{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"stuarthu-dsh-crew","slug":"stuarthu-dsh-crew","rank":669,"url":"https://github.com/stuarthu/dsh-crew","name":"stuarthu/dsh-crew","category":"workflow","description":{"zh":"以角色团队的方式干活：产品经理先写 PRD 或 DoD 并等你确认，再启动架构师、工程师、QA 与各类评审；每个角色的工具集按角色锁定，彼此通过磁盘文件协作。","en":"Runs work as a crew of role agents: a product manager writes the PRD or DoD, waits for your confirmation, then starts architect, engineer, QA and reviewers whose tool sets are locked per role, and shares work through files on disk."},"stars":3,"starsCheckedAt":"2026-08-21","repository":{"owner":"stuarthu","repo":"dsh-crew","requestedRef":null,"subpath":""},"npm":"dsh-crew","downloads":1940,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-crew","tarball":null,"added":"2026-08-19","page":"https://awesome-dsh-plugin.com/p/stuarthu/dsh-crew/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"stuarthu-dsh-crew","slug":"stuarthu-dsh-crew","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:27:21.893Z","scanStatus":"static-complete","verdict":"caution","score":90,"commit":"deaeb79b2cec63f983ea9da1908008209c88e2a9","commitDate":"2026-08-22T15:48:46+08:00","artifactDigest":"sha256:2d2fe55e8e4b742e6da87718f829e29f7095bc1a81e32abcad95650b18a1b35a","downloadUrl":"https://github.com/stuarthu/dsh-crew/archive/deaeb79b2cec63f983ea9da1908008209c88e2a9.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-crew","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-crew","packageVersion":"0.9.0","bundle":{"patch":"./cordis.patch.yml"},"client":null,"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-tool-subagent"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-crew","manifestName":"dsh-crew","nameMatch":true,"npm":{"name":"dsh-crew","latestVersion":"0.7.0","publishedAt":"2026-08-21T02:15:53.718Z","createdAt":"2026-08-18T00:15:52.238Z","versionCount":15,"maintainers":1,"repository":"git+https://github.com/stuarthu/dsh-crew.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-crew-core","name":"dsh-crew/host/crew.js","path":"cordis.patch.yml","disabled":false},{"id":"dsh-crew-git-guard","name":"dsh-crew/host/git-guard.js","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"persona","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-persona","keys":["text"],"path":"preset/crew/agent.cordis.yml"},{"id":"agent-instructions","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-agent-instructions","keys":["maxBytes"],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-bash","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-bash","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-pwsh","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-pwsh","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-fs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-fs-search","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-fs-search","keys":["sampleOverCapGlobResults"],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-jobs","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-jobs","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-skill","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-skill","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-goal","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-goal","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"planning","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0"],"path":"preset/crew/agent.cordis.yml"},{"id":"compaction","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"preset/crew/agent.cordis.yml"},{"id":"delegation","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"cordis:group","keys":["0","1","2"],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-ask-user","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-ask-user","keys":[],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-todo","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-todo","keys":["allowParallelInProgress"],"path":"preset/crew/agent.cordis.yml"},{"id":"tool-web","tier":"normal","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-tool-web","keys":["fetch","searchTimeoutMs"],"path":"preset/crew/agent.cordis.yml"}],"jsExpressions":2,"clientPlatform":null,"parseErrors":[]},"capabilities":["agent-control","environment","filesystem","host-bundle","subprocess"],"outboundHosts":[],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/T-01/case-26-repo-diff-scope.mjs","pathClass":"test-example-docs","line":19,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"ac10bed70531e1dcf9a9a95a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/T-01/case-26-repo-diff-scope.mjs","pathClass":"test-example-docs","line":19,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"8358b85f8cdb893425adb83e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/T-61/case-06-repo-wide-pair-programming-sweep.mjs","pathClass":"test-example-docs","line":41,"evidence":"execFileSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f6825f3e599f35e5b6c280eb"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/T-61/case-06-repo-wide-pair-programming-sweep.mjs","pathClass":"test-example-docs","line":41,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"54329d0e373977830a6b3717"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/lib/qa.mjs","pathClass":"test-example-docs","line":13,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"41bebb8600bc4903cc2b5d03"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"docs/qa/lib/qa.mjs","pathClass":"test-example-docs","line":13,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"f90a47c1e4a6fd9e9f360aff"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"preset/crew/agent.cordis.yml","pathClass":"cordis","line":60,"evidence":"!!js process.platform === 'win32'","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"8108a0bc75f0ad46782c5f21"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"preset/crew/agent.cordis.yml","pathClass":"cordis","line":64,"evidence":"!!js process.platform !== 'win32'","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"04addc232b9ee75501170819"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":43,"evidence":"override: id=agent-instructions name=@deepseek-ai/dsh-agent-instructions config[maxBytes]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Agent 指令（agent-instructions）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"bff2f75a0055c4bda49f1734"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":58,"evidence":"override: id=tool-bash name=@deepseek-ai/dsh-tool-bash","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 Bash 工具（tool-bash）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"19773d919fd9d7e2474c7b7e"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":61,"evidence":"override: id=tool-pwsh name=@deepseek-ai/dsh-tool-pwsh","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-pwsh；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"90f86cc23d9ceaf0e078f80a"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":70,"evidence":"override: id=tool-fs name=@deepseek-ai/dsh-tool-fs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 文件工具（tool-fs）；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"44d05da11561f4c3d4589f84"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":72,"evidence":"override: id=tool-fs-search name=@deepseek-ai/dsh-tool-fs-search config[sampleOverCapGlobResults]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-fs-search；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"085e658b71563e649ca2ae63"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":87,"evidence":"override: id=tool-jobs name=@deepseek-ai/dsh-tool-jobs","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-jobs；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"573e1e0c98a335c05281a663"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":97,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"931c6fde72417f41694ab2f7"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"medium","path":"preset/crew/agent.cordis.yml","line":99,"evidence":"override: id=tool-skill name=@deepseek-ai/dsh-tool-skill","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 tool-skill；该配置随包分发但未被 dsh.bundle 引用，只有用户手动应用时才生效","layer":"dsh-semantics","pathClass":"cordis","hash":"3b8538c1c36d11181b18c28d"}],"counts":{"critical":0,"high":0,"medium":10,"low":0},"rawCounts":{"critical":0,"high":0,"medium":10,"low":6},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":368,"bytesScanned":3146421,"truncated":false,"lockfiles":[],"pathClasses":{"test-example-docs":280,"markdown":73,"cordis":2,"source":11,"manifest":1,"yaml":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:27:21.893Z","commit":"deaeb79b2cec63f983ea9da1908008209c88e2a9","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:17:10.132Z","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:31:22.618Z","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:00:23.485Z","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"commit-change","from":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","to":"deaeb79b2cec63f983ea9da1908008209c88e2a9","commit":"deaeb79b2cec63f983ea9da1908008209c88e2a9","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:27:21.893Z"},{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:17:10.132Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:31:22.618Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"87a4332293bf3f5a0720a3a90bf58cba2b1120fb","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:00:23.485Z"}]}