JazzuLu/find-dsh-plugins

find-dsh-plugins

中文 | English

A conversational plugin finder for DeepSeek Harness — semantic search × four-source aggregation × security audit.

Ask "is there a plugin that tracks token usage?", and the agent searches a unified four-source index, semantically ranks the results, returns a candidate table with security markers, then installs safely and verifies the mount.

Table of Contents

1. What makes it different
2. Supported agents
3. Quick start
4. Usage example
5. How it works
6. Compatibility
7. Data sources & freshness
8. Data sources & credits
9. Security model
10. FAQ
11. Development & contributing
12. License

What makes it different

Supported agents

Built on the open Agent Skills (SKILL.md) standard — the same skill body loads in any compatible agent:

Quick start

Option 1: Skills CLI (recommended, all agents)

# Project-level
npx skills add JazzuLu/find-dsh-plugins

# Or global (all projects for the current user)
npx skills add JazzuLu/find-dsh-plugins -g

Option 2: Manual copy for DSH (no restart)

# 1. Copy the runtime skill directory (only what the agent needs)
mkdir -p ~/.dsh/skills/find-dsh-plugins
cp -r SKILL.md scripts references ~/.dsh/skills/find-dsh-plugins/

# 2. Start a new session (or wait for the watcher)
# 3. Just talk:
#    "Is there a plugin that tracks token usage?"
#    "Help me install an SSH remote ops panel"
#    "What fun UI-enhancement plugins exist?"

Option 3: Bundle install (DSH, restart required)

dsh plugin --profile web add github:JazzuLu/find-dsh-plugins
dsh web   # restart to load

Upgrade / Uninstall

# Upgrade (bundle): re-run the install command
dsh plugin --profile web add github:JazzuLu/find-dsh-plugins

# Uninstall (bundle): always use the package name, never a local path
dsh plugin --profile web remove find-dsh-plugins

# Uninstall (manual copy): delete the directory
rm -rf ~/.dsh/skills/find-dsh-plugins

Usage example

You: Is there a plugin that tracks token usage?
AI:
Candidate 1: dsh-web-ui (collection)  ★1416  [LISTED]
  One-liner: DSH Web UI plugin & skin collection, includes live token stats
  Why it matches: you want token-usage tracking; the collection ships a
                 live-stats component and is curated by all four sources
  Install: dsh plugin --profile web add @linxin666/dsh-web-ui-all

How it works

Four sources (lanshu / awesome / dsh.so / GitHub topic)
   → build-index.mjs unified index (layered TTL, refresh on query)
   → search.mjs BM25 pre-filter → top-30
   → agent LLM semantic ranking → candidate table (with security markers)
   → install-methods.md safe install → post-install verification

Compatibility

• Node.js ≥ 22: scripts use built-in fetch and node:test, zero third-party dependencies.
• Network: needs access to the four data sources (lanshu / awesome-dsh-plugin / dsh.so / GitHub API).
• DSH: tested on the 0.1.x line (web profile); works with any SKILL.md loader.

Data sources & freshness

Freshness: curated sources TTL 30 min, GitHub incremental 15 min, GitHub full daily; stale layers refresh synchronously on query. Optional scheduled tasks:

# launchd/cron: refresh curated + incremental every hour
0 * * * *  cd <skill-dir> && node scripts/build-index.mjs --quiet

# daily full refresh
0 3 * * *  cd <skill-dir> && node scripts/build-index.mjs --refresh-full --quiet

Data sources & credits

The index aggregates data from the following public sources; data copyright belongs to each source, this skill only aggregates and searches:

• Lanshu DSH plugin hub (https://dsh.lanshuagent.com) — 30-min scan and the evidence-grading system;
• awesome-dsh-plugin (https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) — community-curated directory with bilingual descriptions;
• dsh.so (https://www.dsh.so) — DeepSeek Harness developer hub, whose plugin index is open under a "Free to reuse with attribution" license — special thanks;
• GitHub dsh-plugin topic (https://github.com/topics/dsh-plugin).

Security model

• Evidence grades: LISTED (lanshu curated) > CURATED (awesome curated) > INDEXED (dsh.so) > TOPIC (GitHub topic only).
• Local static audit: lifecycle scripts, writes outside $HOME, shell-config modification — run in real time only for the top-3 candidates before the user confirms (GitHub anonymous API rate-limit budget).
• Disclaimer: plugins are third-party code; installing means trusting them. This skill only surfaces signals, it is not an endorsement.

FAQ

Q: Why are results sometimes not the freshest? A: The index auto-refreshes on layered TTLs (curated 30 min / GitHub incremental 15 min / full daily); stale layers refresh synchronously on query — you get the freshest state available at query time, never fresher than the sources themselves.

Q: What if nothing matches? A: The skill retries once with synonyms first; if still empty, the ecosystem truly lacks it — ask the agent to build one with make-dsh-plugin.

Q: Does the security audit execute plugin code? A: No. The static audit reads package.json and README text only (lifecycle scripts, write paths, shell-config keywords) — no dependencies installed, no code executed.

Q: Do I need an API key or to pay? A: No. BM25 pre-filter runs locally for free; LLM re-ranking reuses the current session's model with no external API calls.

Q: How is this different from dsh-find-plugin / dsh-plugin-finder? A: See the comparison table — semantic search, four-source aggregation, and security audit are the three core differences.

Development & contributing

• Tests: npm test (node:test, zero dependencies).
• Scripts: build-index.mjs (index), search.mjs (retrieval), audit.mjs (audit).
• PRs welcome: fix source field mappings, add audit rules, tune BM25 weights.

License

BSD-3-Clause. All code original, no upstream implementation inherited.