What the permission labels on a plugin mean
Plugin pages list what a plugin's code appears to do: read files, use the network, run commands. This page explains each label in plain terms, and what the scan can and cannot tell you.
How the labels are made
The catalog scans each plugin's published code statically, which means it reads the code and looks for the calls that reach files, the network, the shell and so on. It does not run the plugin. So a label says "this code contains a call like that", not "this plugin does that to you".
"Nothing detected" is not "safe". A static scan misses code that is built at runtime, downloaded later, or hidden in a dependency it did not follow. Use the labels to know what to look at, not as a verdict.
The labels
| Label | What it means for you |
|---|---|
| reads files on this machine | It can open files your account can open. Normal for anything that works with projects or settings. |
| writes files on this machine | It can create or change files. Normal for plugins that save notes, caches or configuration. |
| reads your environment variables | It can see variables such as proxy settings or API keys set in your shell. |
| uses the network | It can connect to other computers. Normal for anything that calls an AI model or checks for updates. |
| uses your keys | It reads API keys or tokens. Expected for a plugin that calls a model on your behalf. |
| runs commands | It can start other programs through the shell. Powerful, and normal for developer tools. |
| calls an AI model | It sends text to a model, so that text leaves your machine to wherever the model runs. |
| starts tasks on its own | It can launch sub-agents that work without you approving each step. |
| runs code assembled at runtime | It executes code that is built while running. Harder to review, because the code you read is not all the code that runs. |
| uses DSH internal packages | It reaches into DSH's own packages, which ties it to particular DSH versions. |
The ones worth a closer look
- Runs a script at install time. The package carries a script that runs the moment it is installed, before you open the plugin. Read it first, or install a pinned commit.
- Connects to a fixed IP address, or over unencrypted http. Sometimes harmless (a schema URL), sometimes not. The label names the address so you can judge.
- Changes DSH's own components. The plugin overrides or disables something DSH ships. Legitimate for deep integrations, but it changes behaviour you did not install it to change.
The common combination "uses the network and your keys" is what any model plugin does. It is information, not an alarm.
Practical habits
- Prefer plugins whose label list matches what they claim to do. A theme that runs commands is worth a question.
- Pin a version or commit for anything you rely on, and update on purpose rather than automatically.
- Open the source link on the plugin page. It takes a minute and is the one thing a label cannot replace.