dshbase

Blog · Analysis

The dsh-plugin topic is polluted

August 16, 2026 · dshbase

When we audited our plugin directory, we found something uncomfortable: the #1 plugin by stars was not a DeepSeek Harness plugin at all.

openhanako — 6,047 stars, sitting at the top of our "most popular" list — is a personal AI agent with memory and personality. It has no dsh-plugin topic, no bundle manifest, and no relationship to DeepSeek Harness whatsoever. It was there because it (or a snapshot of it) once carried the dsh-plugin tag, and directories that don't verify simply passed it through.

The problem: tag-squatting

The official GitHub dsh-plugin topic is the natural place to discover plugins — but GitHub topics are self-assigned and unverified. Any repo can add the tag for visibility, and many do. In our sweep we found:

  • Standalone AI agents — openhanako (6k★), exo (646★), synergy (542★)
  • Cross-tool bridges — EchoBird (3k★, "model switch across 20+ coding agents"), ccteam (Claude Code/Codex/Grok/Kimi orchestrator)
  • Claude ecosystem tools — open-managed-agents (Claude Managed Agents API), MateBot (a "claudeclaw clone")
  • Generic dev kits — Python devkits, Go multi-agent frameworks, PPTX generators

None of these load in DeepSeek Harness. A real DSH plugin is a bundle — it ships a cordis.patch.yml / cordis.yml manifest and is installed with dsh plugin add. Tag-squatters don't have that.

How we vet

Since then, every plugin in dshbase is checked three ways before it's listed:

  1. Bundle manifest — does the repo actually ship cordis.patch.yml / cordis.yml / dsh.bundle.patch? That's the mechanical signal a plugin can load in dsh.
  2. Topic — is it currently tagged dsh-plugin?
  3. LLM read of the README — DeepSeek reads each repo's README and judges whether it's a real DSH plugin or a tag-squatter, and writes the bilingual description.

That combination caught 19 non-DSH projects we'd inherited from an upstream snapshot — including the top three by stars. We removed them all.

Why this matters for the ecosystem

DeepSeek Harness is growing fast, and the dsh-plugin topic is the de-facto registry. If it's polluted, then every directory that trusts it — including ours, before this audit — shows users plugins that aren't plugins. That erodes trust in the whole ecosystem.

Our directory now runs this verification as part of the pipeline, so the list stays clean. If you maintain a DSH plugin directory or the topic itself, we'd encourage the same: check for a bundle manifest before listing. Stars are not a signal — the most-starred repo in the topic isn't even a plugin.

Browse the cleaned directory here.

All articles →

🌐 中文