{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"summersec-sumsec-skills","slug":"summersec-sumsec-skills","rank":410,"url":"https://github.com/SummerSec/SumSec-Skills","name":"SummerSec/SumSec-Skills","category":"skill","description":{"zh":"多平台 Agent Skills 集合，作为 DeepSeek Harness profile bundle 挂载，提供中文写作、Git、插件开发、Taste 与语义边界检测等 Skill。","en":"Multi-platform Agent Skills monorepo that mounts as a DeepSeek Harness profile bundle, exposing Chinese writing, Git, plugin-dev, taste, and semantic-linter skills."},"stars":7,"starsCheckedAt":"2026-08-21","repository":{"owner":"SummerSec","repo":"SumSec-Skills","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:SummerSec/SumSec-Skills","tarball":null,"added":"2026-08-16","page":"https://awesome-dsh-plugin.com/p/SummerSec/SumSec-Skills/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"summersec-sumsec-skills","slug":"summersec-sumsec-skills","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-21T13:16:50.774Z","scanStatus":"static-complete","verdict":"review","score":68,"commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","commitDate":"2026-08-15T14:30:46+08:00","artifactDigest":"sha256:526a7c22142e92247e593f67c0a9eca4f2a3c9385e56859a67f47d82249b644a","downloadUrl":"https://github.com/SummerSec/SumSec-Skills/archive/7f646f33bfe579e6234d3ca3c18797598e42ae21.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:SummerSec/SumSec-Skills","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"sumsec-skills","packageVersion":"1.0.45","bundle":{"patch":"./dsh/cordis.patch.yml"},"client":null,"lifecycleScripts":{"postinstall":"python .claude/skills/sync-skills/scripts/sync-skills.py"},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"sumsec-skills","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"dsh/cordis.patch.yml","inserts":[],"overrides":[{"id":"skill-filesystem","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":true,"name":"@deepseek-ai/dsh-skill-filesystem","keys":["providerName","includeDefaultRoots","customSkillDirs"],"path":"dsh/cordis.patch.yml"}],"jsExpressions":9,"clientPlatform":null,"parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","mcp","network","subprocess"],"outboundHosts":[{"host":"fonts.googleapis.com","count":2},{"host":"fonts.gstatic.com","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".claude/skills/sync-skills/scripts/pre-commit-hook.py","pathClass":"source","line":35,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5622fa30549a396ef20437f2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".claude/skills/sync-skills/scripts/pre-commit-hook.py","pathClass":"source","line":43,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5622fa30549a396ef20437f2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".claude/skills/sync-skills/scripts/session-start-check.py","pathClass":"source","line":29,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"55fb1b0dac85a3917545e80e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".claude/skills/sync-skills/scripts/sync-skills.py","pathClass":"source","line":334,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bf782acc7dcbaf43ae86a5e7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":".claude/skills/sync-skills/scripts/sync-skills.py","pathClass":"source","line":403,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"bf782acc7dcbaf43ae86a5e7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"agents-dev/skills/claude-agents-symlink/scripts/ensure_claude_symlink.py","pathClass":"source","line":127,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"33cbe0d802ffaf9c4efd9673"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"agents-dev/skills/skill-creator/assets/eval_review.html","pathClass":"test-example-docs","line":69,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0d9955331b4f11d294117207"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"agents-dev/skills/skill-creator/assets/eval_review.html","pathClass":"test-example-docs","line":82,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"0d9955331b4f11d294117207"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"agents-dev/skills/skill-creator/eval-viewer/generate_review.py","pathClass":"source","line":291,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a2a50f764a86e44e42227a13"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"agents-dev/skills/skill-creator/eval-viewer/viewer.html","pathClass":"html","line":766,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"6d039cc28e9e061058d55745"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"agents-dev/skills/skill-creator/eval-viewer/viewer.html","pathClass":"html","line":770,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"6d039cc28e9e061058d55745"},{"id":"HT-CLIENT-002","title":"从第三方地址加载浏览器脚本","severity":"high","confidence":"low","layer":"static","path":"agents-dev/skills/skill-creator/eval-viewer/viewer.html","pathClass":"html","line":10,"evidence":"<script