每日安全扫描日报
日期 · 2026-09-27 （UTC，覆盖当日 00:00–24:00 新增入库的插件）
63
当日新增
0
严重
23
需注意
40
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @rickwindman/dsh-destinywind-mcp DSH 插件：MCP 可视化管理（服务器/工具开关/环境变量/凭据托管）· Visual MCP manager UI plugin for DSH | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-memory DSH 插件：长期记忆库，注入每个会话的系统提示，设置页增删，HTTP API 改数 · Durable long-term memory bank plugin for DSH | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-27 00:13 |
| @rickwindman/dsh-destinywind-tpm DSH 插件：TPM/DPAPI 封存的凭据提供器，取代明文凭据文件 · TPM/DPAPI-sealed credential provider plugin for DSH | 需注意 | warn | 0/5/1 | 0/0 | 2026-09-27 00:13 |
| @Gaozx1/dsh-web-search-engine DSH 插件：用 Bing / DuckDuckGo / Mojeek / Google / Brave 多引擎混合替代默认网络搜索，带可视化设置页 | 需注意 | warn | 0/5/7 | 0/0 | 2026-09-27 02:13 |
| @hiJoeLee/dsh-suggest-actions 类 Trae 体验，在 AI 回复后提供候选建议，点击后发送指令 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ChengqianHuang/dsh-personal Personal assistant bundle for DSH: natural-language capture, query, and review tools over one SQLite file | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 02:13 |
| @ONEOne-1v1/dsh-github-upload | 低风险 | pass | 0/0/12 | 0/0 | 2026-09-27 02:13 |
| @hu568/dsh-plugin-browser-use DSH 插件：ARIA 快照优先的浏览器操作工具集（导航/点击/输入/截图/多标签）+ 右侧栏实时投屏与用户接管面板。移植自 zai-org/ZCode（Apache-2.0）。MIT。 | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-persona-memory DSH 插件：角色设定与长期记忆（角色库 persona.yml/SOUL.md/USER.md + FACT.md/MEMORY.md + JOURNAL.jsonl），注册在宿主组合层，对所有 agent 预设生效，附右侧栏管理面板。MIT。 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @jr-create/dsh-prompt-wisp 提示词精灵 — 在 DSH 输入框旁一键把草稿优化成结构化提示词 / One-click prompt optimization button for the DSH composer | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-voice-transcribe dsh 插件：本地语音/视频转写（SILK 解码 + faster-whisper），不花 API 钱 | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-27 04:14 |
| @supengpeng/dsh-ssh SSH plugin for DSH: connection, exec/PTY, SFTP transfer, right-sidebar UI | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @JackZo400/dsh-memory-search Markdown 笔记 → Agent 的长期记忆：本地 embedding + SQLite FTS5 混合召回（dsh 插件） | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @s11phere/dsh-commandcode-quota Command Code plan quota in your DSH session header — 5h / weekly / monthly windows, reset countdowns, and billing-period usage | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-27 04:14 |
| @hu568/dsh-plugin-pack-memory-browser DSH 插件包：记忆 + 浏览器（Schema v1 分发清单，spec 指向各插件仓库，随包附带离线 tarball 与自检脚本）。MIT。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 04:14 |
| @zhengjy01/dsh-mcp-manager MCP server manager for DSH: add, edit, enable and test stdio / Streamable HTTP MCP servers from the Web settings page and from agent tools, connected and disconnected at runtime without restarting DSH | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @Weihong-Liu/dsh-html-live-preview Live HTML preview inside DSH conversations: a render_html tool plus an inline, sandboxed, auto-sized renderer. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 04:14 |
| @jipika/dsh-preset-hotswap Switch the agent preset (standard / PTC / cordis) of an already-started conversation from the session header. DSH host+client plugin. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-27 04:14 |
| @AllenWES365/dsh-local-memory Project-isolated long-term memory for DSH:每个项目各存各的库，一个总视角看遍全部。Seeds a project's memory from its git history without opening a session. | 需注意 | warn | 0/2/5 | 0/0 | 2026-09-27 06:13 |
| @jcjyids/dsh-web-advanced-settings | 需注意 | warn | 0/3/9 | 0/0 | 2026-09-27 06:13 |
| @underworld-oddball/sh-volume-shuff Read the newest turn aloud from the DSH composer | 需注意 | warn | 0/1/6 | 0/0 | 2026-09-27 06:13 |
| @hanbernate/dsh-save-button Adds a Download button to DSH delivery cards, so files delivered with present save straight from the browser. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-usage-dashboard DSH 宿主插件：把 dsh-usage-stats 生成的用量报表挂到宿主 Web 的 /usage，鉴权复用宿主登录态（零依赖） | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @hbgdjb/dsh-session-shield Session Shield —— 让 DSH 会话日志永远不会因为一次畸形 tool call（空 id / 空 name / 非法 arguments）而打不开。装上即用，零配置、零依赖。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @SJTUMalPan/dsh-ask-timeout-notify DSH 宿主插件：ask_user_question 超过阈值（默认 60 分钟）无人回答时，向 notify-hub 投递一条待办并通过飞书/webhook/email 推送 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @upcyan/dsh-mimo-usage MiMo (Xiaomi) quota ring and usage detail tab for DSH | 需注意 | warn | 1/0/10 | 0/0 | 2026-09-27 06:13 |
