{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"elohia-dsh-plugin-image-input","slug":"elohia-dsh-plugin-image-input","rank":1506,"url":"https://github.com/Elohia/dsh-plugin-image-input","name":"Elohia/dsh-plugin-image-input","category":"vision","description":{"zh":"图片转文字输入插件：粘贴/拖拽图片自动转为结构化文字描述发送，给纯文本 LLM 提供图片输入接管（OpenAI 兼容视觉 API）。","en":"Image-to-text input for the Web UI: paste or drag an image and it is transcribed into structured text and sent, giving text-only LLMs image-input takeover (OpenAI-compatible vision API)."},"stars":0,"starsCheckedAt":"2026-08-21","repository":{"owner":"Elohia","repo":"dsh-plugin-image-input","requestedRef":null,"subpath":""},"npm":"dsh-plugin-image-input","downloads":352,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-plugin-image-input","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/Elohia/dsh-plugin-image-input/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"elohia-dsh-plugin-image-input","slug":"elohia-dsh-plugin-image-input","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:35:49.995Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","commitDate":"2026-08-15T11:57:59+08:00","artifactDigest":"sha256:ddde07b0b12392c08569252c5af5ad1e598c4d032b543f09c0f022eec90c01fb","downloadUrl":"https://github.com/Elohia/dsh-plugin-image-input/archive/a96667f6b1445322892ae52d9c9e6c210300b0ec.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-plugin-image-input","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-plugin-image-input","packageVersion":"0.1.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-plugin-image-input","manifestName":"dsh-plugin-image-input","nameMatch":true,"npm":{"name":"dsh-plugin-image-input","latestVersion":"0.1.1","publishedAt":"2026-08-15T03:57:36.693Z","createdAt":"2026-08-15T03:57:36.472Z","versionCount":1,"maintainers":1,"repository":"git+https://github.com/Elohia/dsh-plugin-image-input.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"image-input","name":"dsh-plugin-image-input","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[{"host":"dashscope.aliyuncs.com","count":3}],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"lib/index.js","pathClass":"source","line":91,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"8ea6674557c7bac826789007","review":{"verdict":"placeholder","reason":"该行仅是 AST_HINTS 字典中的字符串常量，描述 unsafe-stmt 类型警告的提示文本，并未实际调用 eval()。","model":"sonnet","reviewedAt":"2026-08-21T11:05:17.383Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"critical","confidence":"low","layer":"static","path":"lib/index.js","pathClass":"source","line":236,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式","hash":"8ea6674557c7bac826789007","review":{"verdict":"placeholder","reason":"该行仅是 AST_HINTS 字典中的字符串常量，描述 unsafe-stmt 类型警告的提示文本，并未实际调用 eval()。","model":"sonnet","reviewedAt":"2026-08-21T11:05:17.383Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":112,"evidence":"credential access at line 112 + outbound network at line 129","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"fb839b3aecf2b445dcf8184a","review":{"verdict":"functional","reason":"apiKey取自本地配置文件或环境变量后，用于调用cfg.baseUrl指定的OpenAI兼容视觉API（默认dashscope），正是设置页配置的视觉转文字核心流程，属声明功能而非外泄。","model":"sonnet","reviewedAt":"2026-08-22T08:35:49.995Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":1,"high":1,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":5,"bytesScanned":35962,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":1,"cordis":1,"source":2,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:35:49.995Z","summary":"插件按描述实现“图片转文字”功能：VISION脚本读取用户在设置页或本地配置/环境变量中提供的视觉API Key，调用用户指定（或默认dashscope）的OpenAI兼容端点完成图片转述，凭据流向与网络请求均服务于既定功能。需注意的是apiKey回退逻辑会依次尝试多个不同厂商的环境变量（DASHSCOPE/QWEN/OPENAI/GEMINI），若未显式配置baseUrl，可能出现将非dashscope厂商的Key发往默认dashscope地址的错配风险，属实现瑕疵而非蓄意窃取。整体功能与描述一致。","intentMatch":"consistent","findingsReviewed":3,"findingsCandidates":2,"fromCache":1,"usage":{"inputTokens":2,"outputTokens":1581,"costUsd":0.028432,"durationMs":21083}}},"timeline":[{"scannedAt":"2026-08-22T08:35:49.995Z","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:41:38.014Z","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:10:36.157Z","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:35:49.995Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:41:38.014Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"a96667f6b1445322892ae52d9c9e6c210300b0ec","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:10:36.157Z"}]}