{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"dhicoc-dsh-reverse-skill","slug":"dhicoc-dsh-reverse-skill","rank":89,"url":"https://github.com/dhicoc/dsh-reverse-skill","name":"dhicoc/dsh-reverse-skill","category":"skill","description":{"zh":"完整 reverse-skill（85 个 SKILL.md）的 DeepSeek Harness 插件：逆向工程、授权渗透测试与安全研究的技能路由包。","en":"Complete reverse-skill pack (85 SKILL.md) as a DeepSeek Harness Cordis plugin: reverse engineering, authorized pentesting and security-research skill router."},"stars":59,"starsCheckedAt":"2026-08-21","repository":{"owner":"dhicoc","repo":"dsh-reverse-skill","requestedRef":null,"subpath":""},"npm":"@dhicoc/dsh-reverse-skill","downloads":1041,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @dhicoc/dsh-reverse-skill","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/dhicoc/dsh-reverse-skill/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"dhicoc-dsh-reverse-skill","slug":"dhicoc-dsh-reverse-skill","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:40.642Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"fcb5a8a818834f6e2456812fb994d01692884778","commitDate":"2026-08-21T23:44:35+08:00","artifactDigest":"sha256:206a7880c607324add2b4f13ba1d4510314885364c35ba02ac76e22c440d44b5","downloadUrl":"https://github.com/dhicoc/dsh-reverse-skill/archive/fcb5a8a818834f6e2456812fb994d01692884778.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @dhicoc/dsh-reverse-skill","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@dhicoc/dsh-reverse-skill","packageVersion":"1.0.4","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-skill"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@dhicoc/dsh-reverse-skill","manifestName":"@dhicoc/dsh-reverse-skill","nameMatch":true,"npm":{"name":"@dhicoc/dsh-reverse-skill","latestVersion":"1.0.3","publishedAt":"2026-08-17T03:50:26.089Z","createdAt":"2026-08-15T07:50:50.970Z","versionCount":2,"maintainers":1,"repository":"git+https://github.com/dhicoc/dsh-reverse-skill.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"reverse-skill","name":"@dhicoc/dsh-reverse-skill","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"api.github.com","count":6},{"host":"example.test","count":3},{"host":"brew.sh","count":2},{"host":"www.pnfsoftware.com","count":2},{"host":"app.example.invalid","count":2},{"host":"ginandjuice.shop","count":2},{"host":"apktool.org","count":1},{"host":"developer.android.com","count":1},{"host":"app.example","count":1},{"host":"chal.example","count":1},{"host":"example.invalid","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"skills/diagram-generator/scripts/render_diagram.py","pathClass":"source","line":27,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"81ffa626aca0508c0b341e29"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"skills/pentest-tools/src-hunter/references/payloader/raw/tools.json","pathClass":"data","line":4798,"evidence":"curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"出现在数据文件中，可能是文本样本而非执行路径","hash":"d528b712e4a16018b8136250"}],"counts":{"critical":0,"high":0,"medium":0,"low":1},"rawCounts":{"critical":1,"high":0,"medium":0,"low":1},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":515,"bytesScanned":4835633,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":3,"markdown":403,"yaml":43,"source":9,"cordis":1,"data":7,"manifest":1,"script":48}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:20:40.642Z","commit":"fcb5a8a818834f6e2456812fb994d01692884778","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:33.726Z","commit":"514122407a423c07326c47b67ab1550c3e59d29c","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:22.959Z","commit":"514122407a423c07326c47b67ab1550c3e59d29c","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"fcb5a8a818834f6e2456812fb994d01692884778","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:40.642Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"514122407a423c07326c47b67ab1550c3e59d29c","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:33.726Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"514122407a423c07326c47b67ab1550c3e59d29c","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:22.959Z"}]}