| @Timebro9999/dsh-session-deck Manage your whole workspace in the DSH sidebar: a pinned band for projects and conversations, a bell activity view with answer previews, per-project emoji icons, and collapsible 置顶/项目/组件 sections. Bilingual (EN/中文). | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-27 06:13 |
| @cjx12036/TaskWatch User-intent tracking and agent supervision for DSH · 用户意图监督与受控纠偏 | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 06:13 |
| @Theflowyears/dsh-arknights-theme Arknights theme pack for the DSH Web GUI: wallpapers with saturation-driven edge blur, an acrylic sidebar, and a one-click wallpaper picker. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @Finderchangchang/brewreel 精酿 BrewReel：让 DeepSeek 这类便宜模型也能做出好看的竖版宣传片。写一份产品简报，AI 挑镜头、写文案，一条命令出片。3 种配方、6 个行业、广告法校验，开源可商用。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 06:13 |
| @luckbiao/dsh-markdown-highlighter Rich syntax highlighting for DSH Markdown: activates builtin Shiki theme colors and styles diff codeblocks with green/red backgrounds and split-view | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @Zessi-C/dsh-model-thinking-levels Per-model thinking levels (reasoningEfforts) for custom DSH llm-pi-ai routes, with gateway-side capability probing | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-27 08:13 |
| @Paimonshen/dsh-coding-plugin 代码学习插件 — DSH 动态 Cordis 插件：悬浮窗代码编辑器/多语言执行/课程关卡评判/分析直投对话 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 08:13 |
| @rezon-aki/dsh-doc-kit 文档体系体检：只读工具 doc_lint（注入层配额 / 被禁措辞 / 索引路径 / 是否进 git）+ 随包 doc-governance 技能 | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-27 08:13 |
| @john-walks-slow/dsh-live2d-voice Live2D companion for DSH: realtime TTS voice, continuous speech input, subtitle translation, multi-model catalog, standalone entry | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @b8yg7vjstj-ctrl/dsh-llamacpp-bridge DSH plugin: local llama.cpp (llama-server) as a first-class model provider — process/router management, catalog sync with mmproj vision pairing, auto-start, stop-then-load switching, and a sidebar terminal monitor panel. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-27 08:13 |
| @s11phere/dsh-tex-block-normalizer DSH plugin: fix Pandoc-style $$ display-math blocks that DSH mis-parses into a red KaTeX parse error. | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-27 08:13 |
| @yousj666/dsh-audio-converter DSH 音频转换器：解密网易云 NCM / 酷我 KWM / 酷狗 KGM / QQ音乐 QMC，格式互转 + 音质增强（EBU R128 响度归一化、EQ、重采样、位深）。可打成 197MB 单文件 exe，零依赖。 | 需注意 | warn | 0/6/14 | 0/0 | 2026-09-27 08:13 |
| @mingdui/dsh-growth-workbench 面向普通用户的个人成长工作台：画像 → 能力模型 → 90 天计划 → 今日执行 → 证据 → 考核复盘。页面与 Agent 读写同一份数据。 | 低风险 | pass | 0/0/9 | 0/0 | 2026-09-27 08:13 |
| @SFLAQiu/dsh-waker 正在苏醒的数字员工 | 需注意 | warn | 0/12/32 | 0/0 | 2026-09-27 08:13 |
| @pandarayc/dsh-skill-tier Progressive disclosure for DSH skill collections: one generated index skill stays in the catalog, every member stays user-invocable but leaves the model catalog. Zero dependencies. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @lyp88997/dsh-browser-service 自建 DSH 浏览器服务：单例 CDP 守护 + DSH ctx.browser provider + 兼容 dsh-univer-office 的可执行包装（非 root 服务器环境） | 需注意 | warn | 2/11/45 | 0/0 | 2026-09-27 10:13 |
| @LeeLizuoLiu/rice-patrol Rice Patrol: a bounded reasoning loop guard and clean recovery plugin for DSH | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-27 10:13 |
| @Sostay/dsh-wallpaper Custom full-window wallpaper plugin for DSH: gradient presets, image URLs, local uploads, frosted glass, and a theme-aware top gradient. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 10:13 |
| @fzy-yy/dsh-mcp-inventory DSH plugin: a Settings page listing the MCP servers the current profile has switched on | 需注意 | warn | 0/1/10 | 0/0 | 2026-09-27 10:13 |
