{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"huanlinoto-dsh-plugin-d399","slug":"huanlinoto-dsh-plugin-d399","rank":350,"url":"https://github.com/HuanLinOTO/dsh-plugin-d399","name":"HuanLinOTO/dsh-plugin-d399","category":"fun","description":{"zh":"模型生成时弹出小游戏菜单（wordle/消消乐，可扩展）。","en":"Pops up a mini-game menu (wordle, match-3, extensible) while the model generates."},"stars":8,"starsCheckedAt":"2026-08-21","repository":{"owner":"HuanLinOTO","repo":"dsh-plugin-d399","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:HuanLinOTO/dsh-plugin-d399","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/HuanLinOTO/dsh-plugin-d399/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"huanlinoto-dsh-plugin-d399","slug":"huanlinoto-dsh-plugin-d399","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:03.378Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","commitDate":"2026-08-15T17:05:51+08:00","artifactDigest":"sha256:27c4d51647d082c96e64b3152d2fb90f158c6226631a9985f168b400fa0c6a5a","downloadUrl":"https://github.com/HuanLinOTO/dsh-plugin-d399/archive/fe5e1179daef7ee68df993654aa687a196bc6a0d.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:HuanLinOTO/dsh-plugin-d399","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@huanlin/dsh-plugin-d399","packageVersion":"0.1.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-invariants","@deepseek-ai/cordis"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"@huanlin/dsh-plugin-d399","nameMatch":null,"npm":{"name":"@huanlin/dsh-plugin-d399","latestVersion":"0.1.1","publishedAt":"2026-08-15T09:06:06.664Z","createdAt":"2026-08-13T14:28:12.805Z","versionCount":2,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-d399","name":"@huanlin/dsh-plugin-d399","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","session","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"lib/client.js","pathClass":"source","line":5642,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"86761fdb9c6cdb64004c5325","review":{"verdict":"sanitized","reason":"new Function(\"\") 仅用固定空字符串做 eval/Function 可用性探测（allowsEval，zod 库内部逻辑），未传入任何用户或远程输入，不构成动态代码执行风险。","model":"sonnet","reviewedAt":"2026-08-21T10:51:49.670Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"medium","confidence":"medium","layer":"static","path":"src/client/games/mini/engines-strategy.tsx","pathClass":"source","line":604,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"b61299eaff9ca9982c5b9de3","review":{"verdict":"functional","reason":"new Function 仅用于计算“算24点”小游戏中玩家在输入框内自行键入的算式，属本地用户输入而非远程/不可信数据，是该游戏功能必需的表达式求值逻辑。","model":"sonnet","reviewedAt":"2026-08-22T08:24:03.378Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":0,"high":1,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":44,"bytesScanned":783844,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":2,"cordis":1,"source":33,"manifest":1,"yaml":2,"test-example-docs":4,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:24:03.378Z","summary":"该插件声称在模型生成时弹出小游戏菜单（wordle/消消乐/算24点等），代码实现与描述一致。唯一命中的 new Function 动态执行仅用于解析玩家本地输入的算术表达式（如“3*8÷2+4”）以判断是否等于24，输入来源为本地文本框而非网络或模型输出，风险有限，属于功能实现的一部分，建议用户留意该输入未做字符白名单限制。","intentMatch":"consistent","findingsReviewed":2,"findingsCandidates":2,"fromCache":1,"usage":{"inputTokens":2,"outputTokens":725,"costUsd":0.02114,"durationMs":11277}}},"timeline":[{"scannedAt":"2026-08-22T08:24:03.378Z","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:24:01.766Z","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:52:45.018Z","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:03.378Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:24:01.766Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"fe5e1179daef7ee68df993654aa687a196bc6a0d","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:52:45.018Z"}]}