{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"wxkingstar-specfusion","slug":"wxkingstar-specfusion","rank":93,"url":"https://github.com/wxkingstar/SpecFusion","name":"wxkingstar/SpecFusion","category":"tools","description":{"zh":"通过五个只读工具和一个运行时 Skill，搜索 20 个中国开放平台的 65,600+ 篇 API 文档。","en":"Search 65,600+ API docs from 20 Chinese open platforms through five read-only tools and a runtime skill."},"stars":54,"starsCheckedAt":"2026-08-21","repository":{"owner":"wxkingstar","repo":"SpecFusion","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:wxkingstar/SpecFusion","tarball":null,"added":"2026-08-20","page":"https://awesome-dsh-plugin.com/p/wxkingstar/SpecFusion/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"wxkingstar-specfusion","slug":"wxkingstar-specfusion","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:20:44.711Z","scanStatus":"static-complete","verdict":"review","score":63,"commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","commitDate":"2026-08-18T19:10:23+08:00","artifactDigest":"sha256:f3ca349be81a89adf393906a92587fc7697fd1e20f4b962614d9710c5d6288ea","downloadUrl":"https://github.com/wxkingstar/SpecFusion/archive/f1780beb5dcda37a8ff5130ecf0e11b744830e78.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:wxkingstar/SpecFusion","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"specfusion","packageVersion":"0.1.0","bundle":null,"client":null,"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"specfusion","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":null,"inserts":[{"id":"specfusion-dsh","name":"@wxkingstar/specfusion-dsh","path":"dsh-plugin/cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":null,"parseErrors":[]},"capabilities":["browser-ui","credentials","environment","filesystem","mcp","network","subprocess"],"outboundHosts":[{"host":"api.weixin.qq.com","count":7},{"host":"developer.work.weixin.qq.com","count":4},{"host":"developers.weixin.qq.com","count":4},{"host":"open.pinduoduo.com","count":4},{"host":"specfusion.inagora.org","count":2},{"host":"open.feishu.cn","count":2},{"host":"open.dingtalk.com","count":2},{"host":"open.taobao.com","count":2},{"host":"open.xiaohongshu.com","count":2},{"host":"op.jinritemai.com","count":2},{"host":"doc.youzanyun.com","count":2},{"host":"pay.weixin.qq.com","count":2},{"host":"opendocs.alipay.com","count":2},{"host":"open.jd.com","count":2},{"host":"open.sheincorp.com","count":2},{"host":"open.dewu.com","count":2},{"host":"api.volcengine.com","count":2},{"host":"www.volcengine.com","count":2},{"host":"help.aliyun.com","count":2},{"host":"weapp.eteams.cn","count":2},{"host":"open.italent.cn","count":2},{"host":"oapi.dingtalk.com","count":2},{"host":"applink.feishu.cn","count":2},{"host":"gw-api.pinduoduo.com","count":2},{"host":"ideservice.alipay.com","count":1},{"host":"dashscope.aliyuncs.com","count":1},{"host":"open-api.pinduoduo.com","count":1},{"host":"deb.nodesource.com","count":1}],"findings":[{"id":"HT-EXEC-002","title":"远程脚本直连 Shell 执行","severity":"high","confidence":"high","layer":"static","path":"scripts/deploy.sh","pathClass":"script","line":42,"evidence":"curl -fsSL https://deb.nodesource.com/setup_20.x | bash","remediation":"禁止远程内容直接进入 Shell；下载、校验固定哈希后再由用户显式执行。","hash":"005527108b7d9593c2ebbb0b","review":{"verdict":"functional","reason":"该 curl|bash 位于 scripts/deploy.sh 的 --init 分支，仅在运维者显式执行 npm run deploy -- --init 且自行设置 DEPLOY_HOST 时于其自有远程服务器上引导安装 Node.js，非插件运行时自动触发，不影响使用检索工具的终端用户。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:19:33.176Z"}},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"scrapers/prune-source.mts","pathClass":"source","line":15,"evidence":"credential access at line 15 + outbound network at line 33","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"5303793a80eec297f45a2807","review":{"verdict":"functional","reason":"ADMIN_TOKEN 仅作为 Authorization 头发往可配置的自有后端 API（默认 localhost:3456），用于清理本地文档库残留条目，属于运维脚本自身认证流程，未外发至第三方或无关服务。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:19:33.176Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-35jp-ww65-95wh (CVE-2026-44494) fixed in 1.16.0","remediation":"升级 axios 至 1.16.0 或更高版本。","layer":"vulnerability","hash":"7dc4a2385d5f3ce9c27985ce","review":{"verdict":"unclear","reason":"所示 package-lock.json 片段未包含 axios 依赖条目，无法确认该 CVE 所指版本、使用位置及是否实际可达，缺乏足够上下文判断。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-3g43-6gmg-66jw (CVE-2026-44495) fixed in 1.15.2","remediation":"升级 axios 至 1.15.2 或更高版本。","layer":"vulnerability","hash":"d03b606b8ebb155246081aed","review":{"verdict":"unclear","reason":"同上，提供的 lockfile 片段未展示 axios 条目，无法验证该 CVE 对应的版本与实际引用路径。