A Practical Security Guide for dsh Plugins
2026-08-14
Plugins are code
A dsh plugin can declare tools, hooks and UI — and, like any npm package, it can run arbitrary code during installation and at runtime. Treat each plugin the way you treat a new dependency in your own project.
What to check before installing
Look at the repository's license and recency. Prefer plugins with an explicit risk disclosure, no surprise network calls, and an install path that does not request credentials. Our health score aggregates exactly these signals.
Limit privileges
Run untrusted plugins in a dedicated profile, review manifests before first run, and pin commits for GitHub installs. Audit your installed plugins periodically with a plugin health check.