{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"pensivefei-deep-read-summarize","slug":"pensivefei-deep-read-summarize","rank":187,"url":"https://github.com/PensiveFei/deep-read-summarize","name":"PensiveFei/deep-read-summarize","category":"workflow","description":{"zh":"DSH 精读与摘要：书籍/论文/视频/网页经可插拔解析器转成结构化 Obsidian 笔记，MapReduce 并行精读子代理、JSON Schema 输出与幂等缓存。","en":"Deep reading & summarization for DSH: books/papers/videos/web into structured Obsidian notes via plugin parsers, MapReduce parallel deep-read subagents, JSON Schema outputs and an idempotent cache."},"stars":19,"starsCheckedAt":"2026-08-21","repository":{"owner":"PensiveFei","repo":"deep-read-summarize","requestedRef":null,"subpath":""},"npm":"deep-read-summarize","downloads":0,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add deep-read-summarize","tarball":null,"added":"2026-08-21","page":"https://awesome-dsh-plugin.com/p/PensiveFei/deep-read-summarize/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"pensivefei-deep-read-summarize","slug":"pensivefei-deep-read-summarize","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:58.523Z","scanStatus":"static-complete","verdict":"caution","score":94,"commit":"243f2cdd92dd84e1a59faf6b132ae4e0ef6bd6c5","commitDate":"2026-08-22T00:10:01+08:00","artifactDigest":"sha256:5c08693cc23603786d7d440f9983b26056743888891e3d3596184142bc503acb","downloadUrl":"https://github.com/PensiveFei/deep-read-summarize/archive/243f2cdd92dd84e1a59faf6b132ae4e0ef6bd6c5.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add deep-read-summarize","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"deep-read-summarize","packageVersion":"0.3.1","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"npm-missing","installMode":"npm","upstreamNpm":"deep-read-summarize","manifestName":"deep-read-summarize","nameMatch":true,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"deep-read-summarize","name":"deep-read-summarize","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["filesystem","host-bundle","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/lint.js","pathClass":"source","line":3,"evidence":"execSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"7a94b401df3eb49774144080"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/lint.js","pathClass":"source","line":3,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"8737a5850b51a9dc06d9880b"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/index.test.js","pathClass":"test-example-docs","line":48,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"8df9bb55c3c93ddbe1cc380c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/quick_validate.js","pathClass":"test-example-docs","line":2,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f3fe694f8016e9b88e11b8bc"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/run-tests.js","pathClass":"test-example-docs","line":65,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"444aa753a65b7f68816d7f4f"},{"id":"HT-IDENTITY-003","title":"上游标注的 npm 包在 registry 中不存在","severity":"medium","confidence":"medium","path":"package.json","pathClass":"manifest","line":1,"evidence":"npm view deep-read-summarize → 404","remediation":"包可能已被撤下或改名；安装命令会失败或落到同名占位包。","layer":"identity","hash":"ec789e82d154ba6b44f45894"}],"counts":{"critical":0,"high":0,"medium":1,"low":2},"rawCounts":{"critical":0,"high":2,"medium":1,"low":3},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":29,"bytesScanned":73746,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":8,"markdown":7,"cordis":1,"source":12,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:21:58.523Z","commit":"243f2cdd92dd84e1a59faf6b132ae4e0ef6bd6c5","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:21:18.282Z","commit":"491a7cb0f5ec9e43d4134b7824081b6e172d882c","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:49:18.249Z","commit":"491a7cb0f5ec9e43d4134b7824081b6e172d882c","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"pass","to":"caution","commit":"243f2cdd92dd84e1a59faf6b132ae4e0ef6bd6c5","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:58.523Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"491a7cb0f5ec9e43d4134b7824081b6e172d882c","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:21:18.282Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"491a7cb0f5ec9e43d4134b7824081b6e172d882c","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:49:18.249Z"}]}