{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"cyanfish-x-dsh-live2d-pets","slug":"cyanfish-x-dsh-live2d-pets","rank":273,"url":"https://github.com/cyanfish-x/dsh-live2d-pets","name":"cyanfish-x/dsh-live2d-pets","category":"fun","description":{"zh":"DSH Web GUI 的 Live2D 桌宠悬浮层：镜像 agent 思考/空闲/出错/完成/待审批状态，配动画与气泡，支持分部位触摸反应、拖动停靠、切换人设，以及通过 URL 或本地路径加载自定义模型。","en":"Live2D desk pet overlay for the DSH web GUI: mirrors agent state (thinking, idle, error, done, awaiting approval) with motions and speech bubbles, per-part touch reactions, drag-to-dock, switchable personas, and custom models via URL or local path."},"stars":10,"starsCheckedAt":"2026-08-21","repository":{"owner":"cyanfish-x","repo":"dsh-live2d-pets","requestedRef":null,"subpath":""},"npm":"dsh-live2d-pets","downloads":850,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-live2d-pets","tarball":null,"added":"2026-08-19","page":"https://awesome-dsh-plugin.com/p/cyanfish-x/dsh-live2d-pets/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"cyanfish-x-dsh-live2d-pets","slug":"cyanfish-x-dsh-live2d-pets","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:23:05.793Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","commitDate":"2026-08-16T23:23:03+08:00","artifactDigest":"sha256:cb863db606f923380059176ed1b817f5a269c95454ce85a65d792b9e68c5a423","downloadUrl":"https://github.com/cyanfish-x/dsh-live2d-pets/archive/a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-live2d-pets","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-live2d-pets","packageVersion":"0.2.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["slots"]},"lifecycleScripts":{"prepare":"npm run build"},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-host-webserver","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-settings"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-live2d-pets","manifestName":"dsh-live2d-pets","nameMatch":true,"npm":{"name":"dsh-live2d-pets","latestVersion":"0.2.2","publishedAt":"2026-08-16T13:07:06.402Z","createdAt":"2026-08-14T12:27:38.832Z","versionCount":6,"maintainers":1,"repository":"git+https://github.com/cyanfish-x/dsh-live2d-pets.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"live2d-pet","name":"dsh-live2d-pets","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"assets/vendor/pixi.min.js","pathClass":"test-example-docs","line":8,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"3cdc370a70665842d540dca7"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"assets/vendor/pixi.min.js","pathClass":"test-example-docs","line":8,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式；位于测试、示例或文档目录","hash":"3cdc370a70665842d540dca7"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"assets/vendor/pixi.min.js","pathClass":"test-example-docs","line":8,"evidence":".innerHTML=","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0da64d9490a820dc66f99048"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"assets/vendor/pixi.min.js","pathClass":"test-example-docs","line":8,"evidence":".innerHTML=","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0da64d9490a820dc66f99048"},{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"low","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":80,"evidence":"\"prepare\": \"npm run build\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"该插件以 npm/tarball 预构建方式分发，prepare 不在用户机器上执行","hash":"d28b218339321374f2793b3b"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client/paw-icon.ts","pathClass":"source","line":64,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"5745a72ed216856fb0b46d60"}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":2,"high":0,"medium":4,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":52,"bytesScanned":1126151,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":20,"test-example-docs":11,"cordis":1,"manifest":1,"source":17,"data":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:23:05.793Z","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:48.735Z","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:51:30.148Z","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:23:05.793Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:48.735Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"a22ed5e0c17d8588a0aabce2ff9eee8dcf44528e","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:51:30.148Z"}]}