Jinsong-Zhou / safe-find-dsh-plugins

safe-find-dsh-plugins

简体中文 | English

A DSH plugin that finds plugins for your task across the entire GitHub dsh-plugin topic, with a security scan before anything gets installed.

Install

Send this repository link to DSH and say "install this plugin for me".

To install manually, copy the whole skills/safe-find-dsh-plugins/ directory into $DSH_HOME/skills/, or into <project-root>/.agents/skills/ for one project only. Once it's in place it just works — no other configuration.

What it does

Given your request, it first pulls every public repository under the topic (skipping archives and forks), ranks them against what you asked for, takes a close look at only the best few, works out how each one is meant to be installed, and hands you a shortlist of at most three candidates.

After you pick one, it doesn't install right away: it pins the candidate's exact commit, then runs a static security scan over that source — plugin code is never executed. A clean scan moves ahead; if risks turn up, every finding is laid out for you and the decision is yours; high-risk results, failed scans, or a missing scanner never install. What ends up in your environment is always the exact commit that was scanned — and this step is never skipped, even when you named the plugin yourself from the start.

The scanner is a separate dependency. Before installing a plugin for you the first time, it checks whether the scanner is present and hands you the install command if not.

Acknowledgements

• Forked from Nagi-ovo/dsh-find-plugins.
• Security scanning is powered by NVIDIA SkillSpector: uv tool install git+https://github.com/NVIDIA/skillspector.git.

License

MIT © 2026 Jinsong Zhou. See LICENSE.