DSH Plugin Doctor: compatibility and security checks for plugin bundles

[Xrainsmile]

I built a small tool for validating DSH plugin bundles before they are installed into a real Profile:

https://github.com/Xrainsmile/DSH-Plugin-Doctor

DSH Plugin Doctor checks plugin compatibility, scans risky behavior, installs the plugin in an isolated temporary DSH_HOME, starts a test Web/Profile, and generates Markdown/JSON reports plus a compatibility badge.

Main features:

• Validate package.json and dsh.bundle.patch
• Check Node, DSH, Cordis, and peer dependency compatibility
• Scan high-risk behavior such as lifecycle scripts, shell execution, filesystem access, network access, credential access, hooks, dynamic eval, and native modules
• Install into a temporary DSH_HOME and test Profile
• Start Web/Profile to detect plugin-caused startup failures
• Generate Markdown, JSON, and SVG badge reports
• Provide a dsh-plugin-doctor install flow with automatic Profile rollback on failure
• Include GitHub Actions support for Linux, macOS, Windows, and multiple DSH versions

I made this because official plugins are npm Bundles installed through:

dsh plugin --profile <profile> add <package>

[Electricitysheep]

装前检查兼容性 + 扫描危险行为——正是我们第 13 章"插件安全审计清单"的工具化落地（检查清单 vs 自动化检查，互补）。

已收录进手册生态章节 + 第 13 章审计清单可结合使用：https://github.com/Electricitysheep/dsh-handbook/blob/main/docs/13-security.md