💻插件库应该由官方来做才安全

[MKhichain]

现在一眼望去插件的库都是每天上千个，近似功能的可能有三分之一，而且有可能植入恶意代码/提示词。应该由官方统一审核管理才行吧，或者上一套AI审核的核心。

[zoahdev]

You're right that the raw numbers are exploding and that "near-duplicate + potentially malicious" is the real risk. The practical answer is not necessarily official centralization (the team hasn't opened the PR channel, and a full official review org is heavy), but a layered, verifiable trust model — and most of the layers already exist in community form:

1. Registry with a verified flag — dsh-subscribe is a 569-plugin registry, but only a small subset carries verified, and it requires actual passing CI (build/test/install) rather than self-attestation. Curation at the registry layer is the cheap first filter.
2. Static, deterministic audit — dsh-sandbox-audit checks whether a profile's sandbox wiring actually enforces the policy it claims (bare fs-local, unguarded reads, destructive ops). It runs on config, is reproducible, and gates CI — it catches the "says read-only but can write" class of problem without any LLM.
3. LLM source review — dsh-code-security (by ihuajiu, from 我把 OpenAI Codex Security 的付费墙拆了，给 DSH 做了一个安全审计门禁 #2198) reads plugin source code with bounded collection + secret redaction + untrusted-input framing, which is the layer that can actually flag malicious code/prompts.

The honest caveat: none of these alone is a silver bullet, and "AI review" has a false-negative problem — a policy inconsistency that a static check catches instantly is exactly the kind of thing an LLM reviewer will often miss, and vice versa. That's why the useful model is gate = registry-verified AND static-audit-clean AND (optionally) LLM-reviewed, not "official team approves every plugin".

If the maintainers want to define a single canonical verified contract (what a plugin must pass to be trusted-by-default), I'd be glad to write that spec against the existing dsh-subscribe / dsh-sandbox-audit / dsh-code-security behavior so the three tools converge on one definition instead of three slightly-different ones.

[JairChan]

本来就是，到时候等别人插件投毒。等吧，看他们做不做。

[Electricitysheep]

插件库安全担忧很真实——上千个插件、近三分之一功能近似、可能埋恶意代码，官方审核或 AI 审核确实该上。

这和我们第 13 章的判断一致：安全工具链（vetting/check-dsh-profile/Plugin Doctor/Codex 门禁）先顶上，官方 registry + 审核是治本。https://github.com/Electricitysheep/dsh-handbook/blob/main/docs/13-security.md