How DSH plugins are verified
Star counts measure attention. Verification measures how far a listing was actually checked. Every plugin here carries a level from L1 to L5 plus a security status and a health field, and the rules below are what those labels mean.
The five levels
| Level | Rule | Listed |
|---|---|---|
| L1 | Found Repository accessible, non-empty, README exists | 0 |
| L2 | Structured Manifest valid, key fields complete | 0 |
| L3 | Install spec Install command parsed, DSH target declared | 2 |
| L4 | Install tested Installed in an isolated sandbox without dependency errors | 10 |
| L5 | Run tested Plugin loads and runs; smoke test passed | 21 |
What a security scan covers
Where a scan has run, it is automated static analysis over the repository: declared dependencies, the permissions the code requests, obvious secret handling mistakes, and supply chain signals such as a suspiciously new package name or an install script that downloads and executes code.
An automated scan is a first line of defence, not a manual review. It will not catch a logically malicious plugin written to look ordinary, which is why the permission question stays on every listing and why the security guide walks through the review you should still do yourself.
The four questions on every listing
- What is it?
- Category, use cases and tags taken from the repository description, never invented.
- Is it safe?
- Security scan status plus the permission surface a reader needs to check before installing.
- Can I install it?
- Verification level L1 to L5, and an install command checked against the published package name.
- Is it maintained?
- Health field derived from commit activity, plus the declared dshTarget release and last update date.
Corrections
Listings go wrong in predictable ways: an install command drifts from a renamed package, a repository is archived, or a category no longer fits. Corrections are welcome from anyone, including maintainers who want their own listing fixed. Send them through the contact page, and read the editorial policy for how inclusion and removal decisions are made.
Questions
Does a verification level mean a plugin is safe?
No. Verification records how far the install path was exercised, from finding the repository to running the plugin. Safety depends on what the plugin can reach and what its code does, which is why every listing shows the permissions question separately.
Who performs the verification?
This directory performs its own checks against public repository data and records the result on each listing. Plugins are not submitted for approval by DeepSeek, and an official DeepSeek registry does not exist.
How often is a listing rechecked?
Listings are refreshed regularly, and any change to the repository, the install spec or the declared compatibility target is reflected in the listing. The last update date is shown on each plugin page.
Can a listing be removed?
Yes. A listing is corrected or removed when the install spec no longer matches the published package, the repository disappears, or the plugin is reported as malicious. Corrections can be requested on the contact page.