每日安全扫描日报
日期 · 2026-09-28 (UTC,覆盖当日 00:00–24:00 新增入库的插件)
64
当日新增
0
严重
23
需注意
41
低风险
| 插件 | 风险 | 扫描结论 | C/W/I | 清单审计 | 收录时间 |
|---|---|---|---|---|---|
| @HERO476/dsh-sidecard-ask DSH ????(??????):????/????????,???????????????????Selection follow-up for DSH with an independent side-card answerer. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @shinelon/dsh-mermaid-plugin Render mermaid code blocks in DSH chat as diagrams - 在 DSH 聊天中将 mermaid 代码块渲染为图形 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @BoweiDuan/dsh-tui-session-manager Session manager plugin for dsh-TUI: a /sessions scene to browse, filter and truly delete saved sessions, plus cleanup of the state leftovers the host delete path leaves behind. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-huoqu DSH desktop plugin: capture a rendered webpage into a local offline HTML and MHTML copy. | 需注意 | warn | 0/4/10 | 0/0 | 2026-09-28 02:14 |
| @qujinting/dsh-web-search-clinepass DSH plugin : web_search provider that searches with the session's selected model via gateway-native search tools, replacing the built-in DeepSeek-only provider. | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 02:14 |
| @knopki/dsh-prompt-profiles DSH bundle that adds a per-session prompt profiles: named sets of extra system-prompt sections with their own order and scope, sealed into the prompt at session start. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Barricadetrecharm99/ruvnet-ruflo 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated | 需注意 | warn | 0/2/3 | 0/0 | 2026-09-28 02:14 |
| @reactive-resume/reactive-resume A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today! | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @Shadid516/dsh-off-peak-hours DSH plugin: an ambient pill under the composer showing whether your selected DeepSeek or z.ai plan is billed at peak or off-peak (half-price) rates right now, with a click-to-open schedule panel. PS: No human touched this code | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @fan56/dsh-jev-core Shared TypeSafe Jev decision-model client for the dsh ecosystem: strict response validation, keychain-first key resolution, typed fail-open errors. Jev-optional by design. | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-28 02:14 |
| @dn4hjtcr9s-del/dsh-wait-guard Keep an Agent's turn open until every descendant subagent settles — a pure Host-plane completion gate for DSH. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @yueyexiayu/dsh-subagents DSH desktop plugin: staged team plans, continuable members, dependency tasks, and a collaboration board. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 02:14 |
| @Age10-Moyu/dsh-adiv-theme | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 02:14 |
| @aiyacharley/dsh-at-sider 给原生侧边栏文件树补上「@ 引用 + 修改时间」:右侧栏的 文件 标签页还是原生的,每一行多了一个紧跟文件名的【@文件】引用按钮,和行尾固定的【修改时间】。 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 04:14 |
| @Bill-666code/dsh-kimi-shell DSH Web UI plugin: turn the dsh-web-mobile session drawer into a kimi-style bottom sheet 把左侧会话抽屉变成 kimi 风格底部浮层 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @yonchicy/dsh-composer-modenter DSH web plugin: Enter for newline, Cmd/Ctrl+Enter to send | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 04:14 |
