
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
dsh-plugin-devkit
Advanced tools
🇬🇧 English | 🇨🇳 简体中文
Developer toolkit for building DeepSeek Harness (dsh) plugins. Generates compliant scaffolds, lints your tool schema against the 3 hard rules, and prepares a registry entry for publishing.
# Option 1 (recommended): from npm (package name is dsh-plugin-devkit)
dsh plugin --profile web add dsh-plugin-devkit
# Option 2: from GitHub
dsh plugin --profile web add github:d-ouyang/dsh-plugin-devkit
# local dev:
dsh plugin --profile web add ./dsh-plugin-devkit
Restart the web service (:3080) after installing.
scaffold_plugin — generate a compliant scaffoldSay in chat: "Generate a dsh plugin named my-tool, category tools, author d-ouyang"
→ Creates ~/dsh-plugin-my-tool/ with index.js (correct schema + rule comments), <name>-core.js, package.json, cordis.patch.yml, README.md, test.mjs, examples/.
lint_plugin — catch the 3 hard schema rulesSay: "Check if ~/dsh-plugin-my-tool's schema is valid"
→ Compiles your tools with the real harness defineTool compiler and translates cryptic errors into "you broke rule N — fix it like this".
explain_rules — the 3 hard rules explainedSay: "What are the 3 hard rules for dsh tool schema?"
open_landscape — plugin market landscape dashboardSay: "Show me the dsh plugin market" / "Open the plugin landscape"
→ Generates and opens a visual dashboard: per-category plugin counts / avg stars / max stars, Top 25 by stars, and a competition-gap scan. Every direction has a "create this kind of plugin" button that copies a market-aware prompt — paste it into chat and the agent uses scaffold_plugin to build that direction for you.
file://~/.dsh/devkit/landscape.htmlhttp://localhost:3080/devkit/landscaperequired is either omitted or true — never false.type is a single string — no arrays (use type: 'json' for nullable).object (incl. nested items) must set additionalProperties: true|false.Full workflows: USAGE.md (EN) · USAGE.md (中文)
FAQs
开发者工具包:一键生成合规 dsh 插件脚手架(默认 TypeScript,可选 JavaScript)、按三条硬规则校验 schema、生成社区注册表发布条目。
The npm package dsh-plugin-devkit receives a total of 3 weekly downloads. As such, dsh-plugin-devkit popularity was classified as not popular.
We found that dsh-plugin-devkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.