{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"vlln-whale-girl","slug":"vlln-whale-girl","rank":38,"url":"https://github.com/vlln/whale-girl","name":"vlln/whale-girl","category":"fun","description":{"zh":"桌面宠物（QQ 宠物形态）：右下角悬浮、可拖拽/投喂/玩耍。","en":"Desktop pet (QQ-pet style): floats in the corner, draggable, feedable, playable."},"stars":261,"starsCheckedAt":"2026-08-21","repository":{"owner":"vlln","repo":"whale-girl","requestedRef":null,"subpath":""},"npm":"whale-girl","downloads":108,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add whale-girl","tarball":null,"added":"2026-08-13","page":"https://awesome-dsh-plugin.com/p/vlln/whale-girl/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"vlln-whale-girl","slug":"vlln-whale-girl","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:54.157Z","scanStatus":"static-complete","verdict":"caution","score":89,"commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","commitDate":"2026-08-19T14:18:16-07:00","artifactDigest":"sha256:f82e1524757a6d5ffba71fee1d454c8e8bbfcad6817c924ba506f5998bd928c0","downloadUrl":"https://github.com/vlln/whale-girl/archive/e22e1fd918746e610f7bfb1713cef1e57a56f37c.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add whale-girl","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"whale-girl","packageVersion":"0.1.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web"},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"whale-girl","manifestName":"whale-girl","nameMatch":true,"npm":{"name":"whale-girl","latestVersion":"0.1.0","publishedAt":"2026-08-19T16:46:48.478Z","createdAt":"2026-08-19T16:46:48.052Z","versionCount":1,"maintainers":1,"repository":"git+https://github.com/vlln/whale-girl.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"none","tarballHost":null,"versionMatch":"match"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"whale-girl","name":"whale-girl","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","environment","filesystem","host-bundle","network","session","subprocess"],"outboundHosts":[{"host":"dsh.internal","count":1}],"findings":[{"id":"HT-OBFUSCATION-001","title":"源码呈现混淆或载荷隐藏特征","severity":"medium","confidence":"high","layer":"static","path":"desktop/lib/render/window.mjs","pathClass":"source","line":82,"evidence":"Buffer.from(await res.arrayBuffer()) const { nativeImage } = await import(","remediation":"以可读源码分发；若必须打包，请同时提供可复现构建与 source map。","note":"解码后直接进入执行","hash":"2ef179ead1a6511f7307577e","review":{"verdict":"functional","reason":"该段仅将从本地client.url()资产接口取回的精灵图字节转为Buffer并用nativeImage.createFromBuffer渲染成dataURL用于展示宠物贴图，并非解码后执行任意代码，import('electron')只是取内置模块引用。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:18:21.219Z"}},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"lib/client.js","pathClass":"source","line":375,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"87e8e136bfe0ec624b8b4ecd"},{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"lib/client/index.mjs","pathClass":"source","line":227,"evidence":".innerHTML =","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"b3dea50cbe83647c9c1e0cb3"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-client.mjs","pathClass":"source","line":7,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"1b64d0dc30b7be2f6d187fe7"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/build-client.mjs","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"914d1acd2b025e00f76a3c03"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/gates/run.mjs","pathClass":"source","line":7,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"442b75fee46568943782c2f1"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/gates/run.mjs","pathClass":"source","line":7,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"484f5c051747c6b361f831ea"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"scripts/gates/verify-config-sync.mjs","pathClass":"source","line":24,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","hash":"07e181e998462c421a0e968b","review":{"verdict":"sanitized","reason":"new Function 仅在本地 CI 门禁脚本 scripts/gates 中用于解析仓库自身 config.mjs/client/index.mjs 的纯字面量对象，不接触外部输入，不随插件运行时打包（未列入 package.json files）。","model":"sonnet","reviewedAt":"2026-08-21T10:46:10.320Z"}},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-client-behavior.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"a6776d67ceb90466eaeb283e"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"scripts/verify-client-smoke.mjs","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"4e07dd37afbde9ecb10510dc"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/slice-sheet.test.py","pathClass":"test-example-docs","line":23,"evidence":"subprocess.run","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"b266ca0b383b8fd3931c93ea"}],"counts":{"critical":0,"high":0,"medium":3,"low":6},"rawCounts":{"critical":0,"high":1,"medium":3,"low":7},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":179,"bytesScanned":1116634,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"markdown":94,"cordis":1,"source":47,"data":6,"manifest":2,"html":1,"test-example-docs":27,"yaml":1}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:19:54.157Z","summary":null,"intentMatch":null,"findingsReviewed":2,"findingsCandidates":2,"fromCache":2,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:19:54.157Z","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:18:21.219Z","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:46:10.320Z","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:54.157Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:18:21.219Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"e22e1fd918746e610f7bfb1713cef1e57a56f37c","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:46:10.320Z"}]}