{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"anionex-dsh-vision-toolkit","slug":"anionex-dsh-vision-toolkit","rank":18,"url":"https://github.com/Anionex/dsh-vision-toolkit","name":"Anionex/dsh-vision-toolkit","category":"vision","description":{"zh":"让纯文本模型处理视觉任务：粘贴图片后自动切换到 Vision Toolkit 变体，支持图片问答、多图比较、长截图 OCR、截图还原前端 UI、元素定位与像素对比。默认无需 API Key——图片经作者自建的免费服务处理，每台机器每天 100 张；也可改为指向自己的服务商。","en":"Vision for text-only models: paste an image and the model switches to a Vision Toolkit variant for image Q&A, multi-image comparison, long-screenshot OCR, screenshot-to-UI reproduction, element grounding, and pixel diff. No API key by default — images are processed by the author-hosted free service, 100 per machine per day; configurable to your own provider."},"stars":806,"starsCheckedAt":"2026-08-21","repository":{"owner":"Anionex","repo":"dsh-vision-toolkit","requestedRef":null,"subpath":""},"npm":"@anionex/dsh-vision-toolkit","downloads":21015,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @anionex/dsh-vision-toolkit","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/Anionex/dsh-vision-toolkit/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"anionex-dsh-vision-toolkit","slug":"anionex-dsh-vision-toolkit","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:40.864Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"5a33bf6e9ff38f2d05d32fd6ee41479b8340ac5c","commitDate":"2026-08-22T00:31:40+08:00","artifactDigest":"sha256:5e0e49c033de99e634515885b1528ce075b3f91093b8caaaaa6eaf96a48b0a75","downloadUrl":"https://github.com/Anionex/dsh-vision-toolkit/archive/5a33bf6e9ff38f2d05d32fd6ee41479b8340ac5c.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @anionex/dsh-vision-toolkit","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@anionex/dsh-vision-toolkit","packageVersion":"0.1.38","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-tool","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-input-trigger","@deepseek-ai/dsh-client-locale"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-agent","@deepseek-ai/dsh-api-remotes","@deepseek-ai/dsh-attachment","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-conversation","@deepseek-ai/dsh-client-ui-input-trigger","@deepseek-ai/dsh-client-ui-primitives","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-tool","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-skill","@deepseek-ai/dsh-storage-domain","@deepseek-ai/dsh-subprocess","@deepseek-ai/dsh-tools","@deepseek-ai/cordis","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@anionex/dsh-vision-toolkit","manifestName":"@anionex/dsh-vision-toolkit","nameMatch":true,"npm":{"name":"@anionex/dsh-vision-toolkit","latestVersion":"0.1.38","publishedAt":"2026-08-20T20:49:34.736Z","createdAt":"2026-08-14T11:27:29.781Z","versionCount":34,"maintainers":1,"repository":"git+https://github.com/Anionex/dsh-vision-toolkit.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"vision-toolkit","name":"@anionex/dsh-vision-toolkit","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"developers.cloudflare.com","count":46},{"host":"pptr.dev","count":10},{"host":"www.rfc-editor.org","count":10},{"host":"vision.anionex.me","count":5},{"host":"agent-vision.anionex.me","count":5},{"host":"dsh.internal","count":4},{"host":"dsh-vision-python-bootstrap-1317715800.cos.ap-guangzhou.myqcloud.com","count":4},{"host":"opensource.org","count":4},{"host":"knowledge.digicert.com","count":4},{"host":"dsh.local","count":2},{"host":"mirrors.cloud.tencent.com","count":2},{"host":"dpgr.am","count":2},{"host":"api.github.com","count":1},{"host":"ifdian.net","count":1},{"host":"api.groq.com","count":1},{"host":"www.apache.org","count":1},{"host":"www.iana.org","count":1},{"host":"en.wikipedia.org","count":1},{"host":"tldp.org","count":1},{"host":"ldapwiki.com","count":1},{"host":"www.iso.org","count":1},{"host":"support.cloudflare.com","count":1},{"host":"docs.oasis-open.org","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/plugin-update.js","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d1110f2bfaf35790a7208572"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/plugin-update.js","pathClass":"source","line":39,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d1110f2bfaf35790a7208572"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/upstream.js","pathClass":"source","line":384,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cd9580459869343cf3e1b65c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/upstream.js","pathClass":"source","line":392,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cd9580459869343cf3e1b65c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/run-ui-restoration-example.mjs","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"176e889e91a22ab719c492f9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/sync-skill.mjs","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"824a144e2e11d32a3546628c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/sync-upstream.mjs","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"46627392cc853560e2946847"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/ui-restoration-example.ts","pathClass":"source","line":7,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"35864000f3770cc4bf32086f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/ui-restoration-example.ts","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9bedf59343fe24adae552060"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-portable.mjs","pathClass":"source","line":4,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f4b37e3392c34ca3b76e2777"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-portable.mjs","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cf389c0a234475ee5a5d4b11"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/plugin-update.ts","pathClass":"source","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2580d8616833a961ace0281e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/plugin-update.ts","pathClass":"source","line":159,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2580d8616833a961ace0281e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