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-6chq-wfr3-2hj9 (CVE-2026-42035) fixed in 1.15.1","remediation":"升级 axios 至 1.15.1 或更高版本。","layer":"vulnerability","hash":"4d9b87a1968e00d7ace82cc6","review":{"verdict":"unclear","reason":"提供上下文中未见 axios 依赖声明，无法判断该已知漏洞是否在实际代码路径中被触发或使用。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-777c-7fjr-54vf (CVE-2026-44488) fixed in 1.16.0","remediation":"升级 axios 至 1.16.0 或更高版本。","layer":"vulnerability","hash":"c2803422233e2c45f6a9bd7c","review":{"verdict":"unclear","reason":"lockfile 截取片段缺少 axios 相关记录，无法确认版本匹配及该漏洞的实际可利用性。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-hfxv-24rg-xrqf (CVE-2026-44496) fixed in 1.16.0","remediation":"升级 axios 至 1.16.0 或更高版本。","layer":"vulnerability","hash":"7ac850e1776526cf5a7bb38b","review":{"verdict":"unclear","reason":"同批次重复片段未展示 axios 依赖，缺乏证据判断该 CVE 是否真实影响本插件运行时。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"high","confidence":"medium","path":"package-lock.json","pathClass":"manifest","line":1,"evidence":"axios@1.13.5 GHSA-j5f8-grm9-p9fc (CVE-2026-44486) fixed in 1.16.0","remediation":"升级 axios 至 1.16.0 或更高版本。","layer":"vulnerability","hash":"fb9782d25195da452e1a16e0","review":{"verdict":"unclear","reason":"所给 package-lock.json 内容未含 axios 条目，无法核实该漏洞的实际存在与触发路径。","model":"sonnet","reviewedAt":"2026-08-21T10:47:37.293Z"}}],"counts":{"critical":0,"high":7,"medium":1,"low":0},"rawCounts":{"critical":0,"high":7,"medium":1,"low":0},"vulnerabilities":[{"id":"GHSA-35jp-ww65-95wh","aliases":["CVE-2026-44494"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.16.0","summary":"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`"},{"id":"GHSA-3g43-6gmg-66jw","aliases":["CVE-2026-44495"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.15.2","summary":"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge"},{"id":"GHSA-6chq-wfr3-2hj9","aliases":["CVE-2026-42035"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.15.1","summary":"Axios: Header Injection via Prototype Pollution"},{"id":"GHSA-777c-7fjr-54vf","aliases":["CVE-2026-44488"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.16.0","summary":"Allocation of Resources Without Limits or Throttling in Axios"},{"id":"GHSA-hfxv-24rg-xrqf","aliases":["CVE-2026-44496"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.16.0","summary":"Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection"},{"id":"GHSA-j5f8-grm9-p9fc","aliases":["CVE-2026-44486"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.16.0","summary":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection"},{"id":"GHSA-p92q-9vqr-4j8v","aliases":["CVE-2026-44487"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.16.0","summary":"Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter"},{"id":"GHSA-pf86-5x62-jrwf","aliases":["CVE-2026-42033"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.15.1","summary":"Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking"},{"id":"GHSA-pmwg-cvhr-8vh7","aliases":["CVE-2026-42043"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.15.1","summary":"Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0"},{"id":"GHSA-q8qp-cvcw-x6jj","aliases":["CVE-2026-42264"],"package":"axios","version":"1.13.5","severity":"high","fixed":"1.15.2","summary":"Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking"},{"id":"GHSA-3jxr-9vmj-r5cp","aliases":["CVE-2026-13149"],"package":"brace-expansion","version":"1.1.12","severity":"high","fixed":"5.0.7","summary":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups"},{"id":"GHSA-mh99-v99m-4gvg","aliases":["CVE-2026-14257"],"package":"brace-expansion","version":"1.1.12","severity":"high","fixed":"5.0.8","summary":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash"},{"id":"GHSA-rgw5-rvv9-x895","aliases":["CVE-2026-69152"],"package":"brace-expansion","version":"1.1.12","severity":"high","fixed":"1.1.18","summary":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"},{"id":"GHSA-4c8g-83qw-93j6","aliases":["CVE-2026-13676"],"package":"fast-uri","version":"3.1.0","severity":"high","fixed":"4.0.1","summary":"fast-uri vulnerable to host confusion via failed IDN canonicalization"},{"id":"GHSA-7p8r-x3mc-p8w7","aliases":["CVE-2026-18446"],"package":"fast-uri","version":"3.1.0","severity":"high","fixed":"2.4.4","summary":"fast-uri vulnerable to host confusion via backslash authority introducer"},{"id":"GHSA-q3j6-qgpj-74h6","aliases":["CVE-2026-6321"],"package":"fast-uri","version":"3.1.0","severity":"high","fixed":"3.1.1","summary":"fast-uri