{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"jing-hy-picturereader","slug":"jing-hy-picturereader","rank":135,"url":"https://github.com/jing-hy/picturereader","name":"jing-hy/picturereader","category":"vision","description":{"zh":"给纯文本模型的\"读图\"能力：图片降分辨率+降色深+结构/色彩指纹渲染成文本网格喂回对话，模型像多模态一样自主缩放、取样、OCR 读图；纯本地零外部模型依赖，附读图方法论 skill 与可选 PaddleOCR。","en":"Image \"reading\" for text-only models: downscale + reduce color depth + structure/color fingerprints into text grids fed back to the conversation, letting the model zoom, sample and OCR autonomously like a multimodal model; fully local with zero external model dependency, ships an image-reading methodology skill and optional PaddleOCR."},"stars":31,"starsCheckedAt":"2026-08-21","repository":{"owner":"jing-hy","repo":"picturereader","requestedRef":null,"subpath":""},"npm":"picturereader","downloads":1473,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add picturereader","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/jing-hy/picturereader/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"jing-hy-picturereader","slug":"jing-hy-picturereader","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:19.379Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","commitDate":"2026-08-21T09:50:47+08:00","artifactDigest":"sha256:d3915fec4be11a488b4f892e9c0e505530c0f05f6d8b72706f3c0c15e6989405","downloadUrl":"https://github.com/jing-hy/picturereader/archive/8aba6fcf804a9b2d1c06470d24f170d4069d1582.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add picturereader","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"picturereader","packageVersion":"3.0.6","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-settings","@deepseek-ai/schemastery","@deepseek-ai/dsh-llm"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"picturereader","manifestName":"picturereader","nameMatch":true,"npm":{"name":"picturereader","latestVersion":"3.0.6","publishedAt":"2026-08-21T01:52:57.969Z","createdAt":"2026-08-16T07:02:17.709Z","versionCount":13,"maintainers":1,"repository":"git+https://github.com/jing-hy/picturereader.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"picturereader","name":"picturereader","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[{"host":"api.openai.com","count":3},{"host":"pypi.tuna.tsinghua.edu.cn","count":3},{"host":"open.bigmodel.cn","count":3},{"host":"registry.npmmirror.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/doc-to-image.py","pathClass":"source","line":89,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"3fdcd7cc4c8112b7a55fafd8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-doc-venv.mjs","pathClass":"source","line":20,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"6d3abb11fcca0cc7c1bf648e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-doc-venv.mjs","pathClass":"source","line":20,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1b96cee9ba77fa84cc4a03a2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-ocr.mjs","pathClass":"source","line":16,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"de9d50fb054f3fa984105a7d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-ocr.mjs","pathClass":"source","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4eafc583bd5f8a0461e6ae27"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-rapid.mjs","pathClass":"source","line":18,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"115b59fe1cf0210265c1c006"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/setup-rapid.mjs","pathClass":"source","line":18,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0a33862ad08ca36a8f512263"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/core.js","pathClass":"source","line":25,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5ce63c29d403931d1ae533b1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/doc-tools.js","pathClass":"source","line":31,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"240f767de10a9358ff9f0b11"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/doc-tools.js","pathClass":"source","line":31,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"67d2b43b0db47452e3f10991"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/vlm.js","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"14f1d4a4aecbcfa55c7e4755"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/ocr.test.js","pathClass":"test-example-docs","line":4,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"26ea5f2625c8c7c806850955"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/ocr.test.js","pathClass":"test-example-docs","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"5b5810859152283d959d354b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/rapid.test.js","pathClass":"test-example-docs","line":4,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"caad27f4f0c7314cc2d48048"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/rapid.test.js","pathClass":"test-example-docs","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"c3e8d4d7b5621352407b04a3"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/vlm.js","pathClass":"source","line":153,"evidence":"credential access at line 153 + outbound network at line 238","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"5e0f4efae84e5a2e71f64578","review":{"verdict":"functional","reason":"apiKey取自用户配置的环境变量或dshConfig（settings.yaml），发送目标为同样用户可配置的baseURL（默认GLM4V_BASE），属于插件声明的可选外部VLM桥接功能的必要实现。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:29.692Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":11},"rawCounts":{"critical":0,"high":0,"medium":1,"low":15},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":38,"bytesScanned":425599,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":3,"source":21,"cordis":1,"data":1,"manifest":1,"test-example-docs":11}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:19.379Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:19.379Z","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:29.691Z","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:19.855Z","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:19.379Z"},{"kind":"verdict-change","from":"review","to":"caution","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:29.691Z"},{"kind":"first-scan","from":null,"to":"review","commit":"8aba6fcf804a9b2d1c06470d24f170d4069d1582","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:19.855Z"}]}