{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"freehul-sgme","slug":"freehul-sgme","rank":463,"url":"https://github.com/freehul/sgme","name":"freehul/sgme","category":"memory","description":{"zh":"拾光记忆引擎（SGME）桥接：多智能体共享长期记忆（HTTP）—— L0/L1/L1.5/L2 分层提炼、按场景注入、统一检索、主动关怀信号（memory_search / wiki_search / signal_pull / signal_claim / signal_ack），npm 包名 `dsh-sgme`。","en":"ShiGuang Memory Engine (SGME) bridge: multi-agent shared long-term memory via HTTP — L0/L1/L1.5/L2 distillation, scenario-based injection, unified search, and proactive care signals (memory_search / wiki_search / signal_pull / signal_claim / signal_ack), installable as `dsh-sgme`."},"stars":6,"starsCheckedAt":"2026-08-21","repository":{"owner":"freehul","repo":"sgme","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:freehul/sgme","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/freehul/sgme/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"freehul-sgme","slug":"freehul-sgme","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:25:11.664Z","scanStatus":"static-complete","verdict":"caution","score":89,"commit":"2c42676407a2fa05cd38119df74ec96670442d23","commitDate":"2026-08-20T23:38:41+08:00","artifactDigest":"sha256:db6d427897857da3fe374fbbe1c63ff56dfb83a0ba56a9de49a1ab4032165348","downloadUrl":"https://github.com/freehul/sgme/archive/2c42676407a2fa05cd38119df74ec96670442d23.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:freehul/sgme","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-sgme","packageVersion":"0.1.1","bundle":{"patch":"./adapters/dsh/sgme-bridge/cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-commands"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-sgme","nameMatch":null,"npm":{"name":"dsh-sgme","latestVersion":"0.3.1","publishedAt":"2026-08-20T06:26:52.758Z","createdAt":"2026-08-14T08:56:46.904Z","versionCount":6,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"adapters/dsh/sgme-bridge/cordis.patch.yml","inserts":[{"id":"sgme","name":"dsh-sgme","path":"adapters/dsh/sgme-bridge/cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":3,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session","subprocess"],"outboundHosts":[{"host":"api.siliconflow.cn","count":3},{"host":"ark.cn-beijing.volces.com","count":3},{"host":"open.bigmodel.cn","count":2},{"host":"api.github.com","count":2},{"host":"api.deepseek.com","count":1},{"host":"integrate.api.nvidia.com","count":1},{"host":"cloud.siliconflow.cn","count":1},{"host":"gitee.com","count":1}],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"adapters/dsh/sgme-bridge/cordis.patch.yml","pathClass":"cordis","line":8,"evidence":"!!js process.env.SGME_BASE_URL ?? 'http://192.168.10.10:9910'","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"92b22d66b5517bddecb4f6f5"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"adapters/dsh/sgme-bridge/cordis.patch.yml","pathClass":"cordis","line":12,"evidence":"!!js process.env.SGME_AGENT_KEY ?? ''","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"752bf2647c98cb0225477cfa"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"adapters/dsh/sgme-bridge/lib/index.js","pathClass":"source","line":624,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"fe8e555fcfc241f3339bffc1","review":{"verdict":"functional","reason":"该 new Function 位于打包进来的第三方依赖 schemastery(v3.18.1) 库内部，用于把可序列化的 schema.callback 字符串还原为函数，是该库固有机制而非插件自身注入的动态执行逻辑，且有 try/catch 包裹。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:26:28.743Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/describe_image.py","pathClass":"source","line":54,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"504f8b7cf4f8a194f5b17c89"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/project_init.py","pathClass":"source","line":279,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"770ccaea637eacea9b4ebab0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/project_init.py","pathClass":"source","line":283,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"770ccaea637eacea9b4ebab0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/test_fast.py","pathClass":"test-example-docs","line":28,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"2d1d1b11b63cd8bcb978917d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/test_fast.py","pathClass":"test-example-docs","line":66,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"2d1d1b11b63cd8bcb978917d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"sgme/server/app.py","pathClass":"source","line":375,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a9a92d49f44920957d6334aa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"sgme/skills_hub/__init__.py","pathClass":"source","line":501,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7536cdb12ada8cac874716f2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"sgme/skills_hub/__init__.py","pathClass":"source","line":529,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7536cdb12ada8cac874716f2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_eval_qa_acceptance.py","pathClass":"test-example-docs","line":464,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f8fcb2851c854ab1bf73bea9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_eval_qa_acceptance.py","pathClass":"test-example-docs","line":487,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f8fcb2851c854ab1bf73bea9"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_routes_admin.py","pathClass":"test-example-docs","line":282,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"15154815139e30f850344afa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_skills_hub_sync.py","pathClass":"test-example-docs","line":38,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"55ce33f7eb5145be0d8ece52"}],"counts":{"critical":0,"high":0,"medium":3,"low":6},"rawCounts":{"critical":0,"high":0,"medium":3,"low":12},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":418,"bytesScanned":4699739,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":55,"source":196,"cordis":1,"manifest":3,"yaml":15,"test-example-docs":134,"data":8,"script":5,"html":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:25:11.664Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:25:11.664Z","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:26:28.743Z","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:55:14.560Z","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:25:11.664Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:26:28.743Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"2c42676407a2fa05cd38119df74ec96670442d23","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:55:14.560Z"}]}