{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"poiuyjie-dsh-vision-opencode","slug":"poiuyjie-dsh-vision-opencode","rank":237,"url":"https://github.com/poiuyjie/dsh-vision-opencode","name":"poiuyjie/dsh-vision-opencode","category":"vision","description":{"zh":"给纯文本主模型加可配置识图模型：vision_read_image 工具、输入框识图模型选择器，以及纯文本路由的图片自动转文字。","en":"Adds a configurable vision model to text-only main models: a vision_read_image tool, a composer-bar vision-model selector, and automatic image-to-text conversion for text-only routes."},"stars":13,"starsCheckedAt":"2026-08-21","repository":{"owner":"poiuyjie","repo":"dsh-vision-opencode","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:poiuyjie/dsh-vision-opencode","tarball":null,"added":"2026-08-18","page":"https://awesome-dsh-plugin.com/p/poiuyjie/dsh-vision-opencode/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"poiuyjie-dsh-vision-opencode","slug":"poiuyjie-dsh-vision-opencode","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:22:36.310Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"6d7d67a8b1c1a21679ac149a6bdbee7eae4b3b66","commitDate":"2026-08-22T01:07:02+08:00","artifactDigest":"sha256:fc32d6a01c559b751d30d17474d1fb349e0d87836e565ee3a36aac57d27e55f2","downloadUrl":"https://github.com/poiuyjie/dsh-vision-opencode/archive/6d7d67a8b1c1a21679ac149a6bdbee7eae4b3b66.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:poiuyjie/dsh-vision-opencode","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-vision-opencode","packageVersion":"0.4.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-llm","@deepseek-ai/dsh-tools","@deepseek-ai/dsh-settings","@deepseek-ai/dsh-skill","@deepseek-ai/schemastery"]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-vision-opencode","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"vision-opencode","name":"dsh-vision-opencode","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","subprocess"],"outboundHosts":[{"host":"gateway.example","count":1},{"host":"opencode.ai","count":1}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"scripts/install.sh","pathClass":"script","line":5,"evidence":"curl -fsSL https://raw.githubusercontent.com/poiuyjie/dsh-vision-opencode/main/scripts/install.sh | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"fdd90821ccf659d14a712779","review":{"verdict":"placeholder","reason":"该 curl|bash 命令仅出现在脚本头部注释的用法说明文字中，是展示给用户看的安装方式提示，脚本本身不会执行远程下载。","model":"sonnet","reviewedAt":"2026-08-22T08:22:36.310Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"index.js","pathClass":"source","line":282,"evidence":"credential access at line 282 + outbound network at line 858","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"966bb4922c6af2be8e12c898","review":{"verdict":"functional","reason":"resolveProviderKeyRef 仅解析用户在 visionModels 配置中自建渠道对应的凭据 ref（deriveKeyRef 由用户配置的 provider 名派生），用于向用户自己配置的 baseUrl 发起识图模型调用，属于插件声明功能本身。","model":"sonnet","reviewedAt":"2026-08-22T08:22:36.310Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":1,"high":0,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":15,"bytesScanned":282265,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":1,"markdown":2,"source":4,"cordis":1,"manifest":1,"script":6}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:22:36.310Z","summary":"插件为纯文本主模型提供可配置识图能力，README/install.sh 中的 curl|bash 只是安装方式的文档说明而非自动执行代码；index.js 中的凭据解析仅面向用户自行配置的 vision 模型供应商及其 baseUrl，凭据不会流向未经用户配置的第三方，整体代码行为与描述一致，需用户注意的是安装脚本会写入/修改 dsh 的 settings.yaml 与图片提交闸门配置，建议核实其写入范围。","intentMatch":"consistent","findingsReviewed":2,"findingsCandidates":2,"fromCache":0,"usage":{"inputTokens":2,"outputTokens":950,"costUsd":0.027234,"durationMs":13548}}},"timeline":[{"scannedAt":"2026-08-22T08:22:36.310Z","commit":"6d7d67a8b1c1a21679ac149a6bdbee7eae4b3b66","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:22:22.603Z","commit":"a4ba066b24083073d5158e85ce3604a0455297cd","policyVersion":"HT-DSH-0.2.1","verdict":"blocked","status":"static-complete"},{"scannedAt":"2026-08-21T10:50:55.736Z","commit":"a4ba066b24083073d5158e85ce3604a0455297cd","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"blocked","to":"caution","commit":"6d7d67a8b1c1a21679ac149a6bdbee7eae4b3b66","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:22:36.310Z"},{"kind":"verdict-change","from":"review","to":"blocked","commit":"a4ba066b24083073d5158e85ce3604a0455297cd","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:22:22.603Z"},{"kind":"first-scan","from":null,"to":"review","commit":"a4ba066b24083073d5158e85ce3604a0455297cd","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:50:55.736Z"}]}