A dsh plugin security scanner isn't just a tool — it's the difference between a clean workspace and a compromised build. When you install plugins into your DeepSeek Harness environment, you're giving third-party code access to your system. The question isn't whether you should check before installing; it's whether you know what to look for.
Understanding the DSH Quality Score
The DSH Quality Score evaluates plugins across four dimensions: maintenance health, documentation quality, npm ecosystem integration, and security posture. Every plugin receives a letter grade from A to D plus a 0-100 numerical score.
| Grade | Score Range | What It Means |
|---|---|---|
| A | 90-100 | Excellent maintenance, clear docs, secure |
| B | 75-89 | Good health, minor documentation gaps |
| C | 60-74 | Acceptable but needs attention |
| D | 0-59 | High risk, avoid unless necessary |
The current distribution shows 4 A-grade, 4 B-grade, 6 C-grade, and 7 D-grade plugins. That 35% risk rate (C+D) is exactly why a pre-install dsh plugin security audit matters.
Three Red Flags You Cannot Ignore
1. Missing dsh.bundle declaration
This is the most common issue. Over half of the D-grade plugins lack the dsh.bundle declaration, which means the bundle structure was never properly defined or audited. Without it you have no guarantee the package is self-contained or that dependencies are scoped correctly.
2. Dangerous install scripts
Some plugins ship post-install scripts that execute arbitrary commands. This is the highest-risk warning. If a plugin flags "dangerous install script", never use it in a production environment.
3. Stale last-push dates
A plugin that has not been pushed in 30+ days may carry unpatched vulnerabilities. Security updates do not happen by themselves — they require active maintenance. Check last-push before trusting any plugin.
How to Use the Scanner Effectively
- Check the grade before you click install — A and B passed the full audit; C needs extra scrutiny; D should be avoided unless there is no alternative.
- Read the security warnings column — it tells you exactly what is wrong with each plugin.
- Cross-reference with star count — a 2,000-star A-grade plugin like dsh-core is more trustworthy than a 5-star D-grade one.
- Check maintenance frequency — recent pushes show active development; months of silence is a red flag.
What the Data Shows
Top performers (dsh-core, dsh-vision-router, dsh-context-bridge, dsh-memory-store) all score 84+ with recent activity. The middle tier offers solid B-grade alternatives for common needs. Problem cases (dsh-miner, dsh-telemetry, dsh-payload) all carry dangerous install script warnings.
The lesson is clear: run a dsh plugin security check before every installation. It takes seconds and could save you from a security incident.