{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"dddmuc-dsh-free-search","slug":"dddmuc-dsh-free-search","rank":115,"url":"https://github.com/DDDMUC/dsh-free-search","name":"DDDMUC/dsh-free-search","category":"browser","description":{"zh":"DSH 免费搜索插件：7 个引擎（DuckDuckGo/Bing/SearXNG 免费 + Exa/Perplexity/DeepSeek 付费）、自动回退、设置页 UI（API key 输入 + 官网链接）、web_fetch、引擎测试工具。","en":"Free, keyless web search for DSH: 7 engines (DuckDuckGo/Bing/SearXNG free + Exa/Perplexity/DeepSeek paid), auto-failover, settings-page UI with API key inputs and official links, web_fetch, and an engine test tool."},"stars":40,"starsCheckedAt":"2026-08-21","repository":{"owner":"DDDMUC","repo":"dsh-free-search","requestedRef":null,"subpath":""},"npm":"dsh-free-search","downloads":3047,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-free-search","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/DDDMUC/dsh-free-search/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"dddmuc-dsh-free-search","slug":"dddmuc-dsh-free-search","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:58.934Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"998fcebbebb7f08a972d3a9efb53a56cd6e1bcf5","commitDate":"2026-08-22T02:06:01+08:00","artifactDigest":"sha256:27ae602e23d8b6eafea7daf9c84a8c9ec174e41c09220aabb0adcf81f8bcb7e1","downloadUrl":"https://github.com/DDDMUC/dsh-free-search/archive/998fcebbebb7f08a972d3a9efb53a56cd6e1bcf5.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-free-search","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-free-search","packageVersion":"0.4.12","bundle":{"patch":"cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-settings","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-free-search","manifestName":"dsh-free-search","nameMatch":true,"npm":{"name":"dsh-free-search","latestVersion":"0.4.11","publishedAt":"2026-08-20T12:35:09.294Z","createdAt":"2026-08-15T20:30:58.085Z","versionCount":14,"maintainers":1,"repository":"git+https://github.com/DDDMUC/dsh-free-search.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"web-search-free","name":"dsh-free-search","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["searchProvider"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"duckduckgo.com","count":2},{"host":"www.bing.com","count":2},{"host":"api.keenable.ai","count":2},{"host":"www.npmjs.com","count":2},{"host":"www.v2ex.com","count":2},{"host":"anysearch.com","count":1},{"host":"dashboard.exa.ai","count":1},{"host":"app.tavily.com","count":1},{"host":"keenable.ai","count":1},{"host":"www.perplexity.ai","count":1},{"host":"platform.deepseek.com","count":1},{"host":"html.duckduckgo.com","count":1},{"host":"lite.duckduckgo.com","count":1},{"host":"api.tavily.com","count":1},{"host":"opnxng.com","count":1},{"host":"priv.au","count":1},{"host":"searx.be","count":1},{"host":"searx.tiekoetter.com","count":1},{"host":"search.inetol.net","count":1},{"host":"paulgo.io","count":1},{"host":"api.anysearch.com","count":1},{"host":"mcp.exa.ai","count":1},{"host":"api.github.com","count":1},{"host":"api.bilibili.com","count":1},{"host":"www.bilibili.com","count":1},{"host":"old.reddit.com","count":1},{"host":"hn.algolia.com","count":1},{"host":"news.ycombinator.com","count":1},{"host":"api.stackexchange.com","count":1},{"host":"registry.npmjs.com","count":1},{"host":"api.exa.ai","count":1},{"host":"api.perplexity.ai","count":1},{"host":"api.deepseek.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":6,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":1356,"evidence":"credential access at line 1356 + outbound network at line 37","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"48d9bda2c5ce36707b796728","review":{"verdict":"functional","reason":"resolveApiKey按用户配置或credentials.resolve取得对应引擎密钥仅用于调用该引擎官方API，属于付费引擎接入的必要功能。","model":"sonnet","reviewedAt":"2026-08-22T08:20:58.934Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":1},"rawCounts":{"critical":0,"high":0,"medium":1,"low":1},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":9,"bytesScanned":193416,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":1,"cordis":1,"source":3,"manifest":1,"yaml":1,"html":1,"script":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:58.934Z","summary":"插件为多引擎搜索工具，命中的密钥解析仅用于调用用户自选的付费搜索引擎API，与描述一致，未发现异常外发。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":8,"outputTokens":2015,"costUsd":0.0472712,"durationMs":23872}}},"timeline":[{"scannedAt":"2026-08-22T08:20:58.934Z","commit":"998fcebbebb7f08a972d3a9efb53a56cd6e1bcf5","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:13.487Z","commit":"dc88da137813fb55b22918f77c94561b6f1acefa","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:04.333Z","commit":"dc88da137813fb55b22918f77c94561b6f1acefa","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"998fcebbebb7f08a972d3a9efb53a56cd6e1bcf5","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:58.934Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"dc88da137813fb55b22918f77c94561b6f1acefa","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:13.487Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"dc88da137813fb55b22918f77c94561b6f1acefa","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:04.333Z"}]}