/upstream.ts","pathClass":"source","line":564,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dabec871377468dfc4d6dc51"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/upstream.ts","pathClass":"source","line":572,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dabec871377468dfc4d6dc51"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/html-screenshot-guard.spec.ts","pathClass":"test-example-docs","line":50,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"2a4bfab119bef578753062c5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/image-compress.spec.ts","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"3611c6077267b52c30ee6943"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"tests/model-variants-hider.spec.ts","pathClass":"test-example-docs","line":50,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"e4370ec1655026f9045a1a76"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"tests/model-variants-hider.spec.ts","pathClass":"test-example-docs","line":55,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"e4370ec1655026f9045a1a76"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/plugin-update.spec.ts","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"db19866f54d2a4b3f9761948"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/profile-install.e2e.spec.ts","pathClass":"test-example-docs","line":79,"evidence":"execa(","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"b2b690ed51f08800e46645bf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/ui-restoration-example.spec.ts","pathClass":"test-example-docs","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"b6dab158ca5ab726cc6d33b0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/ui-restoration-example.spec.ts","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"3ab8a1a887f731cf2fd92eb4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/vision-prompt-guard.spec.ts","pathClass":"test-example-docs","line":58,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7647dcc05561feab95f61dc9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"vendor/agent-vision-toolkit/skills/vision-tools/scripts/html_shot.py","pathClass":"source","line":254,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0f5d95abc6de0cf50d906e43"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"vendor/agent-vision-toolkit/skills/vision-tools/scripts/html_shot.py","pathClass":"source","line":270,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0f5d95abc6de0cf50d906e43"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"vendor/agent-vision-toolkit/skills/vision-tools/scripts/long_screenshot_ocr.py","pathClass":"source","line":645,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"3128eb2e1e46b6b302957727"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"vendor/agent-vision-toolkit/tests/test_vision_client.py","pathClass":"test-example-docs","line":427,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"e287fba040cc10546d49014b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"vendor/agent-vision-toolkit/tests/test_vision_client.py","pathClass":"test-example-docs","line":434,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"e287fba040cc10546d49014b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"workers/moondream-openai-proxy/scripts/deploy.mjs","pathClass":"source","line":3,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"972a82b11dbc7e02678fce8d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"workers/moondream-openai-proxy/scripts/deploy.mjs","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"939282e370996adb83c54afe"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"workers/moondream-openai-proxy/scripts/types.mjs","pathClass":"source","line":4,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d7896823f3dc8f7e1d815e54"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"workers/moondream-openai-proxy/scripts/types.mjs","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"664c56cb7158811fef2a814f"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/runtime.js","pathClass":"source","line":415,"evidence":"credential access at line 415 + outbound network at line 1598","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"917b615692af4ccc5f0e858c","review":{"verdict":"functional","reason":"resolveVisionEnv在第415行解析用户配置的凭据(或内置免费Key)，随后在1598行用于向该配置商的视觉API发起请求，属于视觉插件调用图像识别服务的核心必要功能。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:17:29.219Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/runtime.ts","pathClass":"source","line":858,"evidence":"credential access at line 858 + outbound network at line 2113","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"d31484f43967ce7c7ca0070f","review":{"verdict":"functional","reason":"与lib版本相同逻辑的TS源码：ctx.credentials.resolve获取用户配置或内置免费Key，构造VISION_API_KEY/VISION_BASE_URL等环境变量供后续调用用户指定的视觉服务商，是插件宣称功能的必要实现。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:17:29.219Z"}}],"counts":{"critical":0,"high":0,"medium":2,"low":22},"rawCounts":{"critical":0,"high":0,"medium":4,"low":31},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":202,"bytesScanned":3084488,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":60,"markdown":27,"cordis":1,"html":1,"source":101,"manifest":2,"yaml":4,"data":6}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:19:40.864Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:19:40.864Z","commit":"5a33bf6e9ff38f2d05d32fd6ee41479b8340ac5c","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:17:29.219Z","commit":"ca07cda11c5e5a9454203eb829098c6fb44f17f1","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:44:59.337Z","commit":"ca07cda11c5e5a9454203eb829098c6fb44f17f1","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"5a33bf6e9ff38f2d05d32fd6ee41479b8340ac5c","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:40.864Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"ca07cda11c5e5a9454203eb829098c6fb44f17f1","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:17:29.219Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"ca07cda11c5e5a9454203eb829098c6fb44f17f1","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:44:59.337Z"}]}