{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"nexsjournal-dsh-vision-plugin","slug":"nexsjournal-dsh-vision-plugin","rank":1341,"url":"https://github.com/nexsjournal/dsh-vision-plugin","name":"nexsjournal/dsh-vision-plugin","category":"ui","description":{"zh":"给模型目录装上「图片输入」勾选框，自定义模型声明后可直接收图；附带可选的 BYO 视觉中继。","en":"Installs an image-input checkbox into the Models catalog so a custom model can declare image input and receive images directly; includes an optional BYO vision relay."},"stars":1,"starsCheckedAt":"2026-08-21","repository":{"owner":"nexsjournal","repo":"dsh-vision-plugin","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:nexsjournal/dsh-vision-plugin","tarball":null,"added":"2026-08-17","page":"https://awesome-dsh-plugin.com/p/nexsjournal/dsh-vision-plugin/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"nexsjournal-dsh-vision-plugin","slug":"nexsjournal-dsh-vision-plugin","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:34:05.154Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"a9c3f557500614a735217453e2dbfc6a794dff53","commitDate":"2026-08-16T22:46:11+08:00","artifactDigest":"sha256:fcde15489502e667e7f218c11bc6bc50d14e96b866196443adacf7257c571dc1","downloadUrl":"https://github.com/nexsjournal/dsh-vision-plugin/archive/a9c3f557500614a735217453e2dbfc6a794dff53.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:nexsjournal/dsh-vision-plugin","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-vision-plugin","packageVersion":"1.1.1","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-credentials","@deepseek-ai/dsh-llm","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-attachment","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-vision-plugin","nameMatch":null,"npm":{"name":"dsh-vision-plugin","latestVersion":"1.4.0","publishedAt":"2026-08-20T11:17:42.268Z","createdAt":"2026-08-14T13:03:42.433Z","versionCount":5,"maintainers":1,"repository":"git+https://github.com/Xin-Zhang-IceMan/dsh-vision-plugin.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"mismatch","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-vision-plugin","name":"dsh-vision-plugin","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[],"findings":[{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/index.js","pathClass":"source","line":260,"evidence":"credential access at line 260 + outbound network at line 112","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"0f1c67c41947334d2ed5066a","review":{"verdict":"functional","reason":"credentials.resolve在260行读取的是REF_BASE/REF_MODEL/REF_KEY等用户在row-config或凭据服务中配置的视觉中继端点凭据，用于later调用用户自定义的OpenAI兼容baseURL，属于BYO视觉中继声明功能的必要实现，未见发往第三方硬编码地址。","model":"sonnet","reviewedAt":"2026-08-22T08:34:05.154Z"}},{"id":"HT-IDENTITY-001","title":"npm 上存在同名包但指向其他仓库","severity":"low","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm repository=git+https://github.com/Xin-Zhang-IceMan/dsh-vision-plugin.git ≠ nexsjournal/dsh-vision-plugin","remediation":"npm 上存在同名包但指向其它仓库；从源码安装时请使用 github: 引用并锁定 commit。","layer":"identity","hash":"4e87a4c84560b248c6aa0a97"}],"counts":{"critical":0,"high":0,"medium":1,"low":1},"rawCounts":{"critical":0,"high":0,"medium":1,"low":1},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":4,"bytesScanned":40368,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":1,"cordis":1,"source":1,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:34:05.154Z","summary":"该插件核心功能是为模型目录添加图片输入勾选框，附带可选的BYO视觉中继（OpenAI兼容）功能。命中的凭据访问（credentials.resolve）用于解析用户在row-config/凭据服务/环境变量中配置的baseURL、model、apiKey等，目的是调用用户自己指定的视觉中继端点，属于声明功能的正常实现，未发现将凭据发往非用户配置目的地的证据。需要用户注意：该模块确实同时具备凭据读取与网络请求能力，若baseURL被恶意篡改则存在密钥泄露风险，建议关注row-config的来源可信度。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":2,"outputTokens":899,"costUsd":0.020575999999999997,"durationMs":13039}}},"timeline":[{"scannedAt":"2026-08-22T08:34:05.154Z","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:39:13.913Z","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:08:11.497Z","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:34:05.154Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:39:13.913Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"a9c3f557500614a735217453e2dbfc6a794dff53","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:08:11.497Z"}]}