{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"moguiyu-dsh-tavily","slug":"moguiyu-dsh-tavily","rank":470,"url":"https://github.com/moguiyu/dsh-tavily","name":"moguiyu/dsh-tavily","category":"browser","description":{"zh":"Tavily 多密钥搜索：支持密钥轮换/故障转移、用量仪表盘与设置卡片。","en":"Tavily search with multiple API keys, key rotation and failover, a usage gauge, and a settings card."},"stars":6,"starsCheckedAt":"2026-08-21","repository":{"owner":"moguiyu","repo":"dsh-tavily","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:moguiyu/dsh-tavily","tarball":null,"added":"2026-08-15","page":"https://awesome-dsh-plugin.com/p/moguiyu/dsh-tavily/","screenshots":["https://raw.githubusercontent.com/moguiyu/dsh-tavily/main/assets/tavily-search.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"moguiyu-dsh-tavily","slug":"moguiyu-dsh-tavily","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:25:15.650Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","commitDate":"2026-08-21T11:13:48+02:00","artifactDigest":"sha256:a9c20d4a7c0920a6a80585fda3df9c6bd15629a3e88c64034eb7d0322d43c7cc","downloadUrl":"https://github.com/moguiyu/dsh-tavily/archive/bc86dfac730c5b82f7c8e3435fb914d31a808e51.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:moguiyu/dsh-tavily","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-tavily-workspace","packageVersion":"0.1.11","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-tavily-workspace","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-tavily","name":"@moguiyu/dsh-tavily","path":"cordis.patch.yml","disabled":false},{"id":"tavily-backend","name":"@moguiyu/dsh-tavily-backend","path":"packages/dsh-tavily-backend/cordis.patch.yml","disabled":false},{"id":"dsh-tavily","name":"@moguiyu/dsh-tavily","path":"packages/dsh-tavily/cordis.patch.yml","disabled":false},{"id":"tool-tavily-search","name":"@moguiyu/dsh-tool-tavily-search","path":"packages/dsh-tool-tavily-search/cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","filesystem","host-bundle","network"],"outboundHosts":[{"host":"api.tavily.com","count":2}],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"packages/dsh-tavily-backend/src/index.js","pathClass":"source","line":139,"evidence":"credential access at line 139 + outbound network at line 91","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"1c6b50d2b74c5f95b7d7ba52","review":{"verdict":"functional","reason":"credentials.resolve(ref) 读取用户配置的 Tavily 密钥并调用 Tavily 官方用量接口（line 91），是用量仪表盘功能的必要实现，未流向第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:26:31.143Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"packages/dsh-tool-tavily-search/src/index.js","pathClass":"source","line":209,"evidence":"credential access at line 209 + outbound network at line 119","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"b5ef1be5235512d01faf6419","review":{"verdict":"functional","reason":"credentials.resolve('TAVILY_API_KEYS') 取出用户配置的多密钥用于调用 Tavily 官方搜索接口，是 tavily_search 工具密钥轮换/故障转移功能本身，未发往第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:26:31.143Z"}}],"counts":{"critical":0,"high":0,"medium":2,"low":0},"rawCounts":{"critical":0,"high":0,"medium":2,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":34,"bytesScanned":155405,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":9,"markdown":5,"cordis":4,"data":1,"manifest":4,"source":10,"yaml":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:25:15.651Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:25:15.650Z","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:26:31.143Z","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:55:21.919Z","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:25:15.650Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:26:31.143Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"bc86dfac730c5b82f7c8e3435fb914d31a808e51","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:55:21.919Z"}]}