vulnerable to path traversal via percent-encoded dot segments"},{"id":"GHSA-v2hh-gcrm-f6hx","aliases":["CVE-2026-16221"],"package":"fast-uri","version":"3.1.0","severity":"high","fixed":"2.4.3","summary":"fast-uri vulnerable to host confusion via literal backslash authority delimiter"},{"id":"GHSA-v39h-62p7-jpjc","aliases":["CVE-2026-6322"],"package":"fast-uri","version":"3.1.0","severity":"high","fixed":"3.1.2","summary":"fast-uri vulnerable to host confusion via percent-encoded authority delimiters"},{"id":"GHSA-247c-9743-5963","aliases":["CVE-2025-32442","CVE-2026-33806","GHSA-mg2h-6x62-wpwc"],"package":"fastify","version":"5.7.4","severity":"high","fixed":"5.8.5","summary":"Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header"},{"id":"GHSA-2g4f-4pwh-qvx6","aliases":["CVE-2025-69873"],"package":"ajv","version":"8.17.1","severity":"medium","fixed":"8.18.0","summary":"ajv has ReDoS when using `$data` option"},{"id":"GHSA-3p68-rc4w-qgx5","aliases":["CVE-2025-62718"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.0","summary":"Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF"},{"id":"GHSA-3w6x-2g7m-8v23","aliases":["CVE-2026-42044"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.2","summary":"Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`"},{"id":"GHSA-42h9-826w-cgv3","aliases":["CVE-2026-67313"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"0.33.0","summary":"Axios: Excessive recursion in formDataToJSON can cause denial of service"},{"id":"GHSA-445q-vr5w-6q77","aliases":["CVE-2026-42037"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream"},{"id":"GHSA-5c9x-8gcm-mpgx","aliases":["CVE-2026-42034"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0"},{"id":"GHSA-62hf-57xw-28j9","aliases":["CVE-2026-42039"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data"},{"id":"GHSA-7q8q-rj6j-mhjq","aliases":["CVE-2026-67319"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"0.33.0","summary":"Axios: Nested axios option objects can consume polluted prototype values"},{"id":"GHSA-898c-q2cr-xwhg","aliases":["CVE-2026-44490"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.16.0","summary":"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions"},{"id":"GHSA-fvcv-3m26-pcqx","aliases":["CVE-2026-40175"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.0","summary":"Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain"},{"id":"GHSA-jqh4-m9w3-8hp9","aliases":["CVE-2026-67317"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.18.0","summary":"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`"},{"id":"GHSA-m7pr-hjqh-92cm","aliases":["CVE-2026-42038"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: no_proxy bypass via IP alias allows SSRF"},{"id":"GHSA-mmx7-hfxf-jppx","aliases":["CVE-2026-67316"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.18.0","summary":"Axios: Prototype pollution gadgets can alter axios request construction"},{"id":"GHSA-mwf2-3pr3-8698","aliases":["CVE-2026-67318"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.18.0","summary":"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`"},{"id":"GHSA-pmv8-rq9r-6j72","aliases":["CVE-2026-67312"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"0.33.0","summary":"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service"},{"id":"GHSA-vf2m-468p-8v99","aliases":["CVE-2026-42036"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: HTTP adapter streamed responses bypass maxContentLength"},{"id":"GHSA-w9j2-pvgh-6h63","aliases":["CVE-2026-42041"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy"},{"id":"GHSA-xx6v-rp6x-q39c","aliases":["CVE-2026-42042"],"package":"axios","version":"1.13.5","severity":"medium","fixed":"1.15.1","summary":"Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion"},{"id":"GHSA-f886-m6hf-6m8v","aliases":["CVE-2026-33750"],"package":"brace-expansion","version":"1.1.12","severity":"medium","fixed":"5.0.5","summary":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion"},{"id":"GHSA-444r-cwp2-x5xf","aliases":["CVE-2026-3635"],"package":"fastify","version":"5.7.4","severity":"medium","fixed":"5.8.3","summary":"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections"},{"id":"GHSA-xhjh-pmcv-23jw","aliases":["CVE-2026-42040"],"package":"axios","version":"1.13.5","severity":"low","fixed":"1.15.1","summary":"Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams"},{"id":"GHSA-573f-x89g-hqp9","aliases":[],"package":"fastify","version":"5.7.4","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-c96f-x56v-gq3h","aliases":[],"package":"find-my-way","version":"9.4.