{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"pengpengyi92-dsh-quant","slug":"pengpengyi92-dsh-quant","rank":202,"url":"https://github.com/pengpengyi92/dsh-quant","name":"pengpengyi92/dsh-quant","category":"tools","description":{"zh":"面向 DeepSeek Harness 的量化研究工具箱，46 个工具覆盖行情、指标、因子评价、机器学习验证、风控、期权、债券与基金模拟，并提供端到端研究管线。","en":"Quantitative R&D toolkit for DeepSeek Harness — 46 tools across six domains covering market data, indicators, factor evaluation, walk-forward ML validation, risk, options, bonds and fund simulation, with an end-to-end research pipeline."},"stars":17,"starsCheckedAt":"2026-08-21","repository":{"owner":"pengpengyi92","repo":"dsh-quant","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:pengpengyi92/dsh-quant","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/pengpengyi92/dsh-quant/","screenshots":["https://raw.githubusercontent.com/pengpengyi92/dsh-quant/master/demos/ui-demo-preview.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"pengpengyi92-dsh-quant","slug":"pengpengyi92-dsh-quant","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:13.425Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"986d9fedd757e06bfab4ab9d9b0ea8930239daa2","commitDate":"2026-08-22T12:08:54+08:00","artifactDigest":"sha256:a55e6637a68a6c8574ac9f02bc50c48e862c2746fce87405e099bbd06a96781d","downloadUrl":"https://github.com/pengpengyi92/dsh-quant/archive/986d9fedd757e06bfab4ab9d9b0ea8930239daa2.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:pengpengyi92/dsh-quant","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-quant","packageVersion":"0.83.0","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-system-prompt"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-quant","nameMatch":null,"npm":{"name":"dsh-quant","latestVersion":"0.80.0","publishedAt":"2026-08-20T19:37:37.982Z","createdAt":"2026-08-16T09:54:55.742Z","versionCount":96,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"quant-indicators","name":"dsh-quant","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"api.npmjs.org","count":4},{"host":"tushare.pro","count":4},{"host":"akshare.akfamily.xyz","count":2},{"host":"baostock.com","count":2},{"host":"www.wind.com.cn","count":2},{"host":"quantapi.10jqka.com.cn","count":2},{"host":"www.sse.com.cn","count":2},{"host":"www.szse.cn","count":2},{"host":"www.csindex.com.cn","count":2},{"host":"www.chinabond.com.cn","count":2},{"host":"www.chinamoney.com.cn","count":2},{"host":"api.github.com","count":1},{"host":"www.npmjs.com","count":1},{"host":"gu.qq.com","count":1},{"host":"finance.yahoo.com","count":1},{"host":"api.binance.com","count":1},{"host":"www.okx.com","count":1},{"host":"api.bybit.com","count":1},{"host":"quotes.sina.cn","count":1},{"host":"web.ifzq.gtimg.cn","count":1},{"host":"query1.finance.yahoo.com","count":1},{"host":"finance.sina.com.cn","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"cli/tui.mjs","pathClass":"source","line":162,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"91793a04762663107c1318e1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"cli/tui.mjs","pathClass":"source","line":162,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"87e78bda2d0cc14c30fc0013"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo-standalone.html","pathClass":"test-example-docs","line":69,"evidence":"document.write(","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"8b1e5a7649b17d2942f33daa"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo-standalone.html","pathClass":"test-example-docs","line":156,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"b8582d0277fc1a23a03bc43c"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo-standalone.html","pathClass":"test-example-docs","line":66,"evidence":"<script src=\"https://unpkg.com/lightweight-charts@4.2.0/dist/lightweight-charts.standalone.production.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"来自公共 CDN unpkg.com，未固定完整性哈希；位于测试、示例或文档目录","hash":"f2d23c5426e8785fe089cfbd"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo-standalone.html","pathClass":"test-example-docs","line":69,"evidence":"<script src=\"https://cdn.jsdelivr.net/npm/lightweight-charts@4.2.0/dist/lightweight-charts.standalone.production.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"来自公共 CDN cdn.jsdelivr.net，未固定完整性哈希；位于测试、示例或文档目录","hash":"3bd7ad5aca9f4583c6644fea"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo.html","pathClass":"test-example-docs","line":69,"evidence":"document.write(","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"edfad114f8bd4bb36968b7c7"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo.html","pathClass":"test-example-docs","line":156,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"f74fc89539aa37809215e2f6"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo.html","pathClass":"test-example-docs","line":66,"evidence":"<script src=\"https://unpkg.com/lightweight-charts@4.2.0/dist/lightweight-charts.standalone.production.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"来自公共 CDN unpkg.com，未固定完整性哈希；位于测试、示例或文档目录","hash":"69d2761d3cf5584fa34e9f8e"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"medium","confidence":"low","layer":"static","path":"demos/ui-demo.html","pathClass":"test-example-docs","line":69,"evidence":"<script src=\"https://cdn.jsdelivr.net/npm/lightweight-charts@4.2.0/dist/lightweight-charts.standalone.production.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","note":"来自公共 CDN cdn.jsdelivr.net，未固定完整性哈希；位于测试、示例或文档目录","hash":"40fc51eacd7e66bd7b6c0fba"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"src/index.ts","pathClass":"source","line":1231,"evidence":"eval (","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"1b00b6d40050f731fb8de4aa"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"verify.ts","pathClass":"source","line":229,"evidence":"eval (","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"出现在字符串或注释中","hash":"ad3a5cce6db9d23a924caa4a"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/dsh-community/github.ts","pathClass":"source","line":100,"evidence":"credential access at line 100 + outbound network at line 102","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"c9b02899c4bf06ffeb5ba674","review":{"verdict":"functional","reason":"读取环境变量GITHUB_TOKEN仅用于给api.github.com请求加Authorization头以提升限额，凭据发往其自身所属的GitHub官方API，属正常认证用法。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:21:42.414Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":2},"rawCounts":{"critical":0,"high":2,"medium":9,"low":2},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":411,"bytesScanned":1448498,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"test-example-docs":41,"markdown":334,"source":29,"cordis":2,"manifest":2,"data":3}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:13.425Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:22:13.425Z","commit":"986d9fedd757e06bfab4ab9d9b0ea8930239daa2","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:42.414Z","commit":"156d94d88c3eac934f2d7d31cd2ee8625da2c477","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:49:50.997Z","commit":"156d94d88c3eac934f2d7d31cd2ee8625da2c477","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"986d9fedd757e06bfab4ab9d9b0ea8930239daa2","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:13.425Z"},{"kind":"verdict-change","from":"pass","to":"caution","commit":"156d94d88c3eac934f2d7d31cd2ee8625da2c477","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:42.414Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"156d94d88c3eac934f2d7d31cd2ee8625da2c477","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:49:50.997Z"}]}