{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"andiii208-dsh-ultramath","slug":"andiii208-dsh-ultramath","rank":1203,"url":"https://github.com/Andiii208/dsh-ultramath","name":"Andiii208/dsh-ultramath","category":"skill","description":{"zh":"数学建模竞赛多 Agent 求解工作流：「UltraMath」主控预设一个预设跑通 读题→框架→推导→编码→验算→论文→审稿 全流程，另有 数学家/工程师/作家/审稿人 4 个单阶段角色预设与 33 篇模型库技能文档。","en":"Multi-agent workflow for math-modeling contests: the \"UltraMath\" preset runs a problem from reading through framework, derivation, coding, verification, paper and review, plus 4 single-stage role presets (mathematician, engineer, writer, reviewer) and 33 model-library skill docs."},"stars":1,"starsCheckedAt":"2026-08-21","repository":{"owner":"Andiii208","repo":"dsh-ultramath","requestedRef":null,"subpath":""},"npm":"dsh-ultramath","downloads":136,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-ultramath","tarball":null,"added":"2026-08-19","page":"https://awesome-dsh-plugin.com/p/Andiii208/dsh-ultramath/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"andiii208-dsh-ultramath","slug":"andiii208-dsh-ultramath","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:32:45.979Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"ac6bf7fefa1eb3b65110aa6b9caf53b8a88923a3","commitDate":"2026-08-22T00:57:37+08:00","artifactDigest":"sha256:ce462e12629f90ec4a7838fae1f3afc1246a04938821b80623f8e5acce89a488","downloadUrl":"https://github.com/Andiii208/dsh-ultramath/archive/ac6bf7fefa1eb3b65110aa6b9caf53b8a88923a3.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-ultramath","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-ultramath","packageVersion":"0.4.0","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-ultramath","manifestName":"dsh-ultramath","nameMatch":true,"npm":{"name":"dsh-ultramath","latestVersion":"0.3.0","publishedAt":"2026-08-19T17:47:23.456Z","createdAt":"2026-08-19T17:47:23.135Z","versionCount":1,"maintainers":1,"repository":"git+https://github.com/Andiii208/dsh-ultramath.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"ultramath","name":"dsh-ultramath","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"persistent-shell","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"str-replace-editor","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-str-replace-editor","keys":["maxOutputChars"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"tool-goal","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-goal","keys":[],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-engineer/agent.cordis.yml"},{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"persistent-shell","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"str-replace-editor","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-str-replace-editor","keys":["maxOutputChars"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-mathematician/agent.cordis.yml"},{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"persistent-shell","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"str-replace-editor","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-str-replace-editor","keys":["maxOutputChars"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-reviewer/agent.cordis.yml"},{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"persistent-shell","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"str-replace-editor","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-str-replace-editor","keys":["maxOutputChars"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath-writer/agent.cordis.yml"},{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"persistent-shell","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"str-replace-editor","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-str-replace-editor","keys":["maxOutputChars"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"tool-goal","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-goal","keys":[],"path":"presets/ultramath/agent.cordis.yml"},{"id":"delegation","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2","3","4","5"],"path":"presets/ultramath/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"presets/ultramath/agent.cordis.yml"}],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","environment","filesystem","host-bundle","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/standalone-repo.mjs","pathClass":"source","line":5,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7a8a6f66f727ad2d5a7a3dc3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/standalone-repo.mjs","pathClass":"source","line":5,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"3f84ec64cd63ef4e7816af38"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/validate-package.mjs","pathClass":"source","line":4,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"769a8f39a06365c8a3a559c2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/validate-package.mjs","pathClass":"source","line":4,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4f9cccfda6a4f20dcf5ba977"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":51,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"a44538859faeb628e9be93c1"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":86,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"03dadafb161957f770bdb054"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":89,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"c4828171e60e62e4a8cfe5a3"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":92,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"ec18bfbd691d14bd52f92379"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":95,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"37ff04d8f958c3f5382e05b8"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-engineer/agent.cordis.yml","line":98,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"b571aef4d5c740b031cbaf04"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":51,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"aa22c079ea3609d21c7e605a"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":86,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"f8d55cef4e5ba23adcc0744a"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":89,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"1e060e9a40720b0862647b1f"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":92,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"6ed6c6879c3940e41afc7ac5"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":95,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"e8f23a7408ea9d27d1a79ee0"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-mathematician/agent.cordis.yml","line":98,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"8791bd9eef271ce5f00c6b41"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":34,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"0e8c3a8dc48cd87ddb299c50"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":69,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"0dd229746218f31cbd9db330"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":72,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"d70e4662b17bb103928c6386"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":75,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"5ce614e285c0e2fc7647b139"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":78,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"e84e4ad69f61531e4101062b"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-reviewer/agent.cordis.yml","line":81,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"76fa3c52742a959dff531699"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":53,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"a0757746169fd9c453d6d3d8"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":88,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"25ede5a10cf3ed6cb1286d5d"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":91,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"84ad3d8014867d32e9539753"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":94,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"2229a819f30b543045891b45"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":97,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"ac1c6e958afa01d51dbaad53"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath-writer/agent.cordis.yml","line":100,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"e9082a815c3dd2263ec81701"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":47,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"a6f246d3dd0bbcc9894b00c7"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":81,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"cda154e6a4ce175695d180a2"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":84,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"18f539e9190af4574fbcdf8f"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":87,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"f80f675d68ebc8de40981a7a"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":90,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"4f084242c2efed006590bf5c"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"presets/ultramath/agent.cordis.yml","line":93,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"eaa27118b2ef616d8858da95"}],"counts":{"critical":0,"high":0,"medium":30,"low":4},"rawCounts":{"critical":0,"high":0,"medium":30,"low":4},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":58,"bytesScanned":296528,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":2,"markdown":38,"cordis":6,"data":2,"source":4,"manifest":1,"yaml":5}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:32:45.979Z","commit":"ac6bf7fefa1eb3b65110aa6b9caf53b8a88923a3","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:17:23.710Z","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:36:56.993Z","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:05:57.084Z","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"commit-change","from":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","to":"ac6bf7fefa1eb3b65110aa6b9caf53b8a88923a3","commit":"ac6bf7fefa1eb3b65110aa6b9caf53b8a88923a3","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:32:45.979Z"},{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:17:23.710Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:36:56.993Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"dc0e4d60fd674e4f24ae9b5dfc137e98cf540580","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:05:57.084Z"}]}