{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"furongjun-1999-dsh-memory","slug":"furongjun-1999-dsh-memory","rank":148,"url":"https://github.com/FuRongJun-1999/dsh-memory","name":"FuRongJun-1999/dsh-memory","category":"memory","description":{"zh":"AGI长期记忆基础：多智能体时空记忆图谱、自进化知识飞轮、自我认知与可审计的信任护栏。","en":"AGI long-term memory base: multi-agent spatiotemporal memory graph, self-evolving knowledge flywheel, self-cognition, and auditable trust guardrails."},"stars":26,"starsCheckedAt":"2026-08-21","repository":{"owner":"FuRongJun-1999","repo":"dsh-memory","requestedRef":null,"subpath":""},"npm":"@furongjun1999/dsh-memory","downloads":1115,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @furongjun1999/dsh-memory","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/FuRongJun-1999/dsh-memory/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"furongjun-1999-dsh-memory","slug":"furongjun-1999-dsh-memory","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:28.827Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"5ba5f975669b0191f1811d434a996e0f5593d7cc","commitDate":"2026-08-22T13:48:19+08:00","artifactDigest":"sha256:525b27b1a69fab4e736607f9417bcf96218c0f84e2b5d869259145604ee4dfd4","downloadUrl":"https://github.com/FuRongJun-1999/dsh-memory/archive/5ba5f975669b0191f1811d434a996e0f5593d7cc.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @furongjun1999/dsh-memory","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@furongjun1999/dsh-memory","packageVersion":"0.2.8","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-session","@deepseek-ai/dsh-tools","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@furongjun1999/dsh-memory","manifestName":"@furongjun1999/dsh-memory","nameMatch":true,"npm":{"name":"@furongjun1999/dsh-memory","latestVersion":"0.2.8","publishedAt":"2026-08-15T23:34:06.653Z","createdAt":"2026-08-14T11:04:37.320Z","versionCount":9,"maintainers":1,"repository":"git+https://github.com/FuRongJun-1999/dsh-memory.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-memory","name":"@furongjun1999/dsh-memory","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"docs/memory-assessment.html","pathClass":"test-example-docs","line":680,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0731de1349c5e1980e205cd6"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"docs/memory-assessment.html","pathClass":"test-example-docs","line":688,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0731de1349c5e1980e205cd6"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"medium","confidence":"low","layer":"static","path":"docs/memory-assessment.html","pathClass":"test-example-docs","line":7,"evidence":"<script src=\"https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"来自公共 CDN cdn.jsdelivr.net，未固定完整性哈希；位于测试、示例或文档目录","hash":"bf64f47af29a0f59da96c8b3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/bridge.ts","pathClass":"source","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"eacb6aa01ea20cb7e226857d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/mutual.ts","pathClass":"source","line":14,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cabc6dc7565845269dfff1fe"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/roleplay_web.ts","pathClass":"source","line":203,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"c9053a004d3fe50042a31271"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/roleplay_web.ts","pathClass":"source","line":222,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"c9053a004d3fe50042a31271"}],"counts":{"critical":0,"high":0,"medium":2,"low":2},"rawCounts":{"critical":0,"high":0,"medium":5,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":24,"bytesScanned":211815,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":5,"cordis":1,"script":2,"source":10,"test-example-docs":4,"manifest":1,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:21:28.827Z","commit":"5ba5f975669b0191f1811d434a996e0f5593d7cc","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:52.386Z","commit":"17598658fbf4bda986d9cedb4666143df17529d7","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:47.892Z","commit":"17598658fbf4bda986d9cedb4666143df17529d7","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"pass","to":"caution","commit":"5ba5f975669b0191f1811d434a996e0f5593d7cc","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:28.827Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"17598658fbf4bda986d9cedb4666143df17529d7","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:52.386Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"17598658fbf4bda986d9cedb4666143df17529d7","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:47.892Z"}]}