{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"anweat-dsh-browser","slug":"anweat-dsh-browser","rank":325,"url":"https://github.com/anweat/dsh-browser","name":"anweat/dsh-browser","category":"browser","description":{"zh":"自包含浏览器运行时：Playwright（chromium）+ OpenCLI 作为插件本地依赖（全局复用回退），提供 `browser` 服务与 9 个交互式浏览器工具。","en":"Self-contained browser runtime: Playwright (chromium) + OpenCLI as plugin-local dependencies (global reuse fallback), exposes a `browser` service and 9 interactive browser tools."},"stars":8,"starsCheckedAt":"2026-08-21","repository":{"owner":"anweat","repo":"dsh-browser","requestedRef":null,"subpath":""},"npm":"@anweat/dsh-browser","downloads":2829,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @anweat/dsh-browser","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/anweat/dsh-browser/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"anweat-dsh-browser","slug":"anweat-dsh-browser","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:23:44.928Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"abbe5ad039d47432e844c5a7da41df620b2d1e4d","commitDate":"2026-08-22T11:33:35+08:00","artifactDigest":"sha256:92441e1a6baf23e4efdcd33b4b15fc083f9f8f84b7cb51c9e7f14076d1b49958","downloadUrl":"https://github.com/anweat/dsh-browser/archive/abbe5ad039d47432e844c5a7da41df620b2d1e4d.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @anweat/dsh-browser","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@anweat/dsh-browser","packageVersion":"0.1.4","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{"prepare":"npm run build"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-tools","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@anweat/dsh-browser","manifestName":"@anweat/dsh-browser","nameMatch":true,"npm":{"name":"@anweat/dsh-browser","latestVersion":"0.1.3","publishedAt":"2026-08-14T08:01:58.612Z","createdAt":"2026-08-14T02:40:49.210Z","versionCount":2,"maintainers":1,"repository":"git+https://github.com/anweat/dsh-browser.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"browser","name":"@anweat/dsh-browser","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/deps.js","pathClass":"source","line":18,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"79fee2465b60db49f2ba6280"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/deps.js","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8e859ab5a59ee10e80d64f32"},{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":30,"evidence":"\"prepare\": \"npm run build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"d28b218339321374f2793b3b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/install-browser.mjs","pathClass":"source","line":7,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f5eab63f7a7b54e4ff7da4a8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/install-browser.mjs","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f49d4f836c506fb1a7174650"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/deps.ts","pathClass":"source","line":19,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f9f1a6a29a4df37450965b2e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/deps.ts","pathClass":"source","line":19,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ff1d88532fea96ec2b166b36"}],"counts":{"critical":0,"high":0,"medium":0,"low":6},"rawCounts":{"critical":0,"high":0,"medium":1,"low":6},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":23,"bytesScanned":102133,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":1,"markdown":1,"cordis":1,"source":16,"manifest":1,"yaml":2,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:23:44.928Z","commit":"abbe5ad039d47432e844c5a7da41df620b2d1e4d","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:24:09.682Z","commit":"570ac8b54bd152b3f1be26cc0cc068f1a4eeb001","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:52:55.745Z","commit":"570ac8b54bd152b3f1be26cc0cc068f1a4eeb001","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"abbe5ad039d47432e844c5a7da41df620b2d1e4d","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:23:44.928Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"570ac8b54bd152b3f1be26cc0cc068f1a4eeb001","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:24:09.682Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"570ac8b54bd152b3f1be26cc0cc068f1a4eeb001","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:52:55.745Z"}]}