{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"liustack-modlens","slug":"liustack-modlens","rank":8,"url":"https://github.com/liustack/modlens","name":"liustack/modlens","category":"vision","description":{"zh":"为纯文本模型架起视觉桥梁：粘贴图片，输出结构化 JSON 证据（OCR、版面、语义）。","en":"Vision bridge for text-only models: paste an image, get structured JSON evidence (OCR, layout, semantics)."},"stars":3498,"starsCheckedAt":"2026-08-21","repository":{"owner":"liustack","repo":"modlens","requestedRef":null,"subpath":""},"npm":"@liustack/modlens","downloads":75809,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @liustack/modlens","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/liustack/modlens/","screenshots":["https://raw.githubusercontent.com/liustack/modlens/main/assets/demo-dsh-settings-card.jpg","https://raw.githubusercontent.com/liustack/modlens/main/assets/demo-dsh-paste.jpg","https://raw.githubusercontent.com/liustack/modlens/main/assets/demo-codex-chart.jpg","https://raw.githubusercontent.com/liustack/modlens/main/assets/demo-codex-app.jpg"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"liustack-modlens","slug":"liustack-modlens","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:29.272Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"99eb92f0340c12cfbee84d1d97dbb7c5cc403d9c","commitDate":"2026-08-22T16:13:25+08:00","artifactDigest":"sha256:28e3f9caf42194cca0677837a7f1337e26869113ffbe7244f187fe9859a7309b","downloadUrl":"https://github.com/liustack/modlens/archive/99eb92f0340c12cfbee84d1d97dbb7c5cc403d9c.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @liustack/modlens","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@liustack/modlens","packageVersion":"3.24.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":[],"platform":"web","immediately":true},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@liustack/modlens","manifestName":"@liustack/modlens","nameMatch":true,"npm":{"name":"@liustack/modlens","latestVersion":"3.22.1","publishedAt":"2026-08-20T14:20:07.645Z","createdAt":"2026-02-22T08:08:26.722Z","versionCount":73,"maintainers":1,"repository":"git+https://github.com/liustack/modlens.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"modlens","name":"@liustack/modlens","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[{"host":"bun.sh","count":4},{"host":"aistudio.google.com","count":3},{"host":"antigravity.google","count":2},{"host":"api.anthropic.com","count":1},{"host":"moonshotai.github.io","count":1},{"host":"generativelanguage.googleapis.com","count":1},{"host":"api.openai.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh/spawnHidden.d.ts","pathClass":"source","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d799c371780e33c1ffc62333"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh/spawnHidden.js","pathClass":"source","line":9,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"699ceb8e2fe5ec0925561bfa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh/spawnHidden.js","pathClass":"source","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"824c0489d9ba65dc3b6ef161"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"evals/run.mjs","pathClass":"source","line":11,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"98415e0376196b89d5c2def0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"evals/run.mjs","pathClass":"source","line":11,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"c6df963534e8c6d74b9e4842"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"evals/run.mjs","pathClass":"source","line":215,"evidence":"eval (","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"a292955d697f751101403435"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":16,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1de4276ac06c727a5b6b2ab2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f735a4f41f7179ccfa16f964"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/stamp.test.mjs","pathClass":"test-example-docs","line":1,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"755f6d417f1eb886b736d95f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"scripts/stamp.test.mjs","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"5c3ff81d93cd338ecdf0a10f"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/analyzer.leak.test.ts","pathClass":"test-example-docs","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"d4f0bdf202ed4a9702527306"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"src/analyzer.ts","pathClass":"source","line":147,"evidence":"curl -fsSL https://antigravity.google/cli/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行","hash":"dc65012bcd399f26e231c0d5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/auto/routes.test.ts","pathClass":"test-example-docs","line":169,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"b8fe195f810e8be3cacd6f01"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"src/dshClient.test.ts","pathClass":"test-example-docs","line":120,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"2d04291d97fd28078800c461"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"src/dshClient.test.ts","pathClass":"test-example-docs","line":378,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"2d04291d97fd28078800c461"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/dshPlugin.test.ts","pathClass":"test-example-docs","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"5c74ffcc2eab502fa2c33238"},{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"high","confidence":"low","layer":"static","path":"src/imageInput.remote.test.ts","pathClass":"test-example-docs","line":12,"evidence":"Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 