{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"omdsh-dev-dsh-security-audit","slug":"omdsh-dev-dsh-security-audit","rank":236,"url":"https://github.com/omdsh-dev/dsh-security-audit","name":"omdsh-dev/dsh-security-audit","category":"security","description":{"zh":"本机安全审计：配置/插件来源/会话/网络暴露面，只读脱敏风险报告。","en":"Local security audit: config, plugin origins, sessions, network exposure — read-only redacted risk report."},"stars":13,"starsCheckedAt":"2026-08-21","repository":{"owner":"omdsh-dev","repo":"dsh-security-audit","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:omdsh-dev/dsh-security-audit","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/omdsh-dev/dsh-security-audit/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"omdsh-dev-dsh-security-audit","slug":"omdsh-dev-dsh-security-audit","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:35.980Z","scanStatus":"static-complete","verdict":"pass","score":99,"commit":"ae927be8c92e483a8c8739b32831c0a237c0ed01","commitDate":"2026-08-21T19:59:53+08:00","artifactDigest":"sha256:67f764162e284f4a7169061e249bdf53bef97be24e0d6dba3792a8e16f33e12c","downloadUrl":"https://github.com/omdsh-dev/dsh-security-audit/archive/ae927be8c92e483a8c8739b32831c0a237c0ed01.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:omdsh-dev/dsh-security-audit","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"@deepseek-ai/dsh-security-audit","packageVersion":"0.0.1","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-invariants","@deepseek-ai/dsh-tools"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"@deepseek-ai/dsh-security-audit","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"security-audit","name":"@deepseek-ai/dsh-security-audit","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","credentials","environment","filesystem","host-bundle","network","subprocess","telemetry"],"outboundHosts":[],"findings":[{"id":"HT-INSTALL-001","title":"安装阶段执行高风险生命周期脚本","severity":"high","confidence":"low","layer":"supply-chain","path":"fixtures/plugins/dsh-tool-eval-fixture/package.json","pathClass":"test-example-docs","line":9,"evidence":"\"postinstall\": \"node scripts/install.js\"","remediation":"移除安装期执行，或提供可复现构建产物并将脚本降为显式命令。","note":"位于测试、示例或文档目录","hash":"5e38f64c9f1f7e808b1c42e4"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"fixtures/plugins/dsh-tool-eval-fixture/src/index.js","pathClass":"test-example-docs","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"dd5201221de57122d1f2f0a3"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"fixtures/plugins/dsh-tool-eval-fixture/src/index.js","pathClass":"test-example-docs","line":7,"evidence":"eval(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"aae0f9c0d37e31c9fef1d4b1"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"fixtures/risky-home/credentials.yaml","pathClass":"test-example-docs","line":2,"evidence":"sk-live-fake-not-a-real-key-fedcba9876543210","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"ee7e1f0e35eb722ca8a96a56"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/plugins/source-capabilities.js","pathClass":"source","line":13,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4c1c12ecccdd4d9fd1456e50"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/plugins/source-capabilities.js","pathClass":"source","line":110,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4c1c12ecccdd4d9fd1456e50"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/rules.js","pathClass":"source","line":24,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"d7801c8b34d805e527d6f57c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/plugins/source-capabilities.ts","pathClass":"source","line":22,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"35205e084c67a28fd4a2b8fa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/plugins/source-capabilities.ts","pathClass":"source","line":127,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"35205e084c67a28fd4a2b8fa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"src/rules.ts","pathClass":"source","line":38,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"87d326e3c6457a4ef11b3cf2"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"tests/config.spec.ts","pathClass":"test-example-docs","line":138,"evidence":"sk-live-fake-not-a-real-key-0123456789abcdef","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"0e3333f2c42207d1407dbd7c"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"tests/redact.spec.ts","pathClass":"test-example-docs","line":20,"evidence":"sk-live-fake-not-a-real-key-0123456789abcdef","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"包含占位/示例词汇；位于测试、示例或文档目录","hash":"3af310161aa3ddaaa826583f"},{"id":"HT-SECRET-001","title":"疑似硬编码凭据","severity":"critical","confidence":"low","layer":"static","path":"tests/redact.spec.ts","pathClass":"test-example-docs","line":29,"evidence":"-----BEGIN RSA PRIVATE KEY-----","remediation":"立即吊销凭据，并改用 DSH credentials 服务或环境引用。","note":"位于测试、示例或文档目录","hash":"0cf9782e33d863936ffa04df"}],"counts":{"critical":0,"high":0,"medium":0,"low":6},"rawCounts":{"critical":4,"high":2,"medium":0,"low":7},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":98,"bytesScanned":438563,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":2,"cordis":1,"test-example-docs":23,"source":69,"data":2,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:22:35.980Z","commit":"ae927be8c92e483a8c8739b32831c0a237c0ed01","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:09.271Z","commit":"bcf475cf753893bd06f3bfae4cf18f3e136a321b","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:32.372Z","commit":"bcf475cf753893bd06f3bfae4cf18f3e136a321b","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"ae927be8c92e483a8c8739b32831c0a237c0ed01","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:35.980Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"bcf475cf753893bd06f3bfae4cf18f3e136a321b","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:09.271Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"bcf475cf753893bd06f3bfae4cf18f3e136a321b","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:32.372Z"}]}