{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"d-dev0101-open-sea-skin","slug":"d-dev0101-open-sea-skin","rank":44,"url":"https://github.com/d-dev0101/open-sea-skin","name":"d-dev0101/open-sea-skin","category":"theme","description":{"zh":"实时 WebGPU 海洋皮肤，可快捷调节波浪、日光、玻璃不透明度与自动昼夜循环。","en":"Realtime WebGPU ocean skin with quick controls for waves, daylight, glass opacity, and an automatic day cycle."},"stars":185,"starsCheckedAt":"2026-08-21","repository":{"owner":"d-dev0101","repo":"open-sea-skin","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"tarball","upstreamInstall":"dsh plugin --profile web add \"https://github.com/d-dev0101/open-sea-skin/releases/download/v1.2.0/open-sea-skin-1.2.0.tgz\"","tarball":"https://github.com/d-dev0101/open-sea-skin/releases/download/v1.2.0/open-sea-skin-1.2.0.tgz","added":"2026-08-17","page":"https://awesome-dsh-plugin.com/p/d-dev0101/open-sea-skin/","screenshots":["https://raw.githubusercontent.com/d-dev0101/open-sea-skin/5ae54402ec6d4c961d41aee8ed786280799712c7/docs/marketplace/open-sea-harness-cover.png","https://raw.githubusercontent.com/d-dev0101/open-sea-skin/5ae54402ec6d4c961d41aee8ed786280799712c7/docs/screenshots/harness-dark-overview-40.gif","https://raw.githubusercontent.com/d-dev0101/open-sea-skin/5ae54402ec6d4c961d41aee8ed786280799712c7/docs/screenshots/harness-light-overview-40.gif","https://raw.githubusercontent.com/d-dev0101/open-sea-skin/5ae54402ec6d4c961d41aee8ed786280799712c7/docs/screenshots/harness-wave-control-40.gif"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"d-dev0101-open-sea-skin","slug":"d-dev0101-open-sea-skin","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:04.788Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"2437d80a96de4124c54fbe89872fa7090103f025","commitDate":"2026-08-19T11:29:13+08:00","artifactDigest":"sha256:17c5556760a818a42fea09b304783cc251c07164a8da80047616c864ac5a2f85","downloadUrl":"https://github.com/d-dev0101/open-sea-skin/archive/2437d80a96de4124c54fbe89872fa7090103f025.tar.gz","installMode":"tarball","installCommand":"dsh plugin --profile web add \"https://github.com/d-dev0101/open-sea-skin/releases/download/v1.2.0/open-sea-skin-1.2.0.tgz\"","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"open-sea-skin","packageVersion":"1.2.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":[],"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"tarball","upstreamNpm":null,"manifestName":"open-sea-skin","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":"github-release"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"open-sea-skin","name":"open-sea-skin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"www.shadertoy.com","count":3},{"host":"dsh.local","count":1}],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"extension/content.js","pathClass":"source","line":290,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"ed9f0949a670fab01c788cbd"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"extension/content.js","pathClass":"source","line":297,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"ed9f0949a670fab01c788cbd"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"extension/vendor/three.webgpu.js","pathClass":"source","line":31,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"78357cab992e9f0a3c7e8b9b"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"harness-plugin/assets/vendor/three.webgpu.js","pathClass":"test-example-docs","line":31,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"93641c4031074f353703b97e"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"native-dist/loader.js","pathClass":"source","line":290,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"cccbb1bb52cb5730ad6345f7"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"native-dist/loader.js","pathClass":"source","line":297,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"cccbb1bb52cb5730ad6345f7"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"native-dist/vendor/three.webgpu.js","pathClass":"source","line":31,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"93d5617a4b2911392902c6c4"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"plugin/client.js","pathClass":"source","line":293,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"3ba73dd405dfbdb685103e0b"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"plugin/client.js","pathClass":"source","line":300,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"3ba73dd405dfbdb685103e0b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/browser-acceptance.mjs","pathClass":"source","line":6,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e1a001f80fc87677fc67c804"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/browser-acceptance.mjs","pathClass":"source","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"14122bb5552ebf12f046bf4e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/capture-gallery.mjs","pathClass":"source","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"79695c717634cd6febc69e0b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/capture-gallery.mjs","pathClass":"source","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"3bc310cc9492e61bb0385b0e"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"shared/skin-core.js","pathClass":"source","line":289,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"94f483c89af9984367745277"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"shared/skin-core.js","pathClass":"source","line":296,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"94f483c89af9984367745277"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"shared/vendor/three.webgpu.js","pathClass":"source","line":31,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"58849a93e347c8ccd3669537"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/installer.test.mjs","pathClass":"test-example-docs","line":6,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"1c2841d193a51e37f0841bbc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/installer.test.mjs","pathClass":"test-example-docs","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8c0a3739e74be48d87171e1f"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"website/app.js","pathClass":"test-example-docs","line":206,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"14409b914909d0e423c58f29"}],"counts":{"critical":0,"high":0,"medium":8,"low":4},"rawCounts":{"critical":0,"high":4,"medium":9,"low":6},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":105,"bytesScanned":4445029,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":22,"markdown":16,"cordis":1,"data":5,"source":52,"html":3,"script":4,"manifest":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:20:04.788Z","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:35.276Z","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:26.789Z","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:04.788Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:35.276Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"2437d80a96de4124c54fbe89872fa7090103f025","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:26.789Z"}]}