{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"atropinoltt-dsh-guide-dog","slug":"atropinoltt-dsh-guide-dog","rank":516,"url":"https://github.com/AtropinolTT/dsh-guide-dog","name":"AtropinolTT/dsh-guide-dog","category":"vision","description":{"zh":"基于 MiniMax 的多模态插件：实时语音通话模式（流式对话、悬浮胶囊 UI）、语音模式与麦克风语音输入，并提供图像/视频/音乐/语音生成与视觉检查工具。","en":"MiniMax-powered multimodal plugin: real-time voice call mode (streaming conversation, floating dock UI), voice mode and mic voice input, plus image/video/music/speech generation and vision inspection tools."},"stars":5,"starsCheckedAt":"2026-08-21","repository":{"owner":"AtropinolTT","repo":"dsh-guide-dog","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:AtropinolTT/dsh-guide-dog","tarball":null,"added":"2026-08-17","page":"https://awesome-dsh-plugin.com/p/AtropinolTT/dsh-guide-dog/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"atropinoltt-dsh-guide-dog","slug":"atropinoltt-dsh-guide-dog","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:25:43.093Z","scanStatus":"static-complete","verdict":"pass","score":100,"commit":"fbd3a0584609722052710978214f8edceeb458a2","commitDate":"2026-08-18T00:13:38+08:00","artifactDigest":"sha256:65d23223eb092125191dc7fc1cc644482b6f614983f2c08e9a4a073302ac5108","downloadUrl":"https://github.com/AtropinolTT/dsh-guide-dog/archive/fbd3a0584609722052710978214f8edceeb458a2.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:AtropinolTT/dsh-guide-dog","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-guide-dog","packageVersion":"0.1.0","bundle":{"patch":"./bundle/cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-slots"]},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-guide-dog","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"bundle/cordis.patch.yml","inserts":[{"id":"guide-dog-autoload","name":"dsh-guide-dog-autoload","path":"autoload/cordis.patch.yml","disabled":false},{"id":"guide-dog","name":"dsh-guide-dog","path":"bundle/cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"hf-mirror.com","count":4},{"host":"m.thepaper.cn","count":2},{"host":"api.github.com","count":1}],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-progress.js","pathClass":"source","line":20,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"b0c4d886e2196992d274c880","review":{"verdict":"placeholder","reason":"repro/repro-progress.js 是回归测试脚本，eval 的内容是从本地 plugin-host.js 源码正则提取的常量/函数体，非远程或用户输入，且该文件不在 package.json files 清单中未被打包运行时使用。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-progress.js","pathClass":"source","line":21,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"b0c4d886e2196992d274c880","review":{"verdict":"placeholder","reason":"repro/repro-progress.js 是回归测试脚本，eval 的内容是从本地 plugin-host.js 源码正则提取的常量/函数体，非远程或用户输入，且该文件不在 package.json files 清单中未被打包运行时使用。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-rc14.js","pathClass":"source","line":101,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"975c9591d65af03cf8878738","review":{"verdict":"placeholder","reason":"repro/repro-rc14.js 同样是测试脚本，eval 仅用于将本地读取的 sanitizeSpeechText/splitSentences 函数体注入测试作用域做断言，不涉及外部数据，不属于产品运行时代码。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-rc14.js","pathClass":"source","line":102,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"975c9591d65af03cf8878738","review":{"verdict":"placeholder","reason":"repro/repro-rc14.js 同样是测试脚本，eval 仅用于将本地读取的 sanitizeSpeechText/splitSentences 函数体注入测试作用域做断言，不涉及外部数据，不属于产品运行时代码。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-rc15.js","pathClass":"source","line":32,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"2ee600114099c6a82435429e","review":{"verdict":"placeholder","reason":"同文件第79行同样是测试断言用 new Function 包装本地 replayDup 源码，仅用固定字面量参数验证逻辑，无外部/远程输入。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-rc15.js","pathClass":"source","line":79,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"2ee600114099c6a82435429e","review":{"verdict":"placeholder","reason":"同文件第79行同样是测试断言用 new Function 包装本地 replayDup 源码，仅用固定字面量参数验证逻辑，无外部/远程输入。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"repro/repro-stream-drain.js","pathClass":"source","line":29,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"c92577c92c675facb987191c","review":{"verdict":"placeholder","reason":"repro/repro-stream-drain.js 用 eval 将本地 plugin-client.js 提取的 waitStreamDrain 函数体转为可调用对象做模拟回归测试，非生产运行时代码，不处理外部输入。","model":"sonnet","reviewedAt":"2026-08-21T10:55:57.505Z"}}],"counts":{"critical":0,"high":0,"medium":0,"low":0},"rawCounts":{"critical":0,"high":7,"medium":0,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":44,"bytesScanned":1263038,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":2,"markdown":10,"cordis":2,"source":24,"manifest":3,"script":3}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:25:43.093Z","summary":null,"intentMatch":null,"findingsReviewed":7,"findingsCandidates":7,"fromCache":7,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:25:43.093Z","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:27:04.822Z","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:55:57.505Z","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:25:43.093Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:27:04.822Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"fbd3a0584609722052710978214f8edceeb458a2","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:55:57.505Z"}]}