Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Nagi-ovo/dsh-find-plugins --skill find-pluginsgit clone --depth 1 https://github.com/Nagi-ovo/dsh-find-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nagi-ovo/dsh-find-plugins/find-plugins)<a href="https://agentmods.dev/skills/nagi-ovo/dsh-find-plugins/find-plugins"><img src="https://agentmods.dev/badge/skills/nagi-ovo/dsh-find-plugins/find-plugins.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.01384 |
| Opus 5 | $0.00051 | $0.00692 |
| Sonnet 5 | $0.00020 | $0.00277 |
| Haiku 4.5 | $0.00010 | $0.00138 |
Grade A, and why
find-plugins scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
找插件、装插件
把 GitHub 的 dsh-plugin topic 当作插件身份，不把某个 owner 或组织当作目录。
仓库转移后以搜索结果返回的最新 fullName 和 url 为准。完成态只有一个：用户
选中的插件在他的 DSH 里可用。
Step 1：取候选池
运行本 skill 自带的确定性检索脚本：
node <本 skill 目录>/scripts/search-topic.mjs > <临时目录>/dsh-plugins.json
脚本搜索所有公开、未归档、非 fork、带 dsh-plugin topic 的仓库，并处理 GitHub
分页。它依次复用 GITHUB_TOKEN / GH_TOKEN、本机 gh 登录令牌以提高限额；都
没有时使用公开 API。限流时运行 gh auth login 后重试，不要退回组织仓库列表。
完成点：JSON 中的 repositories 非空，每条都有当前 fullName、url、描述、
topics 和更新时间。按 fullName 去重，不根据旧 owner 猜地址。
Step 2：筛选并确认装法
先用用户需求对照 name、description、topics，按 pushedAt 优先查看较新的
命中项。只对语义最匹配的少量仓库读取 README、package.json 和仓库文件树：
package.json声明dsh.bundle.patch：bundle。- 含一个或多个
SKILL.md，且没有 bundle 声明：skill。 - README 明确要求写入
cordis.patch.yml，但没有 bundle 声明：cordis。 - 只有
.dsh-plugin/repository旧格式：标成「需迁移」，不能直接安装。 - 仍无法判断：标成「需核对」，不要编造安装命令。
如果当前账号能读取 dsh-external/hub/catalog.json，可以把其中的 note、
category、managers 当补充信息；只接受 url 与 topic 搜索结果当前 URL 完全匹配
的条目。Hub 缺失、私有或仍指向转移前地址都不影响发现结果，也不能覆盖仓库自身
的当前声明。
产出最多 3 行候选表：名字、一句话用途、最近更新、装法。表后用一句话说明首选 理由。比如「整活 / 复古 / 好玩」可命中 dsh-ads；「把数据、流程和对比画出来」可命中 dsh-visualize。
一条都不匹配时直说 topic 目录里没有，并问是否转 make-dsh-plugin 现写一个。
Step 3：用户拍板
停下来等选择。用户已经点名某个插件时，从 Step 2 核对当前仓库和装法后直接进入 Step 4。
Step 4：安全检查并汇报
用户点头之后、动手之前，先看一遍这个插件装进来会拿到什么。插件运行在用户的 DSH 进程里，能读会话、调工具、跑命令，装它等于授权，所以这一步不能跳过，也不 能只在发现问题时才出声。
至少看这四处：
package.json的 lifecycle scripts：preinstall、install、postinstall、prepare在 Git / npm 安装时会执行。- 插件声明和源码里对外的动作：网络请求、子进程、写
$DSH_HOME之外的路径、 改 shell 配置或系统设置。 - 插件读取的会话数据和凭据：读会话日志、settings、
.env或 credentials 的地方。 - 仓库本身的可信度：
pushedAt、star 数、作者是否还有其他 dsh 插件、README 与 代码是否对得上。
不管有没有发现问题，都要汇报，三到五行讲清：查了哪几处、这个插件实际要什么 权限、有没有和它宣称的用途对不上的动作。有可疑项就把原文贴出来，别转述。
汇报完再问一次是否继续。用户说停就停在这里，不要顺手装完。
完成点：用户看过这份汇报，并明确说继续。
Step 5：安装
按确认出的安装类型打开 references/install-methods.md 并照对应小节操作。多个方式并存时按该文件开头的优先级选一种。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 101 lines · 101 tokens per session scan A 8eee4d2e07a0
find-plugins is a skill published in the GitHub repository Nagi-ovo/dsh-find-plugins (173 stars, last pushed 23d ago), licensed BSD-3-Clause. It adds 101 tokens to every session and 1,384 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
safe-find-dsh-plugins
Use when a user wants to discover or install a DeepSeek Harness plugin, asks whether a plugin exists for a task, or wants to explore the DSH ecosystem. Searches public repositories in GitHub's dsh-plugin topic across all owners, ranks candidates against the requirement, asks the user to choose, runs a SkillSpector…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…
dsh-web-sdk-compatibility
Adapt and repair dsh-web after an approved official @deepseek-ai SDK/runtime cohort is selected or installed. Compare public API, type, service-injection, module-table, protocol, and behavior changes; map every change to repository consumers; implement the smallest fixes and durable compatibility contracts; handle…
manage-taskboard
Manage work in the native DeepSeek Harness Taskboard with exact task ids and optimistic versions. Use when an Agent must inspect project work, claim an eligible todo, record progress or blockers, verify an implementation, submit it for human review, or release its own claim; also use when a human asks how to accept…
agentdebug
Use AgentDebugX for trajectory diagnosis only when the user explicitly asks to use AgentDebug, AgentDebugX, or the agentdebug skill. Do not invoke for generic debugging, diagnosis, inspection, or trajectory-review requests.