{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"jayden-x-l-forkprobe","slug":"jayden-x-l-forkprobe","rank":82,"url":"https://github.com/Jayden-X-L/forkprobe","name":"Jayden-X-L/forkprobe","category":"dev","description":{"zh":"同一任务并行试跑多个技能，对比结果选出最优。","en":"Compare multiple skills on the same task and pick the winner."},"stars":69,"starsCheckedAt":"2026-08-21","repository":{"owner":"Jayden-X-L","repo":"forkprobe","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:Jayden-X-L/forkprobe","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/Jayden-X-L/forkprobe/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"jayden-x-l-forkprobe","slug":"jayden-x-l-forkprobe","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:33.874Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","commitDate":"2026-08-19T16:42:41+08:00","artifactDigest":"sha256:3b63e624b861614cd208c41e55fdfa841877ccd5e968c5321bf7d3255c0af3c4","downloadUrl":"https://github.com/Jayden-X-L/forkprobe/archive/707d02b5a03c280237bb6d602bd8f1d09accf13e.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:Jayden-X-L/forkprobe","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"forkprobe-dsh","packageVersion":"1.1.0","bundle":{"patch":"./dsh-plugin/cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-agent","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-subagent"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"forkprobe-dsh","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"dsh-plugin/cordis.patch.yml","inserts":[{"id":"forkprobe-dsh","name":"forkprobe-dsh","path":"dsh-plugin/cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[{"host":"api.github.com","count":2},{"host":"skillhub.evermind.ai","count":1},{"host":"gitlab.com","count":1},{"host":"forkprobe-selection-telemetry.forkprobe-selection-telemetry.workers.dev","count":1}],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"docs/index.html","pathClass":"test-example-docs","line":2520,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"db0ca7c9417a3ceeb270970b"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"docs/index.html","pathClass":"test-example-docs","line":2582,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"db0ca7c9417a3ceeb270970b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh-plugin/lib/index.js","pathClass":"source","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"72ec77738b4c908349ecfbe7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh-plugin/src/index.ts","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"832e7f4b3181c6cb790ce972"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/finalize_native_compare.py","pathClass":"source","line":30,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"c49933df6951b7ebe11f60c0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/platform_adapter.py","pathClass":"source","line":402,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"fb2ca2bee9fcf6120f3a6c0f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/platform_adapter.py","pathClass":"source","line":421,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"fb2ca2bee9fcf6120f3a6c0f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/render_report.py","pathClass":"source","line":83,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7621c76cdd19d6870ce4e3ac"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/skill_loader.py","pathClass":"source","line":206,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"cc739d18c8d646cbb5f68890"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/video_artifact.py","pathClass":"source","line":409,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"419655c44e1a2a57d84e0a85"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/video_artifact.py","pathClass":"source","line":448,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"419655c44e1a2a57d84e0a85"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/web_artifact.py","pathClass":"source","line":486,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2d2f0f2f472c64a23d713a54"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_integration.py","pathClass":"test-example-docs","line":109,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"183ce13257c3b96b519abfad"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_smoke.py","pathClass":"test-example-docs","line":716,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"c06b68e7d77e9fdf4f891242"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/test_smoke.py","pathClass":"test-example-docs","line":738,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"c06b68e7d77e9fdf4f891242"}],"counts":{"critical":0,"high":0,"medium":0,"low":10},"rawCounts":{"critical":0,"high":0,"medium":2,"low":13},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":54,"bytesScanned":1097843,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":8,"data":9,"test-example-docs":10,"cordis":1,"source":24,"manifest":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:20:33.874Z","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:17.969Z","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:04.114Z","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:33.874Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:17.969Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"707d02b5a03c280237bb6d602bd8f1d09accf13e","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:04.114Z"}]}