{"schemaVersion":2,"dataVersion":"20260822T105549Z-0a0b366f","generatedAt":"2026-08-22T10:55:49.138Z","source":{"id":"ysr666-dsh-vision-router","slug":"ysr666-dsh-vision-router","rank":16,"url":"https://github.com/ysr666/dsh-vision-router","name":"ysr666/dsh-vision-router","category":"vision","description":{"zh":"为纯文本 Agent 提供视觉能力：内置免 Key 视觉链 + 像素级视觉工具（看图问答、定位、裁剪、像素对比、取色、OCR、矢量化、抠图、截图）；粘贴图片即可用。","en":"Free vision for text-only agents: built-in keyless vision chain plus pixel tools (Q&A, grounding, crop, pixel diff, colors, OCR, SVG trace, cutout, screenshots); paste an image to use it."},"stars":935,"starsCheckedAt":"2026-08-21","repository":{"owner":"ysr666","repo":"dsh-vision-router","requestedRef":null,"subpath":""},"npm":"dsh-vision-router","downloads":26390,"installMode":"npm","upstreamInstall":"dsh plugin --profile web add dsh-vision-router","tarball":null,"added":"2026-08-14","page":"https://awesome-dsh-plugin.com/p/ysr666/dsh-vision-router/","screenshots":[],"discovery":{"provider":"awesome-dsh-plugin","channel":"plugins.json","indexUrl":"https://github.com/awesome-dsh-plugin/awesome-dsh-plugin","selection":"all curated entries"}},"report":{"sourceId":"ysr666-dsh-vision-router","slug":"ysr666-dsh-vision-router","policyVersion":"HT-DSH-0.2.2","scannedAt":"2026-08-22T08:19:37.145Z","scanStatus":"static-complete","verdict":"caution","score":84,"commit":"9e9a938e53a70715a23c7b9650b652506e537419","commitDate":"2026-08-22T15:42:15+08:00","artifactDigest":"sha256:fee66a7e4b1810322fe29806cb78f585a7e87a1af63a2a00da2732e6f267ba27","downloadUrl":"https://github.com/ysr666/dsh-vision-router/archive/9e9a938e53a70715a23c7b9650b652506e537419.tar.gz","installMode":"npm","installCommand":"dsh plugin --profile web add dsh-vision-router","manifest":{"found":true,"path":"package.json","parseError":null,"packageName":"dsh-vision-router","packageVersion":"1.7.6","bundle":{"patch":"./cordis.patch.yml"},"client":{"platform":"web","inject":["@deepseek-ai/dsh-client-ui-settings","@deepseek-ai/dsh-client-runtime","@deepseek-ai/dsh-client-connection","@deepseek-ai/dsh-api-remotes"]},"lifecycleScripts":{},"peerDependencies":["@deepseek-ai/dsh-anonymous-user-id","@deepseek-ai/dsh-llm-deepseek"]},"identity":{"status":"found","installMode":"npm","upstreamNpm":"dsh-vision-router","manifestName":"dsh-vision-router","nameMatch":true,"npm":{"name":"dsh-vision-router","latestVersion":"1.7.4","publishedAt":"2026-08-21T05:53:19.899Z","createdAt":"2026-08-14T15:47:58.090Z","versionCount":26,"maintainers":1,"repository":"git+https://github.com/ysr666/dsh-vision-router.git","hasInstallScripts":false,"deprecated":false},"repositoryMatch":"match","provenance":"attested","tarballHost":null,"versionMatch":"differs"},"permissions":{"bundlePatch":"cordis.patch.yml","inserts":[{"id":"vision-router","name":"dsh-vision-router","path":"cordis.patch.yml","disabled":false}],"overrides":[{"id":"attachment-local","tier":"sensitive","mode":"override","disabled":false,"replacesImplementation":false,"name":null,"keys":["maxImageBytes","maxImagePixels","maxImageDimension"],"path":"cordis.patch.yml"}],"jsExpressions":0,"clientPlatform":"web","parseErrors":[]},"capabilities":["agent-control","browser-ui","credentials","environment","filesystem","host-bundle","network","session","subprocess","telemetry"],"outboundHosts":[{"host":"oai.endpoints.kepler.ai.cloud.ovh.net","count":6},{"host":"opencode.ai","count":4},{"host":"open.bigmodel.cn","count":2},{"host":"www.npmjs.com","count":2},{"host":"host.example","count":1},{"host":"api.github.com","count":1},{"host":"dashscope.aliyuncs.com","count":1},{"host":"openrouter.ai","count":1},{"host":"api.siliconflow.cn","count":1}],"findings":[{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"index.js","pathClass":"source","line":28,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b447e259cd9305ea45943b5c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/doctor-runtime.js","pathClass":"source","line":1,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"807829eaa059f9adc1441d82"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/doctor-runtime.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"b683c5ab349942ee0d6faf87"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/file-logger.js","pathClass":"source","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"e6114dcf4c399f6491e73fe5"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/local-vision-stabilizer.