSH: rounded card grid, two-level branch canvas, and a host-side Typert bridge that keeps structure inside your own project folder. | 需注意 | warn | 0/1/6 | 0/0 | 2026-09-23 18:13 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
38 期2026-09-23当前79 新增0 严重29 需注意2026-09-2259 新增1 严重18 需注意2026-09-2165 新增0 严重23 需注意2026-09-20104 新增1 严重34 需注意2026-09-1981 新增0 严重36 需注意2026-09-1872 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-23 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于