{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"xohmai-dsh-cpa-status","slug":"xohmai-dsh-cpa-status","rank":1407,"url":"https://github.com/xohmai/dsh-cpa-status","name":"xohmai/dsh-cpa-status","category":"usage","description":{"zh":"CPA 账号池状态面板：侧栏健康灯、配额进度、成功率刻度与网关密钥末四位一览。","en":"CPA account-pool status panel: sidebar health light, quota bars, success-rate ticks, and gateway key endings."},"stars":1,"starsCheckedAt":"2026-08-21","repository":{"owner":"xohmai","repo":"dsh-cpa-status","requestedRef":null,"subpath":""},"npm":null,"downloads":null,"installMode":"github-source","upstreamInstall":"dsh plugin --profile web add github:xohmai/dsh-cpa-status","tarball":null,"added":"2026-08-20","page":"https://awesome-dsh-plugin.com/p/xohmai/dsh-cpa-status/","screenshots":["https://raw.githubusercontent.com/xohmai/dsh-cpa-status/main/docs/images/panel.png","https://raw.githubusercontent.com/xohmai/dsh-cpa-status/main/docs/images/collapsed.png"],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"xohmai-dsh-cpa-status","slug":"xohmai-dsh-cpa-status","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:34:43.905Z","scanStatus":"static-complete","verdict":"caution","score":95,"commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","commitDate":"2026-08-18T21:04:27+08:00","artifactDigest":"sha256:5d4bbd39f9e09e0eb0c5f4eacb3554eec5e8fede14f44500ece22a5c08f00640","downloadUrl":"https://github.com/xohmai/dsh-cpa-status/archive/3c6f28712d1e7380f36e02909bb64efd180be2b9.tar.gz","installMode":"github-source","installCommand":"dsh plugin --profile web add github:xohmai/dsh-cpa-status","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-cpa-status","packageVersion":"0.1.0","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":[]},"lifecycleScripts":{},"peerDependencies":[]},"identity":{"status":"not-published","installMode":"github-source","upstreamNpm":null,"manifestName":"dsh-cpa-status","nameMatch":null,"npm":null,"repositoryMatch":"not-checked","provenance":"not-checked","tarballHost":null},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"cpa-status","name":"dsh-cpa-status","path":"cordis.patch.yml","disabled":false}],"overrides":[],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["browser-ui","credentials","environment","host-bundle","network"],"outboundHosts":[{"host":"your-cpa.example.com","count":1},{"host":"chatgpt.com","count":1},{"host":"api.kimi.com","count":1},{"host":"cli-chat-proxy.grok.com","count":1}],"findings":[{"id":"HT-CLIENT-001","title":"浏览器端使用危险 HTML 注入点","severity":"medium","confidence":"medium","layer":"static","path":"src/client.js","pathClass":"source","line":145,"evidence":"dangerouslySetInnerHTML","remediation":"使用安全 DOM API，并在不可避免时对不可信内容进行严格清洗。","hash":"fb69d878c8203d81f6dcd9ed"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"high","confidence":"low","layer":"static","path":"src/index.js","pathClass":"source","line":498,"evidence":"credential access at line 498 + outbound network at line 93","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"e7ae758bd99b4a58b51cd30c","review":{"verdict":"sanitized","reason":"publicConfig()中credentials.resolve()仅用于生成`••••+末2位`的hint字符串返回给本地/config接口，未将完整密钥用于第93行的出站网络请求，符合插件宣称的‘网关密钥末四位一览’功能且已脱敏。","model":"sonnet","reviewedAt":"2026-08-22T08:34:43.905Z"}}],"counts":{"critical":0,"high":0,"medium":1,"low":0},"rawCounts":{"critical":0,"high":1,"medium":1,"low":0},"vulnerabilities":[],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-missing","vulnerabilities":"lockfile-missing","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":8,"bytesScanned":92474,"truncated":false,"lockfiles":[],"pathClasses":{"markdown":4,"cordis":1,"manifest":1,"source":2}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:34:43.905Z","summary":"插件为CPA账号池状态面板，publicConfig()读取管理密钥仅为生成掩码提示(末2位)展示给用户，未在该函数内将密钥用于任何出站网络调用，行为与描述的‘网关密钥末四位一览’一致，属于已脱敏的正常展示逻辑。","intentMatch":"consistent","findingsReviewed":1,"findingsCandidates":1,"fromCache":0,"usage":{"inputTokens":2,"outputTokens":965,"costUsd":0.020936,"durationMs":13300}}},"timeline":[{"scannedAt":"2026-08-22T08:34:43.905Z","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:40:10.707Z","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.1","verdict":"review","status":"static-complete"},{"scannedAt":"2026-08-21T11:09:10.113Z","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"verdict-change","from":"review","to":"caution","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:34:43.905Z"},{"kind":"verdict-change","from":"caution","to":"review","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:40:10.707Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"3c6f28712d1e7380f36e02909bb64efd180be2b9","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T11:09:10.113Z"}]}