Borrowing it
Nothing to install: this file belongs to xun404/dsh-pihuo-plugins. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/xun404/dsh-pihuo-plugins/main/.agents/skills/dsh-plugin-compose/SKILL.mdgit clone --depth 1 https://github.com/xun404/dsh-pihuo-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-compose)<a href="https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-compose"><img src="https://agentmods.dev/badge/skills/xun404/dsh-pihuo-plugins/dsh-plugin-compose/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xun404/dsh-pihuo-plugins/dsh-plugin-compose"><img src="https://agentmods.dev/badge/skills/xun404/dsh-pihuo-plugins/dsh-plugin-compose.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.01021 |
| Opus 5.5 | $0.00036 | $0.00408 |
| Sonnet 5.5 | $0.00018 | $0.00204 |
| Haiku 4.5 | $0.00009 | $0.00102 |
Grade A, and why
dsh-plugin-compose scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
组装、安装、发布
运行中的 dsh 是一棵由多层 patch 叠出来的插件树。本技能拥有层顺序、patch 语义、profile/bundle manifest、安装命令。插件源码怎么写见 dsh-plugin-author。
对照：../deepseek-harness/packages/boot/app-boot、vendor/include、apps/cli/src/plugin.ts。
细节：references/layers.md、references/publish.md。
两个概念
| 组合包 bundle | Profile | |
|---|---|---|
| 回答 | 这个包贡献什么 | 按什么顺序叠哪些包 |
| 位置 | 任意 npm/git/path 包 | $DSH_HOME/profiles/<name>/ |
| manifest | "dsh": { "bundle": { "patch": "./cordis.patch.yml" } } |
"dsh": { "profile": { "bundles": [...] } } |
| 谁维护 | 插件作者 | dsh plugin（不要手改 bundles 除非排障） |
没有东西同时是两者。没有 dsh.bundle 的包仍可安装，只当普通依赖，不进层栈。
内置模板：web = dsh-base + dsh-web-app；headless = dsh-base + dsh-headless。自定义 profile 默认从 dsh-base 起。
层顺序（后写的按行胜出）
dsh.profile.bundles里每个组合包的 patch，按列表顺序- profile 的
cordis.patch.yml $DSH_HOME/cordis.patch.yml- 每个
--patchoverlay，按 argv 顺序
应用参数不是一层 patch。覆盖按 id 整行替换 config，不是深合并。覆盖必须重述该行每一个键。
模块解析：先 dsh 安装目录，再 profile node_modules，再 $DSH_HOME/profiles/node_modules（启动时 heal 的扁平 symlink）。内置包永远跟当前安装走。树外插件必须把 @deepseek-ai/cordis 和所用服务定义做成 peer，以便落到同一份安装实例。
日常命令
dsh plugin --profile <name> add <spec> # 转发 pnpm；相对路径按调用目录锚定
dsh plugin --profile <name> remove <pkg>
dsh --profile <name> --dump-config # 必须能看到 "# == <pkg>"
dsh --profile <name>
dsh web --patch ./overlay.yml # 开发 overlay，不改 profile
add 成功后按已安装状态对账：有 dsh.bundle 的依赖追加进 bundles；去掉或不再声明 bundle 的依赖从层栈移除。模板内置包不是依赖，不会被 remove 逻辑碰到。
写 patch 时
- 新插件：根级
insert，自带稳定id。 - 改已有行：
- id: <existing>+ 完整config。name若写了必须与目标一致，否则跳过并 warn。 insert进某个 group：带上那个 group 的id。- 同层后一条可以改前一条刚 insert 的行。
- 匹配不到的 patch 被跳过，不失败启动——所以 dump 是验收，不是可选项。
发布检查
按 publish.md 的作者清单做完再让用户 add。Git 安装必须有自包含 prepare，用户还要在该 profile 的 pnpm-workspace.yaml 里 allowBuilds。能发 npm / tarball 就不要逼用户授权 prepare。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 69 lines · 91 tokens per session scan A 86dff74d120d
dsh-plugin-compose is a skill published in the GitHub repository xun404/dsh-pihuo-plugins (2 stars, last pushed 2mo ago), licensed MIT. It adds 91 tokens to every session and 1,021 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
dsh-plugin-compose compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| dsh-plugin-composexun404/dsh-pihuo-plugins | Skill | 2 | 2mo ago | MIT | A | 91 | Claude Code |
| dsh-plugin-guidePerryLink/dsh-plugin-guide | Skill | 65 | yesterday | Apache-2.0 | A | 62 | Claude Code, Codex |
| codex-syncWalvez/dsh-codex-sync | Skill | 30 | 1mo ago | MIT | B | 40 | Claude Code, Codex |
| dsh-plugin-developmentw2112515/dsh-plugin-development | Skill | 11 | 2mo ago | MIT | A | 130 | Codex |
| dsh-tui-guideccch1mneyyy/dsh-TUI | Skill | 7.2k | today | MIT | A | 41 | Claude Code, Codex |
| modsearchliustack/modsearch | Skill | 952 | 11d ago | MIT | A | 99 | Claude Code |
| submit-dsh-pluginimsai-sh/awesome-deepseek-harness-plugins | Skill | 370 | yesterday | MIT | A | 103 | Codex |