@snow-the/dsh-plugin-doctor
DSH 插件的静态安装前审查：扫描目录或已安装的软件包，检查数据外传、凭据访问、代码混淆、持久化和生命周期脚本等风险信号（自研，用于替代第三方审查插件）。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:snow-The/dsh-plugin-doctor#907dd3d5f03472dca373c1a1fd1b9d85d5e226e2Plugin Doctor 以 @snow-the/dsh-plugin-doctor 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Static vetting for DSH plugins — an own-built replacement for third-party
vetting plugins. Scans a plugin directory (a checkout, or an installed
package under ~/.dsh/profiles/*/node_modules) for red flags, scores them
SAFE / LOW / MEDIUM / HIGH, and reports evidence with file:line. It never
executes the scanned code — purely read-only static analysis.
.ssh, .aws, .env, credentials
files, wholesale process.env harvesteval/Function/vm, hidden
Unicode (zero-width / bidi controls)rm -rf /-style deletes, force pushesdoctor_scan — scan a path (directory or single file), defaulting to
the current profile's node_modules plugin packagesdoctor_scan_path — alias with an explicit path parameterMIT