SEMANTIC DIRECTORY · plugin-directory-semantic-v3-19
Plugin & Supply-Chain Security Audit
在Plugin、Skill、包或依赖安装、激活前后进行静态Security审查和Source验证，包括恶意模式与投毒检测、能力披露、SBOM、漏洞库比对、哈希校验、风险评分和安装门禁。排除运行时行为防护。
Leaf membership
46 plugins
dsh-skill-pack-securityPerryLink/dsh-skill-pack-securityCatalog AnalyzedSecurity-audit methodology skill pack plus the plugin_vet supply-chain gate: eight agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) in Chinese and English editions, with an npm provider bundle that mounts the skills and registers the automated plugin_vet pre-install scanner.CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals13 starsdsh-skill-security-guarddsh-skill-security-guardCatalog AnalyzedDeepSeek Harness community Bundle for the skill-security-guard static scannerCompatibilityDSH 0.1.6-alpha.2 · webDependency audit0 reported in bounded auditArtifact0.1.0Evidence updated2026-09-26Public signals199 downloadsDSH-Skill-Security-Inspectorkakapengta/DSH-Skill-Security-InspectorCatalog Analyzed一个可直接链接到 DeepSeek Harness（DSH）Web profile 的独立Security检查Plugin。在安装或使用不受信任的 Skill 前，先执行浏览器本地粗检，再由用户决定是否调用 DSH 已配置的大模型进行结构化复核。CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals1 starsdsh-trust-checkdsh-trust-checkCatalog AnalyzedStatic capability disclosure for DeepSeek Harness plugins: a Settings page and CLI that list installed plugins' capabilities, literal destinations, install scripts, and injection shapes (prompt registrations, shipped skill text, bundle patch), each with file:line evidence. Code-determined, reproducible, zero-token. Disclosure only — not a security verdict, never a safety claim.CompatibilityDSH 0.1.6-alpha.2 · webDependency audit0 reported in bounded auditArtifact0.1.14Evidence updated2026-09-25Public signals0 stars · 1665 downloadsdsh-vetdsh-vetCatalog AnalyzedSecurity vetting for DeepSeek Harness (DSH) plugins: permission & supply-chain audits before install, graded via the open dsh-vet/v1 report standard.CompatibilityDSH 0.1.6-alpha.2 · webDependency audit0 reported in bounded auditArtifact0.4.0Evidence updated2026-09-25Public signals1478 downloadsdsh-xrayunStone/dsh-xrayCatalog AnalyzedX-ray for DeepSeek Harness plugins: declared capabilities vs actual behavior. Registry + static scanner + badges.CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals4 starsdsh-xray-pluginunStone/dsh-xray-pluginCatalog AnalyzedAsk what a DeepSeek Harness plugin can actually do, from inside your agent. Companion to dsh-xray.CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals1 starsdshpkgExaggarate/dshpkgCatalog AnalyzedSecurity & health audit CLI for DeepSeek Harness (DSH) plugins — npm audit for the everything-is-a-plugin era. Search, info, security-scan, doctor. stdlib-only.CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals0 starsdshscan@shaoshi/dshscanCatalog AnalyzedSecurity scanner for DSH plugins: static and semantic passes over plugin source, DSH-specific attack-surface rules, npm audit, batch scanning, and an HTML report with per-finding severity and evidence.CompatibilityDSH 0.1.6-alpha.2 · webDependency audit3 reported in bounded auditArtifact0.5.0Evidence updated2026-09-19Public signals9 stars · 1238 downloadsskill-sentrywhaojie797-design/skill-sentryCatalog AnalyzedStatic, local, explainable pre-install security audit for Agent Skills. Scans SKILL.md/scripts/config for destructive commands, hidden network calls, secret reads, obfuscation, prompt injection, persistence. CLI + 36 fixtures + GitHub Actions.CompatibilityDSH 0.1.6-alpha.2 · webDependency auditNot testedArtifactUnresolvedEvidence updated2026-09-27Public signals0 stars
Categories are public semantic index facts, not a final recommendation. Compatibility, permissions, and source evidence remain separate.