{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"huey1in-trio","slug":"huey1in-trio","rank":215,"url":"https://github.com/huey1in/trio","name":"huey1in/trio","category":"tools","description":{"zh":"浏览器自动化（Playwright，带实时画面）+ MCP Server（把 DSH agent 暴露给任何 MCP 客户端）+ GitHub issue/PR/webhook 评审工具。","en":"Browser automation (Playwright) with a live view, an MCP server exposing DSH agents to any MCP client, and GitHub issue/PR/webhook review tools."},"stars":15,"starsCheckedAt":"2026-08-21","repository":{"owner":"huey1in","repo":"trio","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:huey1in/trio","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/huey1in/trio/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"huey1in-trio","slug":"huey1in-trio","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:21.802Z","scanStatus":"static-complete","verdict":"caution","score":85,"commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","commitDate":"2026-08-16T17:52:38+08:00","artifactDigest":"sha256:6d7eb1e4e11f197d8feb4a748bdbdcbcbac689e860dacb8bedf2d9bb2147ba94","downloadUrl":"https://github.com/huey1in/trio/archive/5d5ade9af01e134a3f64dc9619eb1881993d4a76.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:huey1in/trio","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-reef","packageVersion":"1.5.2","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{"prepare":"tsdown"},"peerDependencies":[]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-reef","nameMatch":null,"npm":{"name":"dsh-reef","latestVersion":"1.5.2","publishedAt":"2026-08-15T18:13:34.014Z","createdAt":"2026-08-15T17:56:05.987Z","versionCount":3,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"reef-browser","name":"dsh-reef/browser","path":"cordis.patch.yml","disabled":false},{"id":"reef-mcp","name":"dsh-reef/mcp","path":"cordis.patch.yml","disabled":false},{"id":"reef-github","name":"dsh-reef/github","path":"cordis.patch.yml","disabled":false},{"id":"reef-console","name":"dsh-reef/console","path":"cordis.patch.yml","disabled":false},{"id":"reef-gitlab","name":"dsh-reef/gitlab","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","session"],"outboundHosts":[{"host":"api.github.com","count":2},{"host":"gitlab.com","count":2}],"findings":[{"id":"HT-INSTALL-002","title":"Git 安装会触发 prepare 构建脚本","severity":"medium","confidence":"medium","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":48,"evidence":"\"prepare\": \"tsdown\"","remediation":"发布预构建制品（npm 或 GitHub Release tarball），并记录源码与发布包的一致性证明。","note":"源码安装需用户在 allowBuilds 中授权，此脚本会在安装期于用户机器执行","hash":"810168c20b99e01213acbe59"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/console.ts","pathClass":"source","line":150,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"5ecf79f1eebf53fd65fadd82"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/console.ts","pathClass":"source","line":241,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"5ecf79f1eebf53fd65fadd82"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/github/api.ts","pathClass":"source","line":14,"evidence":"credential access at line 14 + outbound network at line 49","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"90e0f10aac01e8f9faab4314","review":{"verdict":"functional","reason":"resolveToken 读取用户配置的 GITHUB_TOKEN 后仅用于向用户可配置的 config.apiBase(默认 api.github.com) 发起请求，是 GitHub 集成的必要行为。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:21:53.904Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/gitlab/api.ts","pathClass":"source","line":13,"evidence":"credential access at line 13 + outbound network at line 45","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"9e392c6171463f58dec830fc","review":{"verdict":"functional","reason":"resolveToken 读取用户配置的 GITLAB_TOKEN 后仅用于向用户可配置的 config.apiBase(默认 gitlab.com/api/v4) 发起请求，属于 GitLab 集成的必要行为。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:21:53.904Z"}}],"counts":{"critical":0,"high":0,"medium":5,"low":0},"rawCounts":{"critical":0,"high":0,"medium":5,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":65,"bytesScanned":414634,"truncated":false,"lockfiles":["pnpm-lock.yaml","package-lock.json"],"pathClasses":{"test-example-docs":14,"markdown":5,"cordis":1,"data":2,"manifest":1,"yaml":1,"source":41}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:21.802Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:22:21.802Z","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:53.904Z","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:10.550Z","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:21.802Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:53.904Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"5d5ade9af01e134a3f64dc9619eb1881993d4a76","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:10.550Z"}]}