{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"jacujay-dsh-model-balance","slug":"jacujay-dsh-model-balance","rank":1290,"url":"https://github.com/jacujay/dsh-model-balance","name":"jacujay/dsh-model-balance","category":"usage","description":{"zh":"自动识别当前模型厂商（内置 7 家），在输入框内显示余额或配额，未内置厂商可配置自定义接口。","en":"Auto-detect the current model vendor (7 built-in) and show its balance or quota in the composer input row, with custom endpoints for unsupported vendors."},"stars":1,"starsCheckedAt":"2026-08-21","repository":{"owner":"jacujay","repo":"dsh-model-balance","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:jacujay/dsh-model-balance","tarball":null,"added":"2026-08-20","page":"https://awesome-dsh-plugin.com/p/jacujay/dsh-model-balance/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"jacujay-dsh-model-balance","slug":"jacujay-dsh-model-balance","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:33:30.136Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","commitDate":"2026-08-20T09:52:59+08:00","artifactDigest":"sha256:8e105ddd20e1c3f847920508b8b7f8278eae4421b7146e56b1665953ebb1d074","downloadUrl":"https://github.com/jacujay/dsh-model-balance/archive/db0c331a0d6d92ee9596cc55a31527e6052a935d.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:jacujay/dsh-model-balance","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-model-balance","packageVersion":"0.1.2","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-ui-slots"]},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-model-balance","nameMatch":null,"npm":{"name":"dsh-model-balance","latestVersion":"0.1.1","publishedAt":"2026-08-15T11:28:17.616Z","createdAt":"2026-08-15T11:19:15.457Z","versionCount":2,"maintainers":1,"repository":"git+https://github.com/nabin-qq273274877/dsh-model-balance.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"mismatch","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"model-balance","name":"dsh-model-balance","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","filesystem","host-bundle","network"],"outboundHosts":[{"host":"api.example.com","count":1},{"host":"api.deepseek.com","count":1},{"host":"api.moonshot.cn","count":1},{"host":"api.minimaxi.com","count":1},{"host":"api.stepfun.com","count":1},{"host":"open.bigmodel.cn","count":1},{"host":"api.siliconflow.cn","count":1},{"host":"openrouter.ai","count":1}],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/query.js","pathClass":"source","line":95,"evidence":"credential access at line 95 + outbound network at line 102","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"520412389191db76575d6358","review":{"verdict":"functional","reason":"credentials.resolve(apiKeyEnv) 取用户为该 provider 配置的密钥，仅发往同一 provider 的官方余额端点或用户自定义 endpoint，是查询余额功能的必要实现。","model":"sonnet","reviewedAt":"2026-08-22T08:33:30.136Z"}},{"id":"HT-IDENTITY-001","title":"npm 上存在同名包但指向其他仓库","severity":"low","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm repository=git+https://github.com/nabin-qq273274877/dsh-model-balance.git ≠ jacujay/dsh-model-balance","remediation":"npm 上存在同名包但指向其它仓库；从源码安装时请使用 github: 引用并锁定 commit。","layer":"identity","hash":"3b9c1e01fad2405a9ca3b153"}],"counts":{"critical":0,"high":0,"medium":1,"low":1},"rawCounts":{"critical":0,"high":0,"medium":1,"low":1},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":12,"bytesScanned":51036,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":2,"markdown":2,"source":5,"cordis":1,"data":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:33:30.136Z","summary":"插件按声明功能自动识别模型厂商并调用其余额接口：使用该 provider 已配置的连接信息（baseURL/apiKeyEnv）或用户在设置页填写的自定义 endpoint，取出对应凭据后仅以 GET 请求发往该 provider 自身的余额/配额端点，未见凭据外泄到无关地址，凭据与网络访问耦合是查询余额功能的必要实现方式，与描述一致。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":8,"outputTokens":1695,"costUsd":0.038788800000000005,"durationMs":19891}}},"timeline":[{"scannedAt":"2026-08-22T08:33:30.136Z","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:38:19.598Z","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:07:20.382Z","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:33:30.136Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:38:19.598Z"},{"kind":"first-scan","from":null,"to":"review","commit":"db0c331a0d6d92ee9596cc55a31527e6052a935d","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:07:20.382Z"}]}