Skip to content

Open source DSH plugin finder · one command

The DSH plugin finder that vets before it installs

dsh-plugin-radar is a DSH plugin finder you install into your own DeepSeek Harness. Ask it in plain language, it searches the 4,000-plus repositories in the GitHub `dsh-plugin` topic on demand, cross-checks candidates against two curated registries, runs a pre-install security scan on whatever you pick, and installs only after you say go.

Jump to installRead the source
dsh-plugin-radar: find, vet, install

Install the DSH plugin finder in three steps

Both paths install the same DSH plugin finder, so pick one. Swap web for whichever profile you actually boot.

dsh plugin --profile web add 'github:dshplugin-me/dsh-plugin-radar#v0.1.1'

Copying does not run anything. Review the command before you execute it.

The official profile-bundle route, in the command form the DeepSeek Harness docs use. No global dsh on your PATH? Use npx -y @deepseek-ai/dsh plugin … instead; running dsh from a source checkout? Use pnpm dsh plugin … from the checkout root. The pinned v0.1.1 keeps a later push from changing what mounts in your profile. Plain JavaScript with no build step means nothing to compile after a git install, so pnpm never asks for an allowBuilds entry — that entry is permission to execute a package's code at install time, not a routine checkbox.

Verify the layer, then boot

dsh --profile web --dump-config
dsh --profile web

The first line only reads the composed config; look for a dsh-plugin-radar layer in the output.

git clone --depth 1 https://github.com/dshplugin-me/dsh-plugin-radar
cp -r dsh-plugin-radar/skills/plugin-radar "${DSH_HOME:-$HOME/.dsh}/skills/"

Copying does not run anything. Review the command before you execute it.

Use this if you would rather not touch profile dependencies: copy the skill directory into any discovery root. Current project only goes to <project>/.dsh/skills/, shared across agents goes to ~/.agents/skills/. The directories are watched, so it takes effect on placement with no restart.

  1. 01

    Run one of the two install paths

    A bundle goes into a named profile, a skill goes into a discovery root. Installing the DSH plugin finder twice on one machine buys you nothing, so choose one.

  2. 02

    Confirm it actually mounted

    For the bundle path, --dump-config shows the composed configuration: a dsh-plugin-radar layer means it mounted, no layer means it landed as a plain dependency. For the skill path, ask your harness to list its available skills and look for plugin-radar in the answer.

  3. 03

    Ask for what you need, in plain language

    Describe the capability you want, or name a plugin and ask whether it is safe. The DSH plugin finder handles both openings, then walks you through search, cross-check, scan, and install.

Confirm the mount

List the skills you currently have available

Ask it to find

Is there a DSH plugin that shows token usage in the web UI?

Ask it to vet

Is dsh-web-ui safe to install?

What the DSH plugin finder does after you ask

The DSH plugin finder always runs the same six steps, and each one reports what it found or where it got stuck, so nothing is installed behind your back.

  1. 01

    Filter candidates server-side

    Your request becomes one to three English keywords that GitHub filters and star-ranks before anything reaches the model. The alternative — dumping a whole topic into context — hits the hard 1,000-result cap anyway, and when a result set is truncated this says so instead of passing a slice off as the whole picture.

  2. 02

    Cross-check two curated layers

    Candidates are checked against the human-gated awesome-dsh-plugin list, then against the 238 plugin profiles on this site for use cases, limitations, and dependency pre-scans. Only when both layers come up empty does it fall back to reading the repository README and package.json directly.

  3. 03

    Determine the install type

    A dsh.bundle.patch declaration in package.json means bundle, a bare SKILL.md means skill, a README asking you to edit cordis.patch.yml means cordis, and the legacy repository format is flagged as needing migration. When the evidence is inconclusive it says so rather than inventing an install command.

  4. 04

    Hand you a candidate table

    At most three rows: name, one-line purpose, stars, last update, install type, and whether it is in the curated registry, plus one sentence on why the top pick. If nothing fits, it says nothing fits instead of forcing a recommendation.

