{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"fishsb-dsh-prompt-enhancer","slug":"fishsb-dsh-prompt-enhancer","rank":117,"url":"https://github.com/Fishsb/dsh-prompt-enhancer","name":"Fishsb/dsh-prompt-enhancer","category":"tools","description":{"zh":"一键提示词增强：独立 LLM 调用把模糊草稿改写为更强的提示词，不满意可撤回。","en":"One-click prompt enhancement: an independent LLM call rewrites your rough draft in the composer, fully undoable."},"stars":40,"starsCheckedAt":"2026-08-21","repository":{"owner":"Fishsb","repo":"dsh-prompt-enhancer","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:Fishsb/dsh-prompt-enhancer","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/Fishsb/dsh-prompt-enhancer/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"fishsb-dsh-prompt-enhancer","slug":"fishsb-dsh-prompt-enhancer","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:01.709Z","scanStatus":"static-complete","verdict":"review","score":78,"commit":"fcbdd78748ad4cc218c577f93f7acdcf0c6c3846","commitDate":"2026-08-22T16:10:18+08:00","artifactDigest":"sha256:ccb0e699084625345b5af653754359d6e35a49807a9d571abb518834146b46b0","downloadUrl":"https://github.com/Fishsb/dsh-prompt-enhancer/archive/fcbdd78748ad4cc218c577f93f7acdcf0c6c3846.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:Fishsb/dsh-prompt-enhancer","manifest":{"found":true,"path":"package.json","parseError":"package.json parse failed: Unexpected token '', \"{\n  \"name\"... is not valid JSON","packageName":null,"packageVersion":null,"bundle":null,"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-applicable","installMode":"github-source","upstreamNpm":null,"manifestName":null,"nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":null,"inserts":[{"id":"dsh-prompt-enhancer","name":"dsh-prompt-enhancer","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","network","session","subprocess"],"outboundHosts":[{"host":"api.github.com","count":13},{"host":"www.webrtc-experiment.com","count":12},{"host":"unpkg.com","count":12},{"host":"huggingface.co","count":4},{"host":"dashscope.aliyuncs.com","count":3},{"host":"uploads.github.com","count":2},{"host":"nssm.cc","count":1},{"host":"placeholder.invalid","count":1},{"host":"ghproxy.net","count":1},{"host":"gh-proxy.com","count":1},{"host":"ghfast.top","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/asr-deploy.cjs","pathClass":"source","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"58c15656e7fb8bae931e8469"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/asr-models.cjs","pathClass":"source","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8d1c1d4e287558334641f3d3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/asr-models.cjs","pathClass":"source","line":272,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"764b38aa1405e3c72cb04c5b"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"high","layer":"static","path":"lib/client.cjs","pathClass":"source","line":49,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"动态执行与编码解码出现在同一语句，是典型的载荷隐藏模式","hash":"7a208e902cd753f5c88741c5","review":{"verdict":"functional","reason":"new Function 求值的是构建期内嵌的固定 client 端源码字符串（由 build-client.mjs 生成），闭包 React/host/styles/executor，属于该插件动态加载客户端半部的标准打包手法，非远程/用户输入代码。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.cjs","pathClass":"source","line":25,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4aebb1da3fdd5691a53f1e2a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.cjs","pathClass":"source","line":25,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b8498095d41941fc5798a2c8"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"low","layer":"static","path":"lib/index.cjs","pathClass":"source","line":38,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"67f5bb31ffe2817dc39c8fae","review":{"verdict":"functional","reason":"BODY 是同文件内硬编码的 host 端插件体字符串，new Function('harness', BODY)(harness) 用于动态求值自身打包代码而非外部输入，是同类 dual-bundle 架构的必要环节。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.cjs","pathClass":"source","line":397,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"67f5bb31ffe2817dc39c8fae","review":{"verdict":"functional","reason":"BODY 是同文件内硬编码的 host 端插件体字符串，new Function('harness', BODY)(harness) 用于动态求值自身打包代码而非外部输入，是同类 dual-bundle 架构的必要环节。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/maintain-lib.cjs","pathClass":"source","line":12,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4eabc3062c76e7f1d9cf9433"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/maintain-lib.cjs","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ebdf973a40505f28d7c99439"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/net-proxy.cjs","pathClass":"source","line":15,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"6bd6d6544cd469a1cc87bd7c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/net-proxy.cjs","pathClass":"source","line":15,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0bb7462afdf898e618bb5a4c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/platform-service.cjs","pathClass":"source","line":24,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2bf02ef7ea7762129c36de00"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/platform-service.cjs","pathClass":"source","line":24,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2894225e56de48428e708994"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/shortcut-win.cjs","pathClass":"source","line":20,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f1ec35dd22bc8e10963bd2f4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/shortcut-win.cjs","pathClass":"source","line":20,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bd8a81026157e903b6b266ca"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/stage-install.cjs","pathClass":"source","line":14,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"57be9228adc15e8ff7946588"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/stage-install.cjs","pathClass":"source","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dd3541d165e8e230e01a844e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/sys.cjs","pathClass":"source","line":7,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cf52a23db578225b833dc859"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/sys.cjs","pathClass":"source","line":11,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b96791087e6156cb09bedc2d"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"lib/sys.cjs","pathClass":"source","line":96,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"68f878ec727353a2c5820437","review":{"verdict":"functional","reason":"pureText 取自本地 BODY 常量中 ==PURE-BEGIN==/==PURE-END== 标记间的自身纯函数片段，用于 host/client 共享实现，输入固定非外部可控。