{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"nagi-ovo-dsh-ads","slug":"nagi-ovo-dsh-ads","rank":24,"url":"https://github.com/Nagi-ovo/dsh-ads","name":"Nagi-ovo/dsh-ads","category":"fun","description":{"zh":"2005 年中文站点风格的整活广告插件：侧栏广告/信息流/角落弹窗 + 假关闭叉，素材全虚构。","en":"Parody ads in 2005-Chinese-web style: sidebar banners, in-chat feeds, corner popups, and a close button whose hit area is smaller than it looks. All fictional."},"stars":529,"starsCheckedAt":"2026-08-21","repository":{"owner":"Nagi-ovo","repo":"dsh-ads","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:Nagi-ovo/dsh-ads","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/Nagi-ovo/dsh-ads/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"nagi-ovo-dsh-ads","slug":"nagi-ovo-dsh-ads","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:54.873Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","commitDate":"2026-08-18T02:28:44+01:00","artifactDigest":"sha256:f5a5599f728d4990eb3c567b998517914bd221cfc1efd4d5235294e7cd2a346e","downloadUrl":"https://github.com/Nagi-ovo/dsh-ads/archive/3a2ba704bc383099c686d3288ff6e0d61fc391e5.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:Nagi-ovo/dsh-ads","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@dsh-external/dsh-ads","packageVersion":"0.1.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":["@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-locale"],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-client-locale","@deepseek-ai/schemastery"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"@dsh-external/dsh-ads","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-ads","name":"@dsh-external/dsh-ads","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","mcp","network","subprocess","telemetry"],"outboundHosts":[{"host":"api.github.com","count":5}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"89dedaa9e6429e9e52b8af60"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-assets.mjs","pathClass":"source","line":16,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1c70a51ea87319903a202fcf"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-assets.mjs","pathClass":"source","line":16,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"80d64b93e1533683c3c041c1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-catalog.mjs","pathClass":"source","line":8,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a929ce8a77aaa09d1a51ab37"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-catalog.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ca6eb20da61ea112914dedaa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-contrib.mjs","pathClass":"source","line":12,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"0d6752fc652df4ffe63fb18d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-contrib.mjs","pathClass":"source","line":12,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"97fe9555cc2f9c13a066ec55"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-english-artwork.mjs","pathClass":"source","line":13,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5143b0381d1868870d42935e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-english-artwork.mjs","pathClass":"source","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"082b1e2e20ab0b2b39b0eef3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/catalog.ts","pathClass":"source","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bff2eea4d05dcb23ab3f49cc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/star-host.ts","pathClass":"source","line":15,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4498969d81a499e4ec3b6289"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"tests/client.spec.tsx","pathClass":"test-example-docs","line":55,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"9ba90cbcbdfe7f47a5c9ec79"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"tests/reward-gate.spec.tsx","pathClass":"test-example-docs","line":109,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"155f73799abb819b3c677bcb"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":1805,"evidence":"credential access at line 1805 + outbound network at line 1779","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"c945a77d22d91331a2107512","review":{"verdict":"functional","reason":"GITHUB_TOKEN仅作为Bearer头发送给官方api.github.com用于构建广告/插件目录列表，未外泄至第三方，属于目录发现功能的必要实现。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:02.298Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/catalog.ts","pathClass":"source","line":202,"evidence":"credential access at line 202 + outbound network at line 174","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"1219a20473291f1481717753","review":{"verdict":"functional","reason":"与lib/index.js同源TS代码，token仅用于向api.github.com搜索仓库以生成赞助/插件轮播列表，目的地正确且为功能所需。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:02.298Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/star-host.ts","pathClass":"source","line":92,"evidence":"credential access at line 92 + outbound network at line 73","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"4649147f43c0856f7b292bd1","review":{"verdict":"functional","reason":"checkHostStarred优先用gh CLI，失败才用env中的GITHUB_TOKEN请求api.github.com/user/starred校验是否已star仓库，用于整活式\"求star\"功能，token未外传第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:02.298Z"}}],"counts":{"critical":0,"high":0,"medium":3,"low":11},"rawCounts":{"critical":0,"high":0,"medium":5,"low":11},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":72,"bytesScanned":729703,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":4,"data":3,"cordis":1,"source":45,"manifest":1,"yaml":2,"test-example-docs":16}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:19:54.873Z","summary":null,"intentMatch":null,"findingsReviewed":3,"findingsCandidates":3,"fromCache":3,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:19:54.873Z","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:02.298Z","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:41:02.583Z","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:54.873Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:02.298Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"3a2ba704bc383099c686d3288ff6e0d61fc391e5","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:41:02.583Z"}]}