
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
dsh-plugin-prune
Advanced tools
Prune dead plugins in DeepSeek Harness: measures the real usage of every plugin's tools and skills (calls, error rate, latency, sessions) plus your value ratings, and flags the plugins you can safely remove. · 死插件修剪器:统计每个插件工具/技能的真实使用(调用、错误率、耗时、跨会话)与你的价值评分
Prune dead plugins in DeepSeek Harness — measures the real usage of every plugin's tools and skills (calls, error rate, latency, cross-session use) plus your value ratings, and flags the plugins you can safely remove.
This is a pure observer plugin: it registers no model tools and modifies no business state. It:
tools/execute + tools/result and aggregates, per tool and per
skill, the number of calls, error count, total/average dispatch duration,
rendered output size, distinct using sessions, and per-day call counts
(rolling 90-day window).pluginInventory Remote): status (ok/disabled/failed), contributed tool
counts and real call statistics per installed plugin — flagging the
never-used / failed / marked-useless ones, i.e. the direct answer to
"which plugins can I remove";$DSH_HOME/dsh-plugin-prune.json
(falls back to ~/.dsh/dsh-plugin-prune.json), so counts accumulate across
restarts.Note: statistics are only collected while the plugin is installed and running; past usage cannot be reconstructed.
# from npm
dsh plugin --profile web add dsh-plugin-prune
# from a git checkout
dsh plugin --profile web add github:<your-org>/dsh-plugin-prune
Restart dsh web and open Settings → Plugins → Plugin Health.
Compatibility: dsh >= 0.1.0-rc.5, Node ^22.19 || >=24, web profile.
engines.dsh gates installation on older deployments.
The patch row accepts optional config:
- id: plugin-prune
name: 'dsh-plugin-prune'
config:
debounceMs: 2000 # persist debounce (>= 100)
keepDays: 90 # per-day count window (>= 7)
dataPath: '' # absolute file override; empty = $DSH_HOME default
pnpm install
pnpm run check # typecheck (host + client) and build
Layout: src/index.ts (host service) → lib/; src/client/ → the
__ModuleLoader__ factory bundle at client/client.js. cordis.patch.yml
inserts the host row; scripts/preflight.mjs guards the package-name wiring.
npm
npm publish --access public
prepare builds on git installs; prepack runs the full check plus
preflight. Publish a version only after pnpm run check passes.
GitHub — push the repository and add the topic dsh-plugin so
dsh-find-plugin and the community directories can discover it.
awesome-dsh-plugin.com — submit the package to the community curated directory so the marketplace surfaces it.
Changelog & tags — tag releases (v0.1.0); the marketplace and users
alike prefer pinned versions over latest.
MIT
FAQs
Prune dead plugins in DeepSeek Harness: measures the real usage of every plugin's tools and skills (calls, error rate, latency, sessions) plus your value ratings, and flags the plugins you can safely remove. · 死插件修剪器:统计每个插件工具/技能的真实使用(调用、错误率、耗时、跨会话)与你的价值评分
We found that dsh-plugin-prune demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.