find-plugin

Community DSH plugins are scattered across GitHub, and installing one traditionally means manually searching repos, verifying bundles and patches, auditing lifecycle scripts, pinning versions, editing profiles, and hoping everything actually loads. find-plugin collapses that error-prone chain into a single six-step workflow inside the Agent: search, static verification, risk disclosure, user approval, pinned-commit install, and result validation—turning self-extension from a manual scavenger hunt into one controlled decision.

Core capabilities: keyword search over the GitHub topic dsh-plugin returning at most five curated candidates filtered by relevance; pre-install static checks on bundle, patch, build entry, and lifecycle scripts that flag broken or high-risk repos; installation always via --ignore-scripts so no community install, prepare, or postinstall ever runs; full commit SHA pinning to prevent version drift between review and install; and post-install verification of dependencies, SHA pin, bundle config, and official dump-config with an explicit restart hint.

Built for users who want to extend their DSH Agent with community plugins but refuse to surrender approval authority, accept supply-chain risk blindly, or hand-wire shell commands. It is not a replacement for full source audits, nor does it add a registry, database, or Web UI. It is a controlled guard layer on top of the official DSH plugin manager.