{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"flyvhidbwo-dsh-vision-proxy","slug":"flyvhidbwo-dsh-vision-proxy","rank":239,"url":"https://github.com/Flyvhidbwo/dsh-vision-proxy","name":"Flyvhidbwo/dsh-vision-proxy","category":"vision","description":{"zh":"DeepSeek 大脑 + 自动识图：GUI 附加的每张图片自动经 OpenAI 兼容 VLM 转译成文字，再交给纯文本的 DeepSeek 作答——有 key 自动走快速通道（默认 qwen3.7-flash，支持百炼/智谱/OpenRouter 等任意 OpenAI 兼容端点），无 key 自动探测本地 Ollama（零配置，图片不出本机）。","en":"DeepSeek brain + automatic image transcription: attach images in the GUI and each one is transcribed to text via any OpenAI-compatible VLM before reaching the text-only DeepSeek — a keyed fast path (default qwen3.7-flash; DashScope/Zhipu/OpenRouter or any OpenAI-compatible endpoint) with your own key, or local Ollama auto-detected with zero config."},"stars":12,"starsCheckedAt":"2026-08-21","repository":{"owner":"Flyvhidbwo","repo":"dsh-vision-proxy","requestedRef":null,"subpath":""},"npm":"dsh-vision-proxy","downloads":1789,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-vision-proxy","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/Flyvhidbwo/dsh-vision-proxy/","screenshots":["https://raw.githubusercontent.com/Flyvhidbwo/dsh-vision-proxy/main/assets/demo-reply.png","https://raw.githubusercontent.com/Flyvhidbwo/dsh-vision-proxy/main/assets/demo-selector.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"flyvhidbwo-dsh-vision-proxy","slug":"flyvhidbwo-dsh-vision-proxy","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:39.424Z","scanStatus":"static-complete","verdict":"review","score":79,"commit":"d246d8511822b2441eb4841ec854981dc3e055e4","commitDate":"2026-08-21T22:33:37+08:00","artifactDigest":"sha256:b9791648d8626b73ceda7f55782669a11ec69bf133fd35a3bafc52670b26892e","downloadUrl":"https://github.com/Flyvhidbwo/dsh-vision-proxy/archive/d246d8511822b2441eb4841ec854981dc3e055e4.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-vision-proxy","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-vision-proxy","packageVersion":"0.3.1","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{"postinstall":"node scripts/postinstall.js"},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-vision-proxy","manifestName":"dsh-vision-proxy","nameMatch":true,"npm":{"name":"dsh-vision-proxy","latestVersion":"0.2.6","publishedAt":"2026-08-20T04:53:05.199Z","createdAt":"2026-08-14T02:28:01.114Z","versionCount":17,"maintainers":1,"repository":"git+https://github.com/Flyvhidbwo/dsh-vision-proxy.git","hasInstallScripts":true,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-vision-proxy","name":"dsh-vision-proxy","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[{"host":"dashscope.aliyuncs.com","count":2},{"host":"www.npmjs.com","count":1}],"findings":[{"id":"HT-INSTALL-001","title":"安装阶段执行高风险生命周期脚本","severity":"high","confidence":"high","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":63,"evidence":"\"postinstall\": \"node scripts/postinstall.js\"","remediation":"移除安装期执行，或提供可复现构建产物并将脚本降为显式命令。","hash":"510863caf7de223ad443c167","review":{"verdict":"unclear","reason":"scripts/postinstall.js 的具体内容未在上下文中给出，无法确认其仅做可选依赖(sharp)校验还是包含其他高风险操作。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:22:14.245Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":139,"evidence":"credential access at line 139 + outbound network at line 228","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"1f40e3cdfa611f468cd630d8","review":{"verdict":"functional","reason":"resolveApiKey 读取 config.apiKey/环境变量后用于向用户在 baseURL 中配置的 OpenAI 兼容 VLM 端点发起请求，属于插件声明的“转译图片”核心功能，未发往未配置的第三方目的地。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:22:14.245Z"}}],"counts":{"critical":0,"high":1,"medium":1,"low":0},"rawCounts":{"critical":0,"high":1,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":10,"bytesScanned":91672,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":2,"markdown":2,"cordis":1,"source":3,"manifest":1,"script":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:39.424Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:22:39.424Z","commit":"d246d8511822b2441eb4841ec854981dc3e055e4","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:14.245Z","commit":"2fa60286a95fa6d254a131d9f4866a02532828fc","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:37.277Z","commit":"2fa60286a95fa6d254a131d9f4866a02532828fc","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"d246d8511822b2441eb4841ec854981dc3e055e4","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:39.424Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"2fa60286a95fa6d254a131d9f4866a02532828fc","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:14.245Z"},{"kind":"first-scan","from":null,"to":"review","commit":"2fa60286a95fa6d254a131d9f4866a02532828fc","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:37.277Z"}]}