| @YV3507/dsh-plugin-allcrash DSH Host plugin: a configured forbidden plugin - loaded, enabled, or about to be installed - crashes the Host process on the spot, with a crash report. Inspired by the Minecraft Forge mod allcrash. | 低风险 | pass | 0/0/5 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-jev-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | 低风险 | pass | 0/0/11 | 0/0 | 2026-09-28 04:14 |
| @stuga-dev/agent-plugins Packages that connect coding agents to Stuga: DSH and Pi. | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-28 04:14 |
| @Jaffe2718/s1cap System-1 decision models (Jev/Laya/Kev-class) as the governance layer for an LLM agent context lifecycle: growing association graph over session segments, relevance-gated recall with Trace-as-State ordering, and plan pre-ranking — measured in solve rate, cache hit/miss tokens, cost and latency. DSH plugin + harness-agnostic proxy. | 需注意 | warn | 0/8/12 | 0/0 | 2026-09-28 04:14 |
| @Drkoh-wz/team-craft Dependency-ordered multi-agent team orchestration plugin for DSH: per-role model routes, an independent review gate with bounded rework, a durable run ledger, and a live progress panel in the web UI. | 需注意 | warn | 4/3/3 | 0/0 | 2026-09-28 04:14 |
| @fan56/dsh-agent-dispatch Jev-guided dispatch advice for DSH: before each turn, Jev judges whether to delegate and to which registered agent. Advice only — jev-optional, fail-open, keychain-first. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @huangmiuXyz/dsh-edit-retry Right-click any user message to edit it and retry from that point — a client-side plugin for DSH. · 右键编辑任意一条用户消息并从那里重试。 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 06:15 |
| @d0ublecl1ck/dsh-external-link Open http/https/mailto/tel anchor links from the DSH web GUI in the OS default application — including localhost URLs the Electron shell keeps in-app. | 需注意 | warn | 0/1/2 | 0/0 | 2026-09-28 06:15 |
| @Napstablooky233/dsh-agent-dispatch Visible dispatch panel for DSH — decide whether other agents help, pick free-lane helpers, and inject the division-of-labour policy. | 需注意 | warn | 0/2/11 | 0/0 | 2026-09-28 06:15 |
| @linzimu666/dsh-intent-suggest 在 dsh 输入框上方猜你还没打完的意图,给几条可以直接发的任务候选;点一下只填回输入框,不替你发送 | 需注意 | warn | 0/1/7 | 0/0 | 2026-09-28 06:15 |
| @lilcandi/dsh-any-background-plus Enhanced fork of dsh-any-background: dual-lane wallpaper (one picture down each side, clear of the centre column) + one folder per side dsh-any-background 的增强分支:左右双图轮播(避开中间会话区)+ 左右各一个文件夹 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-28 06:15 |
| @wxlei2004/dsh-plugins DSH plugins collection | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @mattlennon/jev-harness-router Budget-aware Jev routing plugin for DSH with multi-provider reasoning, SSE, and cancellation reconciliation | 低风险 | pass | 0/0/6 | 0/0 | 2026-09-28 06:15 |
| @liggest/dsh-alt-enter-newline 拯救 dsh 中的 Alt+Enter 换行选手 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 06:15 |
| @MengXinSu/dsh-viya-memory 本地长期记忆插件 for DSH:卡片以 Markdown 存在你自己的 Obsidian vault 里 · Local long-term memory as plain Markdown cards in your own Obsidian vault | 需注意 | warn | 0/1/0 | 0/0 | 2026-09-28 08:13 |
| @dao-awa/dsh-computer-use-native Windows computer use for DSH, built for a vision model: screenshot the real desktop, read the interface from pixels, and drive it through Win32 FFI with no accessibility tree. Input posts to a window's own queue so the desktop focus is left alone. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @JessenReinhart/dsh-tokenslash | 需注意 | warn | 0/3/6 | 0/0 | 2026-09-28 08:13 |
