{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"huanlinoto-dsh-plugin-mineru","slug":"huanlinoto-dsh-plugin-mineru","rank":120,"url":"https://github.com/HuanLinOTO/dsh-plugin-mineru","name":"HuanLinOTO/dsh-plugin-mineru","category":"docs","description":{"zh":"向模型暴露 MineRU 文档解析工具。","en":"Expose MineRU document parsing tools to the model."},"stars":39,"starsCheckedAt":"2026-08-21","repository":{"owner":"HuanLinOTO","repo":"dsh-plugin-mineru","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:HuanLinOTO/dsh-plugin-mineru","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/HuanLinOTO/dsh-plugin-mineru/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"huanlinoto-dsh-plugin-mineru","slug":"huanlinoto-dsh-plugin-mineru","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:04.545Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"79809aa57bd19be0ca548be52b76161514d02e11","commitDate":"2026-08-15T13:06:09+08:00","artifactDigest":"sha256:6e8e20075085d2e059befeda83c5e0d727bd8d5dfa3832563a321cc0a9d7fdba","downloadUrl":"https://github.com/HuanLinOTO/dsh-plugin-mineru/archive/79809aa57bd19be0ca548be52b76161514d02e11.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:HuanLinOTO/dsh-plugin-mineru","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@huanlin/dsh-plugin-mineru","packageVersion":"0.2.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-client-ui-primitives"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-client-locale","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-primitives","@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-ui-slots","@deepseek-ai/dsh-host-apiproxy","@deepseek-ai/dsh-tools"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"@huanlin/dsh-plugin-mineru","nameMatch":null,"npm":{"name":"@huanlin/dsh-plugin-mineru","latestVersion":"0.2.2","publishedAt":"2026-08-14T04:39:34.195Z","createdAt":"2026-08-13T14:28:25.621Z","versionCount":3,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-mineru","name":"@huanlin/dsh-plugin-mineru","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":848,"evidence":"credential access at line 848 + outbound network at line 129","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"3fd05c96ee2d66db59c61f44","review":{"verdict":"functional","reason":"apiKeyResolver通过ctx.get('credentials').resolve按用户配置的apiKeyEnv名取密钥，仅用于MinerUClient向用户在baseURL中配置的MineRU服务发起解析请求，属于文档解析插件鉴权的必要行为。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:19:53.858Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":0,"high":0,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":23,"bytesScanned":201639,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":2,"cordis":1,"source":15,"manifest":1,"yaml":2,"test-example-docs":1,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:04.545Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:04.545Z","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:53.858Z","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:47.406Z","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:04.545Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:53.858Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"79809aa57bd19be0ca548be52b76161514d02e11","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:47.406Z"}]}