{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"liustack-modsearch","slug":"liustack-modsearch","rank":42,"url":"https://github.com/liustack/modsearch","name":"liustack/modsearch","category":"browser","description":{"zh":"纯文本 agent 的联网搜索桥：搜索网页与 X，返回结构化 JSON 证据（search/fetch/引用）。","en":"Web search bridge for text-only agents: ask the web or X, get structured JSON evidence (search, fetch, citations)."},"stars":211,"starsCheckedAt":"2026-08-21","repository":{"owner":"liustack","repo":"modsearch","requestedRef":null,"subpath":""},"npm":"@liustack/modsearch","downloads":10219,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add @liustack/modsearch","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/liustack/modsearch/","screenshots":["https://raw.githubusercontent.com/liustack/modsearch/main/assets/demo-dsh-settings-card.jpg","https://raw.githubusercontent.com/liustack/modsearch/main/assets/demo-codex-search.png","https://raw.githubusercontent.com/liustack/modsearch/main/assets/demo-codex-fetch.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"liustack-modsearch","slug":"liustack-modsearch","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:01.126Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"83cbfb6f431b3c1779073463b42a94c7168e5eaa","commitDate":"2026-08-22T16:11:26+08:00","artifactDigest":"sha256:3933df59d97af0ffb17885da5a1028d4ec6612be1811d9128ac49843c7bb20c4","downloadUrl":"https://github.com/liustack/modsearch/archive/83cbfb6f431b3c1779073463b42a94c7168e5eaa.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add @liustack/modsearch","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@liustack/modsearch","packageVersion":"5.9.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":[],"platform":"web","immediately":true},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"@liustack/modsearch","manifestName":"@liustack/modsearch","nameMatch":true,"npm":{"name":"@liustack/modsearch","latestVersion":"5.8.0","publishedAt":"2026-08-20T19:10:22.664Z","createdAt":"2026-02-22T08:23:12.840Z","versionCount":39,"maintainers":1,"repository":"git+https://github.com/liustack/modsearch.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"modsearch","name":"@liustack/modsearch","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["searchProvider"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[{"host":"bun.sh","count":4},{"host":"api.example.com","count":3},{"host":"exa.ai","count":2},{"host":"app.tavily.com","count":2},{"host":"play.tailwindcss.com","count":1},{"host":"antigravity.google","count":1},{"host":"x.ai","count":1},{"host":"docs.exa.ai","count":1},{"host":"api.exa.ai","count":1},{"host":"docs.firecrawl.dev","count":1},{"host":"api.firecrawl.dev","count":1},{"host":"firecrawl.dev","count":1},{"host":"docs.tavily.com","count":1},{"host":"api.tavily.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh/spawnHidden.d.ts","pathClass":"source","line":1,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d799c371780e33c1ffc62333"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"dsh/spawnHidden.js","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"824c0489d9ba65dc3b6ef161"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"evals/run.mjs","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1f9f7e3d4803abcbd0f73ca8"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":16,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1de4276ac06c727a5b6b2ab2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/release.mjs","pathClass":"source","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"f735a4f41f7179ccfa16f964"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"src/doctor.ts","pathClass":"source","line":118,"evidence":"curl -fsSL https://antigravity.google/cli/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认","hash":"9a2c4e790e993156a6a71851","review":{"verdict":"placeholder","reason":"INSTALL_AGY 是 doctor.ts 诊断模块中的字符串常量，仅作为未安装 antigravity-cli 时展示给用户的安装建议文本，未见任何 exec/spawn 调用它。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:32.265Z"}},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"src/doctor.ts","pathClass":"source","line":119,"evidence":"curl -fsSL https://x.ai/cli/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"命令位于字符串字面量中，执行路径需人工确认","hash":"622a3b479bb3307737e5aeb1","review":{"verdict":"placeholder","reason":"INSTALL_GROK 同样是字符串常量，用于 diagnoseEngine 生成的 reason/note 提示文本，供用户阅读后自行执行，代码本身不调用 shell 执行该命令。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:32.265Z"}},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"src/dshClient.test.ts","pathClass":"test-example-docs","line":59,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"2d04291d97fd28078800c461"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/spawnContract.test.ts","pathClass":"test-example-docs","line":6,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dac07598dfc3477cb0106c94"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"src/spawnContract.test.ts","pathClass":"test-example-docs","line":10,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dac07598dfc3477cb0106c94"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/util/spawnHidden.ts","pathClass":"source","line":13,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8db737fc76187952729b10fb"}],"counts":{"critical":0,"high":0,"medium":0,"low":6},"rawCounts":{"critical":2,"high":1,"medium":0,"low":8},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":113,"bytesScanned":902256,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":32,"markdown":29,"data":4,"cordis":1,"source":43,"manifest":1,"yaml":1,"script":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:01.126Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:20:01.126Z","commit":"83cbfb6f431b3c1779073463b42a94c7168e5eaa","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:32.265Z","commit":"05ee10dbc9c99508914e42616ba16790fd642031","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:20.660Z","commit":"05ee10dbc9c99508914e42616ba16790fd642031","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"83cbfb6f431b3c1779073463b42a94c7168e5eaa","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:01.126Z"},{"kind":"verdict-change","from":"review","to":"pass","commit":"05ee10dbc9c99508914e42616ba16790fd642031","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:32.265Z"},{"kind":"first-scan","from":null,"to":"review","commit":"05ee10dbc9c99508914e42616ba16790fd642031","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:20.660Z"}]}