| @feihong-li/dsh-abaqus DSH plugin: drive Abaqus CAE modelling from a declarative JSON spec, with a verified free CalculiX backend for solving and result extraction. | 需注意 | warn | 0/2/7 | 0/0 | 2026-09-28 08:13 |
| @Utmotc/dsh-plugin-balance 在DSH左侧启用一个余额监测卡片 | 需注意 | warn | 1/1/13 | 0/0 | 2026-09-28 08:13 |
| @shinelon/dsh-mcp-plugin | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 08:13 |
| @laa1991/dsh-health Declarative health readout for DSH: declare where to read, what counts as healthy, and which verdict each reading maps to. Read-only. | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-28 08:13 |
| @BoyangL04/dsh-task-notify DSH plugin: in-app toast + macOS notification when a session finishes a turn or is blocked on you (tool approval, question, plan review). | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 08:13 |
| @XIAOZHAOXSXH/dsh-moyu-reader dsh-moyu-reader,dsh小说阅读器 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @yuhhhong/dsh-skill-status dsh插件,用于显示当前会话skill的状态 | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @xujian519/dsh-annotator 对DSH的交付物进行标注的插件,人工标注后,DSH会根据标注执行 | 低风险 | pass | 0/0/4 | 0/0 | 2026-09-28 10:14 |
| @798645706/dsh-strawberry-data-hub Strawberry research tools for DSH | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @ShukebtAb/Dsh-OtherAPI One-click setup for any OpenAI-compatible API in DSH, with automatic thinking-mode support. Adapted to the DSH 0.1.7 entry-config settings model. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @OutLawZhangSan-liii/dsh-tailnet-gateway | 需注意 | warn | 0/1/11 | 0/0 | 2026-09-28 10:14 |
| @winditer/dsh-paste-spill Inbound large-paste handling for the DSH composer: each 4-50 KB paste folds into one chip, a >=50 KB paste becomes a real file attachment with a deliverable card. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @BarneyZhaoooo/dsh-theme-native A small, native theme plugin for the DSH Web GUI. | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-28 10:14 |
| @CrazyPigHead/dsh-plugin-agents-loader dsh plugin: auto-load ~/.agents/mcp.json MCP servers (http/stdio), ~/.agents/commands/ slash commands and AGENTS.md, with hot reload | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @dzwalker/dsh-session-keepwarm Keep the most recently used sessions resident in the browser, so switching back reuses the loaded history instead of re-reading it. DSH plugin. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @flyhigao/dsh-file-download Add a download button to DSH document previews | 需注意 | warn | 0/1/1 | 0/0 | 2026-09-28 10:14 |
| @xurunxin/dsh-llm-model-tuning Per-model reasoning-effort levels and multimodal input settings for custom providers in the DSH Models settings page. | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @demxyuanli/dsh-canvas DSH project-board plugin —— 适配 DSH 的项目看板插件:agent 写的 .canvas.tsx 看板实时编译渲染到右栏,面板决定可回流给 agent。 | 需注意 | warn | 0/2/1 | 0/0 | 2026-09-28 10:14 |
| @rasyidmmz/dsh-paper-search Literature search for DSH: 13 international sources and 3 Indonesian journal portals, all native HTTP, with a status tool that reports which sources answer. | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 10:14 |
| @cyh3436332528/dsh-plugin-session-purge DSH 会话管理插件:永久删除会话,连同它的日志、投影缓存、工作区记账与子会话(子代理)一起清掉。设置页入口,删除不可恢复。 | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @relaxyabc/dsh-GitPanel 一个类似 intellij-idea 中 Git 插件UI 的 dsh git 插件 | 需注意 | warn | 0/1/3 | 0/0 | 2026-09-28 10:14 |
