{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"cloader-dsh-taskboard","slug":"cloader-dsh-taskboard","rank":220,"url":"https://github.com/cloader/dsh-taskboard","name":"cloader/dsh-taskboard","category":"workflow","description":{"zh":"dsh 的任务看板：创建任务时可指定项目与模型，支持手动执行及定时执行；项目内新建会话会自动拉取该项目的待办任务，完成后移至待验收。","en":"Task board for DSH: create tasks with project and model assignment, run them manually or on cron schedules; new sessions in a project automatically pick up its todo tasks and move them to in-review when done."},"stars":14,"starsCheckedAt":"2026-08-21","repository":{"owner":"cloader","repo":"dsh-taskboard","requestedRef":null,"subpath":""},"npm":"dsh-taskboard","downloads":1940,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-taskboard","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/cloader/dsh-taskboard/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"cloader-dsh-taskboard","slug":"cloader-dsh-taskboard","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:26.266Z","scanStatus":"static-complete","verdict":"caution","score":90,"commit":"43ca7e55a700f3944f8aca32ac7d6696c64ec102","commitDate":"2026-08-22T14:45:42+08:00","artifactDigest":"sha256:dbaf79fb346d38c830c78da9b17a3ffde687fd7683cad1d4ccc440814e611c8a","downloadUrl":"https://github.com/cloader/dsh-taskboard/archive/43ca7e55a700f3944f8aca32ac7d6696c64ec102.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-taskboard","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-taskboard","packageVersion":"0.4.3","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":[],"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-taskboard","manifestName":"dsh-taskboard","nameMatch":true,"npm":{"name":"dsh-taskboard","latestVersion":"0.4.2","publishedAt":"2026-08-19T10:14:00.461Z","createdAt":"2026-08-15T08:17:37.042Z","versionCount":10,"maintainers":1,"repository":"git+https://github.com/cloader/dsh-taskboard.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-taskboard","name":"dsh-taskboard","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"lib/client.js","pathClass":"source","line":1638,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"87e8e136bfe0ec624b8b4ecd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"medium","confidence":"medium","layer":"static","path":"lib/host/git.js","pathClass":"source","line":54,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"命令由运行时变量拼接，需确认输入来源是否可信","hash":"138af3b160c88a2d8a053cd1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/host/git.js","pathClass":"source","line":57,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0a9641cc8cda8cce12994b90"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client/sidebar-entry.ts","pathClass":"source","line":65,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"c7b53ba2524f6b772c4b85cf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"medium","confidence":"medium","layer":"static","path":"src/host/git.ts","pathClass":"source","line":171,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"命令由运行时变量拼接，需确认输入来源是否可信","hash":"d19870f8226b52896150dadf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/host/git.ts","pathClass":"source","line":174,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5864429968924913bb9a5a5d"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"tests/client.spec.ts","pathClass":"test-example-docs","line":95,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"1d195476f955668ee35543e1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/manual-git-e2e.mjs","pathClass":"test-example-docs","line":132,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f934f5b34a961fbda240eb20"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/manual-git-e2e.mjs","pathClass":"test-example-docs","line":141,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f934f5b34a961fbda240eb20"}],"counts":{"critical":0,"high":0,"medium":4,"low":2},"rawCounts":{"critical":0,"high":0,"medium":5,"low":4},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":61,"bytesScanned":1138469,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":1,"cordis":1,"source":47,"data":2,"manifest":1,"test-example-docs":9}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:22:26.266Z","commit":"43ca7e55a700f3944f8aca32ac7d6696c64ec102","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:11.254Z","commit":"cfea989d51a7df565305b4f24a1e7b50b5dcde72","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:37.825Z","commit":"cfea989d51a7df565305b4f24a1e7b50b5dcde72","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"43ca7e55a700f3944f8aca32ac7d6696c64ec102","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:26.266Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"cfea989d51a7df565305b4f24a1e7b50b5dcde72","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:11.254Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"cfea989d51a7df565305b4f24a1e7b50b5dcde72","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:37.825Z"}]}