7, 7]); let port = 0; vi.mock('./net/network.ts', async (importOriginal) => { const real = await importOriginal<typeof ","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行；位于测试、示例或文档目录","hash":"cf82484de59a939ef852f9c0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/main.test.ts","pathClass":"test-example-docs","line":4,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8c6e1335c0ecd97930cf4e15"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/main.test.ts","pathClass":"test-example-docs","line":4,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"62c5d62b6788841ced75c1e2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/providers/availability.test.ts","pathClass":"test-example-docs","line":56,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"790c7829e02ca42c9ffcf798"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/providers/availability.ts","pathClass":"source","line":81,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4c9eaeed39dd98a32c78088b"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"src/providers/availability.ts","pathClass":"source","line":42,"evidence":"curl -fsSL https://antigravity.google/cli/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认","hash":"265bafc645ca1aa6e9512571","review":{"verdict":"placeholder","reason":"该 curl|bash 字符串只是 PROVIDER_DESCRIPTORS 中 antigravity-cli 的 install 提示文本，与其它 fix 字段一样仅用于 doctor 报告展示给用户，代码中未见 exec/spawn 该字符串。","model":"sonnet","reviewedAt":"2026-08-21T10:39:56.680Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/recoverPaste/detect.ts","pathClass":"source","line":81,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"796fee6940375d624d7dd7ff"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/spawnContract.test.ts","pathClass":"test-example-docs","line":22,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dac07598dfc3477cb0106c94"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/spawnContract.test.ts","pathClass":"test-example-docs","line":24,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"7bc4266e00bf8858a6c0a68e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/util/secretInput.pty.test.ts","pathClass":"test-example-docs","line":1,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"a7785de4a554fbce1882ec79"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/util/secretInput.pty.test.ts","pathClass":"test-example-docs","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"19e263cceea2e4c8dfa7644b"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/util/spawnHidden.ts","pathClass":"source","line":19,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f8c17ea8435dcd28c3a7d7b4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/util/spawnHidden.ts","pathClass":"source","line":24,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8db737fc76187952729b10fb"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/util/winExec.test.ts","pathClass":"test-example-docs","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"245cb42c0b1c7ebd0c5698c3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"medium","confidence":"low","layer":"static","path":"src/util/winExec.test.ts","pathClass":"test-example-docs","line":571,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"命令由运行时变量拼接，需确认输入来源是否可信；位于测试、示例或文档目录","hash":"f7e0220bf2f31eb4fcf60c01"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"vitest.globalSetup.ts","pathClass":"source","line":1,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"2cfb1e035388e37e462ef531"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"vitest.globalSetup.ts","pathClass":"source","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"920de16b6c7dee84d759e3a0"}],"counts":{"critical":0,"high":0,"medium":0,"low":13},"rawCounts":{"critical":2,"high":4,"medium":1,"low":26},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":139,"bytesScanned":1694267,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":47,"markdown":28,"data":8,"cordis":1,"source":51,"manifest":1,"yaml":1,"script":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:19:29.272Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:19:29.272Z","commit":"99eb92f0340c12cfbee84d1d97dbb7c5cc403d9c","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:17:16.104Z","commit":"aaeb5664290f8ffa701261bce3284edbaa21a5d8","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:39:56.676Z","commit":"aaeb5664290f8ffa701261bce3284edbaa21a5d8","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"99eb92f0340c12cfbee84d1d97dbb7c5cc403d9c","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:29.272Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"aaeb5664290f8ffa701261bce3284edbaa21a5d8","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:17:16.104Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"aaeb5664290f8ffa701261bce3284edbaa21a5d8","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:39:56.676Z"}]}