{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"senmuuuuw-dsh-whale-report","slug":"senmuuuuw-dsh-whale-report","rank":156,"url":"https://github.com/SenmuuuuW/dsh-whale-report","name":"SenmuuuuW/dsh-whale-report","category":"usage","description":{"zh":"深迹 DeepTrace — 从会话日志生成日报/周报/月报/年报/自定义区间报告：成本与 Token 拆解、8 条确定性洞察、协作复盘、实时模型余额、PDF/PNG/HTML 导出；只读，绝不改写历史。","en":"DeepTrace — deterministic agent reports from session logs (daily/weekly/monthly/yearly/custom): cost & token breakdown, 8 insight rules, collaboration review, live provider balance, PDF/PNG/HTML export; read-only, never rewrites history."},"stars":25,"starsCheckedAt":"2026-08-21","repository":{"owner":"SenmuuuuW","repo":"dsh-whale-report","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:SenmuuuuW/dsh-whale-report","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/SenmuuuuW/dsh-whale-report/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"senmuuuuw-dsh-whale-report","slug":"senmuuuuw-dsh-whale-report","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:34.919Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","commitDate":"2026-08-20T21:36:34+08:00","artifactDigest":"sha256:7c8f7d584c85417a62b708bed4fd0ed89dd256bdf9dc28ce0ee6d9b3548bd5cc","downloadUrl":"https://github.com/SenmuuuuW/dsh-whale-report/archive/5fccde44b1e06f927c651ed6418ffd28ea638132.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:SenmuuuuW/dsh-whale-report","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-whale-report","packageVersion":"0.4.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"inject":[],"platform":"web"},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/cordis","@deepseek-ai/dsh-session","@deepseek-ai/dsh-session-query","@deepseek-ai/dsh-storage","@deepseek-ai/dsh-storage-domain","@deepseek-ai/dsh-tools","@deepseek-ai/schemastery"]},"identity":{"status":"found","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-whale-report","nameMatch":null,"npm":{"name":"dsh-whale-report","latestVersion":"0.4.0","publishedAt":"2026-08-20T05:56:48.311Z","createdAt":"2026-08-20T05:56:47.999Z","versionCount":1,"maintainers":1,"repository":null,"hasInstallScripts":false,"deprecated":false},"repositoryMatch":"missing","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"whale-report-core","name":"dsh-whale-report","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"dsh.internal","count":12},{"host":"api-docs.deepseek.com","count":3},{"host":"api.deepseek.com","count":2}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"lib/stats.js","pathClass":"source","line":252,"evidence":"curl|sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行","hash":"770a576f01449e6a8351842d"},{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"critical","confidence":"low","layer":"static","path":"src/stats.ts","pathClass":"source","line":482,"evidence":"curl|sh","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","note":"更像是展示给用户的安装提示字符串，而非程序自行执行","hash":"f079a9fef759067be5b3dcdf"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"lib/balance.js","pathClass":"source","line":112,"evidence":"credential access at line 112 + outbound network at line 120","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"cb990532bff6c10e0a4f754f","review":{"verdict":"functional","reason":"readKey() 读取用户本地 DEEPSEEK_API_KEY 后通过 Bearer 头发往 DEEPSEEK_BALANCE_URL（DeepSeek 官方余额接口），是插件声称的“实时模型余额”功能的必要实现。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:57.077Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"src/balance.ts","pathClass":"source","line":131,"evidence":"credential access at line 131 + outbound network at line 139","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"7fbc98e42d088aabee269733","review":{"verdict":"functional","reason":"与编译产物 lib/balance.js 相同逻辑的 TS 源码，凭据仅用于向 DeepSeek 官方余额端点发起请求，属于余额查询功能本身，非泄露至第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:20:57.077Z"}}],"counts":{"critical":0,"high":0,"medium":2,"low":0},"rawCounts":{"critical":2,"high":0,"medium":2,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":88,"bytesScanned":1632330,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":15,"markdown":5,"cordis":1,"source":63,"manifest":1,"yaml":1,"data":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:21:34.919Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:21:34.919Z","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:57.077Z","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:57.784Z","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:34.919Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:57.077Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"5fccde44b1e06f927c651ed6418ffd28ea638132","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:57.784Z"}]}