{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"btspoony-dsh-advisor","slug":"btspoony-dsh-advisor","rank":212,"url":"https://github.com/btspoony/dsh-advisor","name":"btspoony/dsh-advisor","category":"workflow","description":{"zh":"搭配一个副模型，每轮被动审查并注入见解。","en":"Pair a second model that passively reviews each turn and injects notes."},"stars":15,"starsCheckedAt":"2026-08-21","repository":{"owner":"btspoony","repo":"dsh-advisor","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:btspoony/dsh-advisor","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/btspoony/dsh-advisor/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"btspoony-dsh-advisor","slug":"btspoony-dsh-advisor","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:20.476Z","scanStatus":"static-complete","verdict":"caution","score":93,"commit":"82d04b625b05e7aff2b94586623924577b231e35","commitDate":"2026-08-21T22:06:01+08:00","artifactDigest":"sha256:d0fb6f2eaff16af8981af9cbfa82ea72bd4383cf5e6d78206826c4d156127be5","downloadUrl":"https://github.com/btspoony/dsh-advisor/archive/82d04b625b05e7aff2b94586623924577b231e35.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:btspoony/dsh-advisor","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-advisor","packageVersion":"0.2.4","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings-plugins","@deepseek-ai/dsh-client-locale"],"platform":"web"},"lifecycleScripts":{"prepare":"pnpm build"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-agent","@deepseek-ai/dsh-api-gateway","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-settings-plugins","@deepseek-ai/dsh-client-ui-primitives","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-commands","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-timeout","@deepseek-ai/dsh-typert-protocol","@deepseek-ai/dsh-typert-registry","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-advisor","nameMatch":null,"npm":{"name":"dsh-advisor","latestVersion":"0.2.4","publishedAt":"2026-08-21T08:21:47.561Z","createdAt":"2026-08-13T16:28:20.871Z","versionCount":16,"maintainers":1,"repository":"git+https://github.com/omdsh-dev/dsh-advisor.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"mismatch","provenance":"attested","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"advisor","name":"dsh-advisor","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"medium","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":35,"evidence":"\"prepare\": \"pnpm build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"源码安装需用户在 allowBuilds 中授权，此脚本会在安装期于用户机器执行","hash":"619d136d2740ac49e3552764"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-client.mjs","pathClass":"source","line":38,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1b64d0dc30b7be2f6d187fe7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-client.mjs","pathClass":"source","line":38,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"914d1acd2b025e00f76a3c03"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/prepare-release.mjs","pathClass":"source","line":24,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dc1dcffab24785531e714a5a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/prepare-release.mjs","pathClass":"source","line":24,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a6a4b3aa6cf4a418cd356f94"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/client-build.test.ts","pathClass":"test-example-docs","line":24,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ca7ab25408fadbf64674c258"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/client-build.test.ts","pathClass":"test-example-docs","line":24,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"4e954a39530f4a2be67bb9ef"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/prepare-release.test.ts","pathClass":"test-example-docs","line":18,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"1e9cf6c8669363e433163ae1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/prepare-release.test.ts","pathClass":"test-example-docs","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f301b901e155265d23bf3ef5"},{"id":"HT-IDENTITY-001","title":"npm 上存在同名包但指向其他仓库","severity":"low","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm repository=git+https://github.com/omdsh-dev/dsh-advisor.git ≠ btspoony/dsh-advisor","remediation":"npm 上存在同名包但指向其它仓库；从源码安装时请使用 github: 引用并锁定 commit。","layer":"identity","hash":"1f29d10d4d3265b399b2cf74"}],"counts":{"critical":0,"high":0,"medium":1,"low":5},"rawCounts":{"critical":0,"high":0,"medium":1,"low":9},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":82,"bytesScanned":1216665,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":27,"markdown":25,"cordis":1,"manifest":1,"yaml":2,"source":22,"data":4}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:22:20.476Z","commit":"82d04b625b05e7aff2b94586623924577b231e35","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:52.738Z","commit":"afe8bdbf17a83826cd6fdfc3b21e9850ecc43395","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:08.443Z","commit":"afe8bdbf17a83826cd6fdfc3b21e9850ecc43395","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"82d04b625b05e7aff2b94586623924577b231e35","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:20.476Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"afe8bdbf17a83826cd6fdfc3b21e9850ecc43395","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:52.738Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"afe8bdbf17a83826cd6fdfc3b21e9850ecc43395","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:08.443Z"}]}