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/updater-host.cjs","pathClass":"source","line":33,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"eecd65d520ef75a8ae8e6f4c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/updater-host.cjs","pathClass":"source","line":33,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dfc58a69994796131ef7adbe"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"plugin-host.js","pathClass":"source","line":44,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"d24142e3e00e546ef78c0c2f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/asr-deploy.mjs","pathClass":"source","line":9,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ea850c56c7bc6f8836354ba6"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/asr-deploy.mjs","pathClass":"source","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e57c15b72e73dd2f0e5fee3e"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"scripts/build-client.mjs","pathClass":"source","line":146,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"76060b61b948c2ed6fa48534","review":{"verdict":"functional","reason":"该 new Function 调用只是构建脚本用模板字符串生成写入 lib/client.cjs 的源码文本（${embedded} 为占位插值），构建时不会真正执行外部代码，是产出上面同一动态求值模式的生成器。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":12,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1de4276ac06c727a5b6b2ab2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f735a4f41f7179ccfa16f964"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"scripts/sync-prompts.mjs","pathClass":"source","line":7,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"42e7f8e72b8674d29f8cc4b8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/sync-runtime.mjs","pathClass":"source","line":11,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"24f73ddd043c78591d317625"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/sync-runtime.mjs","pathClass":"source","line":11,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a20a1e52ef42360f62054a85"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/voice-verify.mjs","pathClass":"source","line":11,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a5934e820e7b492bc7294ece"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/voice-verify.mjs","pathClass":"source","line":11,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5f582f38dd8140597018a5b0"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"src/host/app.js","pathClass":"source","line":5,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"b64bf6b3b9946d45ef0d7c4f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/a4-drill.cjs","pathClass":"test-example-docs","line":28,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"24662e35490a74f958286716"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/a6-drill.cjs","pathClass":"test-example-docs","line":8,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"fdd2755512e9be0c7dc922c4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/a6-drill.cjs","pathClass":"test-example-docs","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"92326204a59d8ffe0fa30532"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/bundle-smoke.test.cjs","pathClass":"test-example-docs","line":3,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中；位于测试、示例或文档目录","hash":"a55102a06eb807ab4185dff7"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/bundle-smoke.test.cjs","pathClass":"test-example-docs","line":40,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"a55102a06eb807ab4185dff7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/e2e-restart.cjs","pathClass":"test-example-docs","line":20,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"807276817069b6a1fa25ab11"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/e2e-restart.cjs","pathClass":"test-example-docs","line":20,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"797072e9b017157763f6e0b0"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/lib.test.cjs","pathClass":"test-example-docs","line":24,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"0ba8ec432a44f4d930a6c6cc"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/lib.test.cjs","pathClass":"test-example-docs","line":264,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"0ba8ec432a44f4d930a6c6cc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/maintain.test.cjs","pathClass":"test-example-docs","line":13,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"89230901438b33157dabc07d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"test/maintain.test.cjs","pathClass":"test-example-docs","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7631e0972ec0072af2e6dcf7"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/voice-persist.test.cjs","pathClass":"test-example-docs","line":330,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"16030fcdf09145ffb15d2cfa"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":23,"evidence":"credential access at line 23 + outbound network at line 53","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"0573e9f32eef8e23a6b83bfa","review":{"verdict":"functional","reason":"GITHUB_TOKEN 取自维护者本地环境变量，仅用于向官方 api.github.com 发起 Release 相关请求，属于发布脚本自身预期行为，且该脚本不在 npm 包 files 列表中，不随插件分发给终端用户。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:11.146Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scripts/sync-release-notes.mjs","pathClass":"source","line":14,"evidence":"credential access at line 14 + outbound network at line 24","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"ed4eb01e8928bea3101d88a3","review":{"verdict":"functional","reason":"该脚本不在package.json的files列表中，不随插件分发给终端用户，是维护者本地发布工具：读取自身GITHUB_TOKEN环境变量并发往官方api.github.com更新Release说明，符合注释所述用途。","model":"sonnet","reviewedAt":"2026-08-22T08:21:01.710Z"}}],"counts":{"critical":0,"high":1,"medium":5,"low":27},"rawCounts":{"critical":0,"high":9,"medium":6,"low":34},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"error","bundleConfig":"not-declared","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"not-applicable","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":140,"bytesScanned":2945241,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":22,"markdown":33,"cordis":1,"source":82,"data":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:01.710Z","summary":"该finding位于scripts/sync-release-notes.mjs，是仓库维护者用于同步GitHub Release说明的本地发布脚本，不属于package.json files中打包分发给最终用户的插件运行时代码（lib/index.cjs等）。凭据来自维护者自行设置的GITHUB_TOKEN环境变量，且仅发往官方api.github.com接口更新自身仓库的Release正文，未涉及用户凭据或未声明的第三方目的地，行为与注释所述\"发布后同步Release说明\"意图一致，不构成对终端用户的安全风险。","intentMatch":"consistent","findingsReviewed":7,"findingsCandidates":6,"fromCache":5,"usage":{"inputTokens":4,"outputTokens":1348,"costUsd":0.0334958,"durationMs":17411}}},"timeline":[{"scannedAt":"2026-08-22T08:21:01.709Z","commit":"fcbdd78748ad4cc218c577f93f7acdcf0c6c3846","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:11.146Z","commit":"3fd60f66a72d3c547d2deca8aff43d671e3cbcd6","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:01.636Z","commit":"3fd60f66a72d3c547d2deca8aff43d671e3cbcd6","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"fcbdd78748ad4cc218c577f93f7acdcf0c6c3846","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:01.709Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"3fd60f66a72d3c547d2deca8aff43d671e3cbcd6","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:11.146Z"},{"kind":"first-scan","from":null,"to":"review","commit":"3fd60f66a72d3c547d2deca8aff43d671e3cbcd6","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:01.636Z"}]}