Introduction¶

Community plugins for DSH primarily come from the dsh-plugin topic on GitHub. Third-party plugins are essentially executable code, and once installed, they may possess local permissions reachable by the current DSH process. dsh-discovery is a read-only DSH plugin browser: it browses GitHub community plugins, offering category, keyword, and scenario filtering, plugin detection, deterministic security pre-check, and an LLM review installation process, but does not directly execute installation, updates, or uninstallation.

What is This¶

Name: EricXu20266/dsh-discovery
Positioning: DSH plugin discovery browser / DSH Plugin Searcher
Data Source: GitHub official API topic:dsh-plugin search
License: MIT
Boundaries: Read-only browsing of community plugins; no installation, updates, uninstallation, or loading of remote code

It solves the problem of: as the number of DSH community plugins increases, filtering and reviewing candidate plugins before deciding whether to install. It is not an official app store, but a read-only entry point for GitHub community plugins.

Core Features¶

Community Plugin Browsing¶

Browse community plugins under the GitHub dsh-plugin topic
Filter plugins by category, keywords, and scenarios
Provide zh/en bilingual interface
Use plugin detection and “Show Only Plugins” filter to reduce interference from non-plugin repositories

Chinese-English Synonym Search¶

Plugin data is usually in English. dsh-discovery has built-in 38-word Chinese-English synonyms, allowing Chinese keywords to match English plugin data.

Example keywords:

记忆
通知
模型

Deterministic Security Pre-check¶

After clicking “Review Install”, the host performs a deterministic security pre-check. Static rule scanning targets include:

Installation scripts
Entry code
Dependencies
Owner reputation

The pre-check report is sent into the session along with the review prompt for LLM deep review.

LLM Deep Review of Installation¶

Review is completed by the LLM within the session:

LLM reads the pre-check report and repository materials.
Reviews installation scripts, entry code, dependencies, network behavior, and owner reputation item by item.
Installation proceeds only if the review passes.
If risks are found, list the risk points and stop installation.

If the pre-check rating is high-risk, it is rejected by default; unless the LLM confirms the risk is controllable after reading the code.

Agent Awareness¶

dsh-discovery supports two Agent channels:

Inject ecosystem summary into system prompt (toggleable)
Provide two Agent tools:

dsh_discovery_search
dsh_discovery_audit

dsh_discovery_search is for searching community plugins; dsh_discovery_audit is for deterministic security pre-check of plugin repositories.

Reputation Signals and Official Markers¶

The interface displays reputation signal badges and official/third-party markers. Only deepseek-ai is marked as official; the bare deepseek account is not marked as official.

Update Checks for Installed Plugins¶

For installed plugins, an update check prompt can be generated for the LLM to compare versions and changelogs. Security review is also performed before updating, and the update is executed only if the review passes.

Caching¶

The tool provides listing cache and plugin detection cache to reduce repeated fetching and repeated detection.

Installation and Enablement¶

Current documentation does not provide the complete installation command for dsh-discovery itself, so concatenating installation commands based on the repository name is not recommended. Please refer to the directory page or GitHub repository documentation before enabling.

Reference entries:

Directory:
https://www.skillhub.cn/plugins/EricXu20266/dsh-discovery

GitHub:
https://github.com/EricXu20266/dsh-discovery

Typical Usage¶

Browsing and Searching¶

Browse community plugins by category, keyword, and scenario. This process is read-only and does not load remote code.

You can search for English plugins using Chinese keywords, for example:

记忆
通知
模型

Review and Install¶

The process is as follows:

Click “Review Install” on the plugin card.
The host performs a deterministic security pre-check.
The pre-check report is sent into the session with the review prompt.
The LLM reviews the code item by item carrying the pre-check report.
After the review passes, the LLM uses dsh plugin add to install the target plugin.
If the pre-check rating is high-risk, it is rejected by default, unless the LLM confirms the risk is controllable after reading the code.
If risks are found, the LLM lists the risk points and stops installation.

Related command snippet:

dsh plugin add

Note: The dsh plugin add above is the command used to install third-party plugins after review passes, not the complete installation command for dsh-discovery itself.

Let the Agent Search or Pre-check¶

You can directly ask the Agent to call the tools:

dsh_discovery_search
dsh_discovery_audit

For example:

Ask the Agent to call dsh_discovery_search to search for community plugins.
Ask the Agent to call dsh_discovery_audit to perform a security pre-check.

Control Ecosystem Summary Injection¶

In the “All” tab, you can toggle the “Ecosystem Summary Injection into System Prompt” slider.

Check Updates for Installed Plugins¶

Generate an update check prompt for installed plugins for the LLM to compare versions and changelogs. After the review passes, the LLM can use:

dsh plugin update

Applicable Scenarios and Notes¶

Suitable for:

Users of DSH who frequently need to find community plugins
Developers who want to filter, review, and then install third-party plugins
Users who want the Agent to search for plugins and perform security pre-checks within the session

Precautions before use:

dsh-discovery itself is a read-only tool: no installation, updates, uninstallation, or loading of any remote code
Third-party plugins run with the permissions of the current DSH process after installation, potentially accessing local files, commands, network resources, etc.
Precautions do not equal safety assurance; static pre-checks and LLM reviews cannot exhaust all risks
Check the source code, dependencies, license, and source reputation before installation
Do not leak sensitive information to plugins, such as API keys, secrets, or personal data
Pay attention to abnormal behavior after installation
Only deepseek-ai is marked as official; the bare deepseek account is not considered official

Conclusion¶

The value of dsh-discovery lies in separating the finding and review of DSH community plugins: read-only browsing first, then deterministic pre-check, and finally LLM review for installation. It is suitable for DSH users who need an extra layer of review process before installing third-party plugins.