{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"amlyczz-dsh-lark-link","slug":"amlyczz-dsh-lark-link","rank":149,"url":"https://github.com/amlyczz/dsh-lark-link","name":"amlyczz/dsh-lark-link","category":"notify","description":{"zh":"DeepSeek Harness 的高可靠飞书/Lark 桥接：扫码一键认证、卡片化命令与意图确认、at-least-once 零丢失出站队列、多媒体出入站、/doctor 会话日志 ZIP，并复用 DSH Web GUI 把会话归入正确工作区。","en":"High-reliability Feishu/Lark bridge for DeepSeek Harness: QR one-click auth, card-based commands and intent-confirmation cards, at-least-once zero-loss outbox, media in/out, /doctor session-log ZIP, and a reusable DSH Web GUI that lands sessions in the right workspace."},"stars":26,"starsCheckedAt":"2026-08-21","repository":{"owner":"amlyczz","repo":"dsh-lark-link","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:amlyczz/dsh-lark-link","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/amlyczz/dsh-lark-link/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"amlyczz-dsh-lark-link","slug":"amlyczz-dsh-lark-link","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:29.789Z","scanStatus":"static-complete","verdict":"review","score":74,"commit":"1a48d4865a92acdb87ec806f940241596c06835b","commitDate":"2026-08-21T19:00:01+08:00","artifactDigest":"sha256:266e29ac856b4d983cd90ee76446e54bdda2f5ea49e6a7c012645784ecd7d044","downloadUrl":"https://github.com/amlyczz/dsh-lark-link/archive/1a48d4865a92acdb87ec806f940241596c06835b.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:amlyczz/dsh-lark-link","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-lark-link","packageVersion":"0.5.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["slots"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-agent","@deepseek-ai/dsh-commands","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/dsh-storage-domain","@deepseek-ai/dsh-system-prompt","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-lark-link","nameMatch":null,"npm":{"name":"dsh-lark-link","latestVersion":"0.4.1","publishedAt":"2026-08-20T11:19:46.828Z","createdAt":"2026-08-13T18:36:11.201Z","versionCount":9,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"lark-link","name":"dsh-lark-link","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":3,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session"],"outboundHosts":[{"host":"accounts.feishu.cn","count":1},{"host":"accounts.larksuite.com","count":1}],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":7,"evidence":"!!js \"process.env.DSH_LARK_LINK_ENABLED ?? 'true'\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"b9df0115a5bd9d1429454b09"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"cordis.patch.yml","pathClass":"cordis","line":10,"evidence":"!!js \"process.env.DSH_LARK_LINK_APP_ID ?? ''\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"ef547e1008963f635ca5b4dc"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/host/auth-setup.ts","pathClass":"source","line":69,"evidence":"credential access at line 69 + outbound network at line 141","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"a692ac931910a240075f36f9","review":{"verdict":"functional","reason":"registerApp为Lark SDK官方扫码建应用流程，返回的client_id/client_secret经persist写入调用方持有的ctx.credentials，属于插件自述的\"扫码一键认证\"核心功能，未见外发至第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:21:04.113Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"js-yaml@4.2.0 GHSA-52cp-r559-cp3m (CVE-2026-59869) fixed in 3.15.0","remediation":"升级 js-yaml 至 3.15.0 或更高版本。","layer":"vulnerability","hash":"a2592f25bd88261802c598c6","review":{"verdict":"unclear","reason":"所给 package-lock.json 片段被截断，未展示 js-yaml 实际条目及其在依赖树中的位置（运行时还是仅构建期），无法确认该 CVE 是否真实可达。","model":"sonnet","reviewedAt":"2026-08-21T10:49:03.996Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"js-yaml@4.2.0 GHSA-5p4m-2wfm-xmqj fixed in 4.3.1","remediation":"升级 js-yaml 至 4.3.1 或更高版本。","layer":"vulnerability","hash":"cd4c9fdebb131b0eb47ecd9f","review":{"verdict":"unclear","reason":"同上，可见的 package-lock.json 内容未包含 js-yaml 版本行，缺乏证据确认该已知漏洞版本确实存在于依赖树中并被使用。","model":"sonnet","reviewedAt":"2026-08-21T10:49:03.996Z"}}],"counts":{"critical":0,"high":2,"medium":3,"low":0},"rawCounts":{"critical":0,"high":2,"medium":3,"low":0},"vulnerabilities":[{"id":"GHSA-52cp-r559-cp3m","aliases":["CVE-2026-59869"],"package":"js-yaml","version":"4.2.0","severity":"high","fixed":"3.15.0","summary":"js-yaml: YAML merge-key chains can force quadratic CPU consumption"},{"id":"GHSA-5p4m-2wfm-xmqj","aliases":[],"package":"js-yaml","version":"4.2.0","severity":"high","fixed":"4.3.1","summary":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":88,"bytesScanned":815460,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":35,"markdown":7,"cordis":1,"data":2,"manifest":1,"source":41,"script":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:29.789Z","summary":null,"intentMatch":null,"findingsReviewed":3,"findingsCandidates":3,"fromCache":3,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:29.789Z","commit":"1a48d4865a92acdb87ec806f940241596c06835b","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:04.113Z","commit":"1a48d4865a92acdb87ec806f940241596c06835b","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:49:03.996Z","commit":"9e4332cea378c5a252b25917cc82fd82fbd6f2bb","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"1a48d4865a92acdb87ec806f940241596c06835b","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:29.789Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"1a48d4865a92acdb87ec806f940241596c06835b","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:04.113Z"},{"kind":"first-scan","from":null,"to":"review","commit":"9e4332cea378c5a252b25917cc82fd82fbd6f2bb","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:49:03.996Z"}]}