src=\"https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js","remediation":"固定并随插件分发客户端依赖，或使用带 integrity 校验的受信任来源。","hash":"50f8e229819a6a0745d24bac","review":{"verdict":"sanitized","reason":"引入cdn.sheetjs.com的xlsx.full.min.js时带有SRI的integrity哈希与crossorigin属性，浏览器会校验脚本内容与哈希一致，篡改会被阻止，且仅用于本地eval-viewer展示表格。","model":"sonnet","reviewedAt":"2026-08-21T10:53:59.173Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"agents-dev/skills/skill-creator/scripts/improve_description.py","pathClass":"source","line":35,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"dda8f6f5d354e2d2d5edcbe1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"agents-dev/skills/skill-creator/scripts/run_eval.py","pathClass":"source","line":85,"evidence":"subprocess.Popen","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e6d47ef7e9f0ebd9c882860c"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"dsh/cordis.patch.yml","pathClass":"cordis","line":11,"evidence":"!!js \"process.getBuiltinModule('node:url').fileURLToPath(new URL('../writing-zh/skills/', baseUrl))\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"6bdd356641e28fa23a3b5943"},{"id":"HT-CONFIG-001","title":"Cordis 配置包含可执行 !!js 表达式","severity":"medium","confidence":"high","layer":"dsh-semantics","path":"dsh/cordis.patch.yml","pathClass":"cordis","line":12,"evidence":"!!js \"process.getBuiltinModule('node:url').fileURLToPath(new URL('../dev-tools/skills/', baseUrl))\"","remediation":"!!js 是 DSH 的官方配置机制；只在表达式引入模块、访问进程或网络时需要额外解释。","note":"表达式访问模块、进程或网络，超出读取注入服务的常规用法","hash":"66a7a65be69108ffcf56ee41"},{"id":"HT-INSTALL-001","title":"安装阶段执行高风险生命周期脚本","severity":"high","confidence":"high","layer":"supply-chain","path":"package.json","pathClass":"manifest","line":27,"evidence":"\"postinstall\": \"python .claude/skills/sync-skills/scripts/sync-skills.py\"","remediation":"移除安装期执行，或提供可复现构建产物并将脚本降为显式命令。","hash":"48592fc7cd7b31e46cd6b187","review":{"verdict":"unclear","reason":"postinstall 调用的 .claude/skills/sync-skills/scripts/sync-skills.py 与 sync/sync:dry/sync:clean 脚本同源，命名和上下文均指向本地多平台 Skill 目录同步，但未提供该 Python 脚本的实际内容，无法确认是否仅做本地文件操作而无外联/写入敏感路径行为。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:25:25.230Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"writing-zh/skills/humanizer-zh/scripts/compare_cn.py","pathClass":"source","line":23,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b837d2f152285fba20d286cd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"writing-zh/skills/humanizer-zh/scripts/compare_cn.py","pathClass":"source","line":43,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b837d2f152285fba20d286cd"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"writing-zh/skills/humanizer-zh/scripts/humanize_cn.py","pathClass":"source","line":1042,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ddf9566800d0014dc21d5355"},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"high","path":"dsh/cordis.patch.yml","line":5,"evidence":"override: id=skill-filesystem name=@deepseek-ai/dsh-skill-filesystem config[providerName,includeDefaultRoots,customSkillDirs]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"替换实现 skill-filesystem","layer":"dsh-semantics","pathClass":"cordis","hash":"d94e38684216917322d04dc3"}],"counts":{"critical":0,"high":1,"medium":5,"low":12},"rawCounts":{"critical":0,"high":2,"medium":7,"low":12},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":285,"bytesScanned":2190020,"truncated":false,"lockfiles":[],"pathClasses":{"data":39,"markdown":156,"source":56,"yaml":2,"test-example-docs":21,"html":1,"cordis":1,"manifest":3,"script":6}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-21T13:16:50.774Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-21T13:16:50.774Z","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:25:25.229Z","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:53:59.173Z","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:50.774Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:25:25.229Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"7f646f33bfe579e6234d3ca3c18797598e42ae21","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:53:59.173Z"}]}