DSH plugin security scan status

Unverified — no scan has been run70

No automated scan has been run on any listing, so this is “unverified”, not “safe”. Read the source and the install script yourself before installing.

What the scan covers

The scan is automated static analysis: declared dependencies, the permissions the code requests, obvious secret-handling mistakes, and supply-chain signals such as a suspiciously new package name or an install script that downloads and executes code.

It is not a manual audit. It will not catch a logically malicious plugin written to look ordinary, which is why the permission surface and the install command still deserve a look on every listing.

This directory treats neither stars nor verification level as a safety verdict: verification records how far the install path was exercised, scan status records whether automated analysis ran, and neither replaces your own check.

Questions about scan status

Does "scanned" mean the plugin is safe?

No, and this directory does not claim otherwise. 0 of 70 listings have had an automated scan run; the other 70 are marked unverified, which means the check has not happened — not that the plugin is safe or unsafe.

What does the scan actually do?

It reads the repository without running it: declared dependencies, the permissions the code requests, obvious secret-handling mistakes, and supply-chain signals such as a very new package name or an install script that downloads and executes code.

Why not publish a score out of ten?

Because the inputs do not support one. Stars measure attention, verification levels measure how far an install path was exercised, and a static scan catches patterns rather than intent. Publishing a single number would turn three partial signals into one false certainty.

Related pages

• How to judge a plugin before you install it
• What the L1–L5 verification levels prove
• Every listing by harness target
• Report a problem or request a correction