| @rajpaulsingh6-stack/dsh-genoffice-captain DSH plugin: launch GenOffice for GenOffice task-list skills, or designate a Captain session to orchestrate first | 需注意 | warn | 0/1/18 | 0/0 | 2026-09-27 10:13 |
| @jetformat/dsh-plugin DSH plugin for Jetformat: Office to PDF and PDF tools via the local CLI | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-27 10:13 |
| @Sen70s/dsh-workspace-plus 增强DSH的工作区的多级目录功能 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-27 10:13 |
| @MuzeWinter/dscomputer-control Windows desktop automation for DSH: 14 tools for real GUI input (click, type, keys, scroll, drag), occlusion-proof window screenshots and the accessibility tree. | 需注意 | warn | 0/1/4 | 0/0 | 2026-09-27 10:13 |
| @tayuLuc/dsh-ru-voice-input Russian-first Voice input for DSH: local GigaAM v3 with punctuation, and a speech registry fix that makes recognizer switching work | 需注意 | warn | 0/2/13 | 0/0 | 2026-09-27 10:13 |
| @koinrokka/dsh-plugins DSH extension bundles for Koinrokka: sandbox runtime providers, IDE tools, LLM adapters | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-27 10:13 |
| @HuaiminHuang/dsh-subscription-plugin Experimental DSH plugin for ChatGPT/Codex subscription sign-in and model routing. v0.0.2 preview; real login unverified. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @upcyan/dsh-mimo-extension MiMo (Xiaomi) quota ring and usage detail tab for DSH | 需注意 | warn | 1/0/10 | 0/0 | 2026-09-27 12:13 |
| @malko/dsh-malko-prefs Some settings to make DSH more comfortable to use | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-27 12:13 |
| @sviktor75/dsh-sound-notification DSH Web plugin: plays a chime when any session's response finishes (rising tone) or a question/approval is asked (falling tone), with a click-to-mute badge. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-27 12:13 |
| @KAsyori/dsh-unicode-guard DSH plugin: keeps the glyph class that trips content moderation out of every model-visible surface, so a fetched page cannot permanently break a session. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @OMSociety/dsh-mineru DSH 插件：把扫描版 PDF 送到 MinerU 云端解析，产出带页码块锚点的 Markdown（页码锚点 / 分片续跑 / 后台任务 / 配置页） | 低风险 | pending | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @wbb316/dsh-novel DSH 插件：小说创作台 —— 给 agent 5 个 novel_* 工具 + 一个能改设定、画关系图、一键续写并流式直播的右侧栏面板 | 需注意 | warn | 0/4/9 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/dsh-uia-agent Windows UI Automation agent for DSH: enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot + window state as a dsh plugin (single C++ exe) | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-27 12:13 |
| @catsenior507/dsh-command-center Command center for DSH: watch running background jobs in one panel, tell a long silence apart from a hang, and see when the agent is waiting on you. | 需注意 | warn | 0/2/8 | 0/0 | 2026-09-27 12:13 |
| @David7583/baigong_research_atlas Local research continuity across agents and AI clients, with versioned tasks, traceable evidence and verifiable handoffs. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @cnyc6n/uia-agent Windows UI Automation agent - single C++ exe (enumerate/snapshot/find/click/set_text/scroll/drag/swipe/screenshot/window-state). Built with MSVC, static CRT. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-27 12:13 |
| @NMTZ-z/system-one-benchmark-lab | 需注意 | warn | 0/3/4 | 0/0 | 2026-09-27 12:13 |
静态启发式扫描 + 语义清单审计，非完整安全审计；不执行代码、不解析依赖。风险等级映射与站点一致：secrets/外泄/破坏性/挖矿类 critical 为"严重"，其余 critical 级与警告归入"需注意"（medium）。
历史日报归档
42 期2026-09-27当前63 新增0 严重23 需注意2026-09-2684 新增0 严重29 需注意2026-09-2545 新增1 严重24 需注意2026-09-240 新增0 严重0 需注意2026-09-2379 新增0 严重29 需注意2026-09-2259 新增1 严重18 需注意2026-09-2165 新增0 严重23 需注意2026-09-20104 新增1 严重34 需注意2026-09-1981 新增0 严重36 需注意2026-09-1872 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么？
这份日报覆盖 2026-09-27 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的？
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”，其余 critical 判为“高风险”；medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计？
日报是静态启发式扫描加 manifest 审计，不执行代码，也不解析依赖，因此不能证明插件绝对安全。请用它来优先安排检查，而不是替代检查。
来源：dsh.so 安全标准 · 由 dsh.so 维护 · 发布于