| @SanChou0627/dsh-token-bill Live DeepSeek balance and per-hour token costing for DSH: two agent tools read the live balance and the ledger-observed daily charge, then write Markdown/HTML/JSON statements. | 需注意 | warn | 0/3/7 | 0/0 | 2026-09-28 10:14 |
| @asun-labs/dsh-plugin-token-dashboard DSH plugin for generating a self-contained token usage dashboard | 低风险 | pass | 0/0/1 | 0/0 | 2026-09-28 10:14 |
| @fengbinmov/R4-Coder-Provider R4 Coder账户的套餐余额、钱包、并发上限、到期时间、今日消费与最近 7 天用量。 | 需注意 | warn | 0/1/5 | 0/0 | 2026-09-28 10:14 |
| @ming-14/download-by-mirror-skill 让 AI 学会从镜像下载资源 - 覆盖 GitHub NuGet HuggingFace vcpkg Cargo Maven Maven DockerHub apt WinGet pip npm/pnpm | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 10:14 |
| @hu568/dsh-plugin-cluster-preset DSH「集群模式」agent preset:主控智能体自主编排 5 个具名专家子智能体,附「智能体寿命论」阶段提示器 | 需注意 | warn | 0/3/13 | 0/0 | 2026-09-28 12:14 |
| @gosomea/dsh-opencode-go OpenCode Go and Zen live model discovery, pricing and session routing for DSH | 低风险 | pass | 0/0/2 | 0/0 | 2026-09-28 12:14 |
| @miqian-nomad/dsh-new-workdir 一键领一个独立工作目录并开干净会话:目录即沙盒边界,产物不再互相污染。One click: a fresh timestamped workdir as a DSH workspace with a clean session. 零官方文件改动。 | 低风险 | pass | 0/0/3 | 0/0 | 2026-09-28 12:14 |
| @ZnonEn/dsh-mcp-manager DSH 插件:在桌面端设置页里管理 MCP 服务器 —— 新增/编辑/删除/启停 + 运行状态,直接读写 profile 的 cordis.patch.yml,零依赖。 | 需注意 | warn | 0/2/2 | 0/0 | 2026-09-28 12:14 |
| @Movingelated/dsh-local-ollama-models DSH plugin: delegate read-only collection tasks to a local Ollama model — zero cloud token cost, zero API key. 把只读采集任务交给本机 Ollama 模型:含设置面板 + 选型尺 + AI 可读说明书。 | 需注意 | warn | 0/2/11 | 0/0 | 2026-09-28 12:14 |
| @Soulize/dsh-continue-on-limit-host Auto-continue for DSH: when a local model hits its output-token cap, automatically send "continue" so the reply keeps flowing | 低风险 | pass | 0/0/0 | 0/0 | 2026-09-28 12:14 |
静态启发式扫描 + 语义清单审计,非完整安全审计;不执行代码、不解析依赖。风险等级映射与站点一致:secrets/外泄/破坏性/挖矿类 critical 为"严重",其余 critical 级与警告归入"需注意"(medium)。
历史日报归档
43 期2026-09-28当前64 新增0 严重23 需注意2026-09-2763 新增0 严重23 需注意2026-09-2684 新增0 严重29 需注意2026-09-2545 新增1 严重24 需注意2026-09-240 新增0 严重0 需注意2026-09-2379 新增0 严重29 需注意2026-09-2259 新增1 严重18 需注意2026-09-2165 新增0 严重23 需注意2026-09-20104 新增1 严重34 需注意2026-09-1981 新增0 严重36 需注意2026-09-1872 新增0 严重14 需注意2026-09-1770 新增1 严重24 需注意2026-09-1567 新增2 严重32 需注意2026-09-1482 新增1 严重30 需注意2026-09-1343 新增0 严重15 需注意2026-09-1284 新增0 严重29 需注意2026-09-1131 新增0 严重12 需注意2026-09-1096 新增1 严重17 需注意2026-09-0948 新增0 严重15 需注意2026-09-08922 新增2 严重301 需注意2026-09-0743 新增0 严重15 需注意2026-09-0614 新增0 严重3 需注意2026-09-0565 新增0 严重20 需注意2026-09-044 新增0 严重0 需注意2026-09-0377 新增0 严重30 需注意2026-09-0285 新增0 严重19 需注意2026-09-010 新增0 严重0 需注意2026-08-300 新增0 严重0 需注意2026-08-290 新增0 严重0 需注意2026-08-28444 新增1 严重87 需注意2026-08-2733 新增0 严重15 需注意2026-08-26253 新增0 严重74 需注意2026-08-25336 新增1 严重106 需注意2026-08-24327 新增4 严重79 需注意2026-08-23370 新增2 严重119 需注意2026-08-2212 新增0 严重6 需注意2026-08-212656 新增8 严重509 需注意2026-08-20597 新增5 严重160 需注意2026-08-191301 新增12 严重402 需注意2026-08-184003 新增22 严重1352 需注意2026-08-17142 新增1 严重49 需注意2026-08-16189 新增0 严重80 需注意2026-08-15348 新增5 严重166 需注意
这份日报覆盖什么?
这份日报覆盖 2026-09-28 首次被 dsh.so 收录的插件。对每个新增插件记录名称、风险等级、扫描结论、严重/警告/提示发现数、manifest 审计信号和收录时间。此前已在插件市场中的插件不会包含在内。
风险等级是如何划分的?
风险等级沿用站点的公开模型。密钥、外传、破坏性或挖矿类 critical 判为“严重”,其余 critical 判为“高风险”;medium 与 low 分别表示需要关注和当前无发现。
为什么这不是完整安全审计?
日报是静态启发式扫描加 manifest 审计,不执行代码,也不解析依赖,因此不能证明插件绝对安全。请用它来优先安排检查,而不是替代检查。
来源:dsh.so 安全标准 · 由 dsh.so 维护 · 发布于