  5. 05

    Scan before install and report

    A report comes back whether or not anything turned up. Bundles are checked for lifecycle scripts, outbound domains, subprocesses, out-of-bounds writes, and credential reads; skills for prompt injection, exfiltration, and privilege overreach. Anything suspicious is quoted verbatim, never paraphrased.

  6. 06

    Install on your word, then verify

    It follows the method matching the confirmed install type, then has you confirm the expected UI, tool, or skill entry appeared. If the install surfaces a download source or write path the scan never saw, it stops and hands you the raw text.

What the security scan actually checks

Public research that scanned tens of thousands of agent skills found 26.1% carrying vulnerabilities and 5.2% showing likely malicious intent. A plugin runs inside your DSH process — it can read sessions, call tools, and run commands — so installing one is a grant of authority, which is why the DSH plugin finder makes this step mandatory rather than optional.

Threat categories distilled from the public NVIDIA SkillSpector and Cisco AI Defense documentation

bundle / cordis: executable code

  • preinstall, install, postinstall, and prepare scripts in package.json
  • Every fetch, HTTP, and WebSocket destination in the source, matched against the plugin's stated purpose
  • Each child_process, execSync, and spawn call site, and where its arguments come from
  • Writes outside $DSH_HOME, edits to .zshrc or .bashrc, changes to system settings
  • Reads of session logs, settings, .env, credentials, ssh keys, and browser data
  • The count and provenance of runtime dependencies, followed down through any that carry their own lifecycle scripts

skill: instructions injected into context

  • Prompt injection: wording that tells the agent to ignore prior rules, impersonate system authority, or hide things from you
  • Exfiltration: steps that send session content, files, or credentials to external URLs or unexpected paths
  • Privilege overreach: curl-pipe-shell, download-and-execute, permission changes unrelated to the stated purpose
  • Trigger abuse: a frontmatter description promising code formatting while the body reads credentials
  • Any bundled scripts/ directory, which gets the full executable-code checklist on the left
Every report closes the same way: this scan covers known patterns only, and no findings does not mean no risk. Static checklists cannot catch novel techniques, so a DSH plugin finder that overclaims would leave you worse off than one that says nothing.

DSH plugin finder questions

How does the DSH plugin finder relate to this website?

The website is the directory for humans and the DSH plugin finder is the interface for your agent, both reading the same data. You search, filter, and read plugin profiles here; once dsh-plugin-radar is installed, those same profiles get cited inside your DSH session so you no longer have to open a browser to cross-check.

Does the DSH plugin finder need a GitHub token?

Not required. It uses GITHUB_TOKEN or GH_TOKEN from the environment first, then your local gh login, and falls back to the public API. The only difference is rate limiting: the public API allows 60 searches an hour, so run gh auth login and retry if you hit a limit.

What is the difference between the bundle and skill install paths?

A bundle installs the repository as a dependency of one profile and registers the skill at startup, keeping profiles isolated from each other. A skill install copies a directory into a discovery root, takes effect immediately, and touches no dependencies. The capability is identical, so choose bundle for multi-profile isolation and skill for a quick trial.

Can it install something without asking me?

No. The flow has two hard stops: it waits after presenting the candidate table, and it asks again after the security report. Nothing is installed until you say yes, and if a behaviour appears mid-install that the scan never saw, it stops and hands you the raw text.

Does the security scan guarantee a plugin is safe?

No static scan can. It checks known risk patterns: install scripts, outbound domains, subprocesses, credential reads, and prompt injection. Every report closes with a line stating that no findings does not mean no risk, and for high-value environments you should still read the source yourself.

What happens when no plugin fits?

It tells you so. GitHub search caps any query at 1,000 results while the topic holds four thousand-plus repositories, so any single search may be a slice; when a result set is truncated the output marks it rather than presenting the slice as the whole ecosystem or pushing an unrelated plugin to have an answer.