dsh-spring-admin-kit
Manifest validSpring Boot admin toolkit: EasyExcel batch import/export code generation and Thymeleaf + LayUI template safety guard.
dsh-spring-admin-kit
面向 Spring Boot + MyBatis Plus + Thymeleaf + LayUI 企业后台开发者的 DSH 技能插件,把两个实战验证过的技能打包为一个可安装的插件,通过 DSH 官方的运行时技能注册 API(ctx.skills.register())注入,模型可自动触发,用户也可在技能目录中手动调用。
内置技能
1. excel-batch-import-export
为后台管理页面实现 EasyExcel 批量导入/导出/模板下载三件套:
- 统一 VO(
@ExcelProperty列头与 index 规范) - Controller 三个端点(downloadTemplate / export / import)
- Service 层按业务唯一键 Upsert(
@Transactional+ 空行过滤) - Thymeleaf + LayUI 前端(
upload.render在 tabledone回调重绑、导出确认弹窗、<a>模板链接) - 附实现后检查清单
触发:批量导入、批量导出、导入模板、Excel导入、EasyExcel。
2. thymeleaf-layui-guard
Thymeleaf + LayUI 模板语法安全守卫,防止 cols: [[...]]、onclick="fn({...})" 等写法被 Thymeleaf 内联解析导致 TemplateInputException。含 6 条强制规则(th:inline="none"/"javascript" 分离、cols 写法、禁内联事件、块注释、变量注入标准写法、页面标准结构)与提交前检查清单。编辑 templates/**/*.html 时应激活。
触发:Thymeleaf、LayUI、模板页面、后台管理、cols、table.render。
安装(本地路径)
node "<DSH app>/node_modules/@deepseek-ai/dsh/lib/bin.js" plugin --profile web add /path/to/dsh-spring-admin-kit
安装后重启 / 刷新 DSH Desktop,在技能目录(或 /skill 列表)中应能看到两个技能;模型在匹配场景下会自动建议加载。
使用示例
- 「给门店列表页加批量导入、批量导出和模板下载」→ 自动匹配
excel-batch-import-export,按模板生成 VO/Controller/Service/前端代码。 - 「新建一个用户管理页面」→ 生成
templates/**.html时按thymeleaf-layui-guard的 6 条规则产出安全模板。 - 手动调用:对话中直接说「用 thymeleaf-layui-guard 检查这个页面」。
设计说明
- 技能注册使用官方通道:插件作为 cordis host 服务加载,
inject: ["skills"]后在apply()中对每个技能调用ctx.skills.register(),SKILL.md的 YAML front matter 提供官方description,正文作为content注入。无需 slash command 或 hook 等替代方案。 - 兼容性对齐
dsh-subagent-sidebar(dsh: 0.1.7-alpha.1,profiles:["web"])。 - 插件内不含任何用户本机路径或密钥;技能正文中出现的项目内相对路径仅为示例项目结构。
License
MIT
dsh-spring-admin-kit (English)
A DSH skill plugin for enterprise admin developers on Spring Boot + MyBatis Plus + Thymeleaf + LayUI. Bundles two battle-tested skills and injects them via DSH's official runtime-skill API (ctx.skills.register()); both are model-invocable automatically and user-invocable from the skill catalog.
Bundled skills
- excel-batch-import-export — EasyExcel batch import / export / template download for admin pages: unified VO, three controller endpoints, service-layer upsert by business key with
@Transactional, Thymeleaf+LayUI frontend wiring, plus a post-implementation checklist. - thymeleaf-layui-guard — Template syntax safety rules preventing
TemplateInputExceptionfromcols: [[...]]/ inline{...}clashes between Thymeleaf inline parsing and LayUI JS. Six mandatory rules and a pre-commit checklist.
Install (local path)
node "<DSH app>/node_modules/@deepseek-ai/dsh/lib/bin.js" plugin --profile web add /path/to/dsh-spring-admin-kit
Restart/refresh DSH Desktop; both skills then appear in the skill catalog and are triggered by their keywords.
Design notes
- Skills register through the official channel: the plugin loads as a cordis host service, injects the
skillsservice, and callsctx.skills.register()once per bundledSKILL.md(front-matterdescription+ markdown body ascontent). No slash-command or hook workaround is needed. - Compatibility mirrors
dsh-subagent-sidebar(dsh: 0.1.7-alpha.1, profiles:["web"]). - No user-specific paths or secrets are hardcoded.
License
MIT
Comments
Loading…
Similar plugins
by tancheng33
Runtime security gate on the tool pipeline: denies calls naming hosts outside an egress allowlist, redacts credentials from results at the canonical value rather than only the rendered content, and ap
★ 1
↓ 95/wk
MIT
TypeScript
Sep 22, 2026
dsh plugin --profile web add dsh-egress-guardTaints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.
★ 0
dsh plugin --profile web add dsh-taintguardby a179-sanae
Automatic type-check diagnostics: after the model edits or creates TS files, runs `tsc --noEmit` in the background (debounced per project) and reports errors via the `code_check` tool — grouped by fil
★ 1
BSD-3-Clause
TypeScript
Aug 14, 2026
dsh plugin --profile web add @a179-sanae/dsh-code-checkString-matches tool-call input arguments, blocks dangerous tool calls (deny) or allows them with an injected warning (warn), and ships a full rules-management panel.
★ 0
dsh plugin --profile web add @jypjypjypjyp/dsh-guardrailby feely0208
装第三方插件之前,先看它会动什么 —— 静态审查一个包的代码能力(执行/读凭据/出网/装时钩子)
★ 0
MIT
Shell
Oct 16, 2026
dsh plugin --profile web add @deepwhale-cn/dsh-tool-vetStatic pre-install security auditor for plugin bundles: lifecycle scripts, dynamic execution, credential-exfiltration combos, and patch-layer hazards, with zero dependencies and in-memory tar parsing.
★ 0
dsh plugin --profile web add dsh-plugin-sentinel