Manifest-aware repository analysis

DSH plugin checker

Check any public GitHub repository against the same static rules this registry runs. Nothing is executed, installed, or published, and every result names the commit it was read from.

What happens next

STEP 01Manifest classification

The checker reads public metadata, package.json, the README, and the repository tree.

STEP 02Evidence gaps

It records install-time scripts, missing bundle patches, unstated versions, and checks the registry has not run.

STEP 03Review before install

Open the source, pin the commit, and test in a disposable profile.

Static signals cannot prove a plugin is safe, future-compatible, or free of hidden behaviour. Review the source, pin a commit, and test in a disposable profile before trusting any record here.