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-r4q5-vmmm-2653","aliases":[],"package":"follow-redirects","version":"1.15.11","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-hmw2-7cc7-3qxx","aliases":[],"package":"form-data","version":"4.0.5","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-52cp-r559-cp3m","aliases":[],"package":"js-yaml","version":"4.1.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-5p4m-2wfm-xmqj","aliases":[],"package":"js-yaml","version":"4.1.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-h67p-54hq-rp68","aliases":[],"package":"js-yaml","version":"4.1.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-23c5-xmqv-rm74","aliases":[],"package":"minimatch","version":"3.1.2","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-3ppc-4f35-3m26","aliases":[],"package":"minimatch","version":"3.1.2","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-7r86-cg39-jmmj","aliases":[],"package":"minimatch","version":"3.1.2","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-23hp-3jrh-7fpw","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-34x7-hfp2-rc4v","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-83g3-92jg-28cx","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-8qq5-rm4j-mr97","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-8x88-c5mf-7j5w","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-9ppj-qmqm-q256","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-gvwx-54wh-qm9j","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-qffp-2rhf-9h96","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-r292-9mhp-454m","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-r6q2-hw4h-h46w","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-vmf3-w455-68vh","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-w8wr-v893-vjvp","aliases":[],"package":"tar","version":"6.2.1","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-2mjp-6q6p-2qxm","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-35p6-xmwp-9g52","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-4992-7rv2-5pvq","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-4cwx-7wf7-3272","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-8xcm-r25x-g524","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-f269-vfmq-vjvj","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-g8m3-5g58-fq7m","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-jr45-8vmc-qm54","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-m8rv-5g2x-5cg5","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-p88m-4jfj-68fv","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-phc3-fgpg-7m6h","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-pr7r-676h-xcf6","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-v3r7-h72x-cjcm","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-v9p9-hfj2-hcw8","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-vrm6-8vpv-qv8q","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-vxpw-j846-p89q","aliases":[],"package":"undici","version":"7.21.0","severity":"unknown","fixed":null,"summary":""},{"id":"GHSA-48c2-rrv3-qjmp","aliases":[],"package":"yaml","version":"1.10.2","severity":"unknown","fixed":null,"summary":""}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"not-declared","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":87,"bytesScanned":852684,"truncated":false,"lockfiles":["package-lock.json"],"pathClasses":{"markdown":11,"manifest":4,"source":56,"test-example-docs":3,"data":5,"cordis":1,"html":1,"yaml":1,"script":5}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:20:44.711Z","summary":null,"intentMatch":null,"findingsReviewed":8,"findingsCandidates":8,"fromCache":8,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:20:44.711Z","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.2","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:19:33.175Z","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T10:47:37.293Z","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.0","verdict":"review","status":"static-complete"}],"events":[{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:20:44.711Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:19:33.175Z"},{"kind":"first-scan","from":null,"to":"review","commit":"f1780beb5dcda37a8ff5130ecf0e11b744830e78","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:47:37.293Z"}]}