{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"sutera-diffusus-dsh-whale-musume","slug":"sutera-diffusus-dsh-whale-musume","rank":139,"url":"https://github.com/Sutera-Diffusus/dsh-whale-musume","name":"Sutera-Diffusus/dsh-whale-musume","category":"fun","description":{"zh":"元气鲸鱼娘桌宠：摸头养成、工作状态联动、494 条台词与 30 项成就，自带设置面板，全本地零遥测。","en":"A cute whale-girl desktop pet for the DeepSeek Harness Web UI: pat-to-raise growth, live work-state poses, 494 dialogue lines, 30 achievements and a built-in settings panel — all local, zero telemetry."},"stars":30,"starsCheckedAt":"2026-08-21","repository":{"owner":"Sutera-Diffusus","repo":"dsh-whale-musume","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:Sutera-Diffusus/dsh-whale-musume","tarball":null,"added":"2026-08-18","page":"https://awesome-dsh-plugin.com/p/Sutera-Diffusus/dsh-whale-musume/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"sutera-diffusus-dsh-whale-musume","slug":"sutera-diffusus-dsh-whale-musume","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:21:22.031Z","scanStatus":"static-complete","verdict":"pass","score":100,"commit":"032ff113d75116d573a555bc32eca52f788dbdc9","commitDate":"2026-08-18T22:46:30+08:00","artifactDigest":"sha256:8cf23fa6abc47c6fc2e4992870ac99cfdcbdbb0b8142a98d2c98fcccc17c84a8","downloadUrl":"https://github.com/Sutera-Diffusus/dsh-whale-musume/archive/032ff113d75116d573a555bc32eca52f788dbdc9.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:Sutera-Diffusus/dsh-whale-musume","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-whale-musume","packageVersion":"1.4.1","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-whale-musume","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"dsh-whale-musume","name":"dsh-whale-musume","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","host-bundle","network"],"outboundHosts":[{"host":"jmrai.net","count":2},{"host":"free.quanthatch.com","count":1}],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"assets/dsh-whale-moe.js","pathClass":"test-example-docs","line":786,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"daadf8bc5569e3826fd4de7e"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"test/cdp-whale-moe.mjs","pathClass":"test-example-docs","line":111,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"fb068ad8f32b3c27a2d1456d"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"low","layer":"static","path":"test/cdp-whale-moe.mjs","pathClass":"test-example-docs","line":350,"evidence":".innerHTML=","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","note":"位于测试、示例或文档目录","hash":"8354b77820420a226964a42f"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"test/load-core.mjs","pathClass":"test-example-docs","line":15,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"d85ad96f2199a7767910fe5a"}],"counts":{"critical":0,"high":0,"medium":0,"low":0},"rawCounts":{"critical":0,"high":1,"medium":3,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"not-needed","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":41,"bytesScanned":584808,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":6,"test-example-docs":23,"cordis":1,"source":10,"manifest":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"]},"timeline":[{"scannedAt":"2026-08-22T08:21:22.031Z","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.2","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T11:20:40.664Z","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.1","verdict":"pass","status":"static-complete"},{"scannedAt":"2026-08-21T10:48:33.525Z","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.0","verdict":"pass","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:21:22.031Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:20:40.664Z"},{"kind":"first-scan","from":null,"to":"pass","commit":"032ff113d75116d573a555bc32eca52f788dbdc9","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:48:33.525Z"}]}