Why Scan the Top 10?
When a new ecosystem explodes — the dsh-plugin topic now has over 11,000 repositories — most users reach for the highest-starred plugins first. That makes security scanning the top 10 not just useful but essential. A single compromised plugin in that list could mislead thousands of installers.
The Testing Methodology
We evaluated each plugin across four dimensions using the DSH Quality scoring framework: maintenance health (last push, commit frequency), documentation quality (README completeness, usage examples), npm ecosystem integration (dsh.bundle presence, dependency hygiene), and security posture (install script analysis, known CVEs, permission scope).
Results: The Grade Distribution
| Rank | Plugin | Stars | Grade | Security Warnings |
|---|---|---|---|---|
| 1 | deepseek-harness | 179k | A (92) | None |
| 2 | open-design | 90k | A (88) | None |
| 3 | ruflo | 68k | A (85) | None |
| 4 | reactive-resume | 41k | A (90) | None |
| 5 | DeepSeek-Reasonix | 35k | A (87) | None |
| 6 | OpenViking | 31k | B (82) | None |
| 7 | nocobase | 24k | B (78) | None |
| 8 | colleague-skill | 24k | A (84) | None |
| 9 | WeKnora | 20k | A (86) | None |
| 10 | voyager | 20k | D (45) | Dangerous install script |
The One Failure: voyager
voyager (Nagi-ovo/voyager) earned a D-grade due to a dangerous install script. The package includes a postinstall hook that attempts to fetch remote configuration without verification. This is the exact pattern our scanner flags as critical risk.
What the Top 3 Share
- All three have explicit dsh.bundle declarations in their package.json
- All three show consistent weekly commits over the past 90 days
- All three have detailed security sections in their READMEs
- None ship postinstall scripts that execute remote code
The B-Grade Middle Tier
OpenViking and nocobase both scored in the B range (75-89). They passed security checks but had minor documentation gaps or slightly stale last-push dates. Neither should raise alarms, but both could benefit from more frequent release cycles.
Actionable Takeaways
- Install only A and B grade plugins from the start
- Check the security warnings column before trusting star count
- Report dangerous install scripts to the plugin author
- Contribute to awesome-dsh-plugin to help others discover safe plugins
Next Steps
We will continue scanning new plugins as they appear. Subscribe to DSH Weekly for weekly security reports and plugin recommendations. The full scanner data is available on our plugins page.