{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"letter2025-dsh-approval-llm","slug":"letter2025-dsh-approval-llm","rank":383,"url":"https://github.com/Letter2025/dsh-approval-llm","name":"Letter2025/dsh-approval-llm","category":"security","description":{"zh":"基于模型的权限审批：由独立审查模型自动应答 approval 权限请求。","en":"Model-based permission approval: an approval-request answerer backed by a separate reviewer model."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"Letter2025","repo":"dsh-approval-llm","requestedRef":null,"subpath":""},"npm":"dsh-approval-llm","downloads":461,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-approval-llm","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/Letter2025/dsh-approval-llm/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"letter2025-dsh-approval-llm","slug":"letter2025-dsh-approval-llm","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-21T13:16:43.954Z","scanStatus":"static-complete","verdict":"review","score":84,"commit":"cd84622eb9308c295e6c5073bfae7792704c9194","commitDate":"2026-08-18T13:56:30+08:00","artifactDigest":"sha256:6864815e17b25f3fb094da6b6b133ecd9c9c8e1a22be3dcafd30df13b5718189","downloadUrl":"https://github.com/Letter2025/dsh-approval-llm/archive/cd84622eb9308c295e6c5073bfae7792704c9194.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-approval-llm","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-approval-llm","packageVersion":"0.1.4","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-agent","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-permission-presets","@deepseek-ai/dsh-session","@deepseek-ai/dsh-skill","@deepseek-ai/dsh-timeout","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-user-approval","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-approval-llm","manifestName":"dsh-approval-llm","nameMatch":true,"npm":{"name":"dsh-approval-llm","latestVersion":"0.1.4","publishedAt":"2026-08-18T05:59:37.332Z","createdAt":"2026-08-14T07:30:30.010Z","versionCount":5,"maintainers":1,"repository":"git+https://github.com/Letter2025/dsh-approval-llm.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"approval-llm","name":"dsh-approval-llm","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"permission","tier":"critical","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["presets"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","filesystem","host-bundle"],"outboundHosts":[],"findings":[{"id":"HT-PERMISSION-001","title":"覆盖安全关键宿主能力","severity":"high","confidence":"high","path":"cordis.patch.yml","line":32,"evidence":"override: id=permission config[presets]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"改写配置 权限预设（permission）","layer":"dsh-semantics","pathClass":"cordis","hash":"3f8552c40e7de21122e3f5b0"}],"counts":{"critical":0,"high":1,"medium":0,"low":0},"rawCounts":{"critical":0,"high":1,"medium":0,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"failed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":18,"bytesScanned":85354,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":3,"cordis":1,"manifest":1,"source":7,"test-example-docs":4,"data":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-21T13:16:43.954Z","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T13:16:18.733Z","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:24:30.874Z","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:53:20.365Z","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"caution","to":"review","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:43.954Z"},{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:18.733Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:24:30.874Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"cd84622eb9308c295e6c5073bfae7792704c9194","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:53:20.365Z"}]}