{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"loserfox-telegram","slug":"loserfox-telegram","rank":404,"url":"https://github.com/LoserFox/telegram","name":"LoserFox/telegram","category":"notify","description":{"zh":"Telegram Bot API 桥接：长轮询、per-chat 会话、HTML 格式化。","en":"Bridge to the Telegram Bot API: long polling, per-chat sessions, HTML formatting."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"LoserFox","repo":"telegram","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:LoserFox/telegram","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/LoserFox/telegram/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"loserfox-telegram","slug":"loserfox-telegram","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:24:34.751Z","scanStatus":"static-complete","verdict":"pass","score":100,"commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","commitDate":"2026-08-13T21:11:31+08:00","artifactDigest":"sha256:4b279af3fae8c92df89a17f16b6573e8af067c324fd8f1f232443802c380849d","downloadUrl":"https://github.com/LoserFox/telegram/archive/a0a9ca11e427b62217250e2e561f6ad3c49d13f2.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:LoserFox/telegram","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@loserfox/telegram","packageVersion":"0.1.0","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-agent","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-session","@deepseek-ai/cordis","@deepseek-ai/schemastery"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"@loserfox/telegram","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"telegram","name":"@loserfox/telegram","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","session"],"outboundHosts":[{"host":"api.telegram.org","count":2}],"findings":[{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"low","layer":"dsh-semantics","path":"examples/telegram-agent/cordis.yml","pathClass":"test-example-docs","line":17,"evidence":"!!js process.env.DSH_TELEGRAM_TOKEN","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法；位于测试、示例或文档目录","hash":"82041dbb287b4ab6c1a93292"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"low","layer":"dsh-semantics","path":"examples/telegram-agent/cordis.yml","pathClass":"test-example-docs","line":20,"evidence":"!!js \"process.env.DSH_TELEGRAM_ALLOWED_USER_IDS === undefined ? [] : process.env.DSH_TELEGRAM_ALLOWED_USER_IDS.split(',').map(Number)\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法；位于测试、示例或文档目录","hash":"3f7f84cc05cbb994ca71214b"}],"counts":{"critical":0,"high":0,"medium":0,"low":0},"rawCounts":{"critical":0,"high":0,"medium":2,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":27,"bytesScanned":102718,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":1,"cordis":1,"test-example-docs":9,"source":13,"manifest":1,"script":1,"data":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:24:34.751Z","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:25:11.880Z","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:53:46.657Z","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:24:34.751Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:25:11.880Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"a0a9ca11e427b62217250e2e561f6ad3c49d13f2","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:53:46.657Z"}]}