Preface

When the DSH plugin ecosystem sees more community repositories and npm packages, agent developers usually encounter specific questions before installation: is this repository a DSH plugin, is it recently maintained, does the npm package exist, are the documentation and license clear, and are there risks in the installation scripts.

dsh-plugin-audit consolidates these judgments into a local directory: it first syncs the GitHub dsh-plugin topic, then probes npm, performs static security scanning, and generates a score, ranking, and Agent tool for each plugin.

We treat this as an introduction to the DSH community ecosystem tool, not as an official DSH application store.

What is it

dsh-plugin-audit is a plugin ecosystem health check tool for DeepSeek Harness (DSH). It syncs the GitHub dsh-plugin topic to a local scoring directory, probes npm, performs static security scanning on plugin files, and scores each plugin, providing a Web leaderboard and Agent tools.

Verified information:

  • Repository: 863683348/dsh-plugin-audit
  • Maintainer: 863683348
  • Package Name: dsh-audit
  • Version: 0.4.0
  • License: MIT
  • Name Differences: The repository path, README title, and package.json name are not fully consistent; it is recommended to keep both the repository path and package name when referencing.

Core Capabilities

Sync and Scoring

audit_sync is responsible for scanning the dsh-plugin topic, probing npm, and performing incremental re-scoring. It is aware of the GitHub search rate limit: it stops early when the budget is insufficient and resumes on the next run.

Scoring signals cover four categories:

  • Maintenance signals: last push recency, star tier, star trend
  • Documentation signals: README existence, description depth, license
  • npm signals: npm package existence, publish recency, weekly downloads
  • Ecosystem signals: curated awesome list existence, listing recency

dsh-plugin-audit can generate a seed catalog from the awesome-dsh-plugin list, verified at a scale of 1018 plugins.

Leaderboards and Reports

audit_top provides a leaderboard, sortable by score, stars, latest, and name, and supports category filter.

audit_plugin generates a full report card, accompanied by evidence explanations, suitable for viewing specific evidence or flags before deciding whether to install.

Static Security Scanning

audit_scan performs static security scanning on package.json install scripts, shell scripts, and entry source code. High/Critical findings enter flags and result in grade D, no longer “cancelling out” with other signals.

v0.4 Real Plugin Validation

v0.4 checks if a repository is like a DSH plugin: repositories missing cordis.patch.yml, dsh.bundle in package.json, or plugin entry files are marked not-plugin and capped at grade C.

Installation and Enabling

Installation Commands

The README provides both local checkout installation and npm installation commands; they are listed below.

Local checkout installation:

dsh plugin --profile <profile> add /path/to/dsh-audit

NPM package installation:

dsh plugin --profile <profile> add dsh-audit

After installation, restart DSH. The leaderboard dock will appear in the Web UI of the web profile.

Configuration

After providing the Agent with a GitHub token, execute audit_sync, or configure the following items:

  • dataDir: Directory location; default can be $DSH_HOME/dsh-plugin-audit or ~/.dsh/dsh-plugin-audit
  • githubToken: GitHub token
  • syncIntervalHours: Periodic sync interval
  • npmProbe: Whether to probe npm registry

GitHub search is anonymous at 10 req/min, using a token increases it to 30 req/min. Sync will stop early due to rate limit and resume on the next run.

Data Files

Default data is located at $DSH_HOME/dsh-plugin-audit or ~/.dsh/dsh-plugin-audit, containing:

  • catalog.json
  • meta.json
  • history.json

All writes are atomic (temp + rename); corrupted files fall back to empty rather than crashing.

Typical Usage

Below, three paths are explained: local installation, first sync, and standalone execution.

  1. Local installation and restart:
dsh plugin --profile <profile> add /path/to/dsh-audit

After installation, restart DSH, then enter the Web UI of the web profile to view the leaderboard dock.

  1. First sync:

After providing the Agent with a GitHub token, execute audit_sync. You can also configure githubToken, dataDir, syncIntervalHours, and npmProbe.

  1. Standalone execution for testing or CI:
node scripts/seed.mjs
node scripts/sync.mjs --token <gh-token>
node --test test/

The first line generates a seed catalog from the awesome-dsh-plugin list; the second executes sync; the third runs offline tests.

Suitable Scenarios and Notes

Suitable for the following scenarios:

  • Want to batch view DSH community plugin maintenance, documentation, npm, and ecosystem signals
  • Want to provide a local basis for the Agent on “which plugins are worth installing”
  • Want to check the static risks of install scripts, shell scripts, and entry source code before installation

Precautions before use:

  • Plugins run with the current DSH process permissions. You should check the source code, dependencies, and license before installation.
  • auditSummary session projection and composer-dock leaderboard are marked as experimental; optional periodic sync is marked as guarded.
  • peerDependencies in package.json are truncated in the current data; full dependencies are not confirmed.
  • There are differences in repository path, README title, and package name. Use the actual repository commands and files as the basis for installation and reference.
  • The community directory is not an official DSH app store; the leaderboard is a local scoring directory, not an official quality certification.

Conclusion

The value of dsh-plugin-audit lies in transforming the pre-installation judgment for DSH plugins from “read README + guess npm package” to a repeatable sync, scan, and scoring process. It is not a replacement for manual review, but rather exposes the parts that can be machine-checked in advance.

Verified links:

  • GitHub: https://github.com/863683348/dsh-plugin-audit
  • Directory Page: Fixed URL not provided in currently verified materials.