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"42ddf02ae26a25d5188fbdd2"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/self-update.js","pathClass":"source","line":1,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"ba20acbadd39c0c162a61477"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/tesseract-exec-compat.js","pathClass":"source","line":8,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"beb31339e69ed1c28d0519ec"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"medium","layer":"static","path":"lib/tesseract-exec-compat.js","pathClass":"source","line":13,"evidence":"child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","hash":"5da1e8dca9311c9a1d433046"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/adversarial-hardening.test.js","pathClass":"test-example-docs","line":138,"evidence":"new Function(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"da7f772f265058a33f332f2f"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/client-presentation-boundary.test.js","pathClass":"test-example-docs","line":64,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"47abbabc95e9612161ecc69a"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/client-presentation-boundary.test.js","pathClass":"test-example-docs","line":144,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"47abbabc95e9612161ecc69a"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/doctor-cli.test.js","pathClass":"test-example-docs","line":3,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"e0325fb1b90bbb399ba2a9a0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/doctor-cli.test.js","pathClass":"test-example-docs","line":3,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"5f4f123ae434e65dff36ce1c"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/live-model-discovery.test.js","pathClass":"test-example-docs","line":246,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"164d0e4e4fd32581997655d8"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/local-remote-settings-permission.test.js","pathClass":"test-example-docs","line":126,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"e00d1dd068d9c5c039fca88d"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/native-multimodal-process-restart-contract.mjs","pathClass":"test-example-docs","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"fd740ec6158d1cad0a4996e0"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/native-multimodal-process-restart-contract.mjs","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"44e5d74c48d81e2ba749a89c"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/pi-ai-native-process-restart-contract.mjs","pathClass":"test-example-docs","line":2,"evidence":"spawnSync","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"afd46249ac8b91fcd6b13e86"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/pi-ai-native-process-restart-contract.mjs","pathClass":"test-example-docs","line":2,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"d660aa124e56b119c1dfbc7d"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/provider-directory-fallback.test.js","pathClass":"test-example-docs","line":57,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"582b7d3705a66e98f87e6ddc"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/qa-top5-reliability.test.js","pathClass":"test-example-docs","line":178,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"79521ddb8e90f82177eefc12"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/remote-settings-risk-confirmation.test.js","pathClass":"test-example-docs","line":132,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"bff762bb84c883530e768799"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/remote-settings-risk-confirmation.test.js","pathClass":"test-example-docs","line":133,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"bff762bb84c883530e768799"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/runtime-e2e.test.js","pathClass":"test-example-docs","line":9,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"e10de1df7984136151cc437e"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/settings-scroll-jank-regression.test.js","pathClass":"test-example-docs","line":34,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"c448022ee73392b63d77868f"},{"id":"HT-RUNTIME-001","title":"动态代码执行","severity":"high","confidence":"low","layer":"static","path":"tests/settings-section-order.test.js","pathClass":"test-example-docs","line":39,"evidence":"vm.runInNewContext(","remediation":"使用静态模块和受约束的配置解析器，避免在宿主权限下执行动态字符串。","note":"位于测试、示例或文档目录","hash":"b0d7b7c70b7183ede2e70cfa"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/tesseract-node24-boot.test.js","pathClass":"test-example-docs","line":4,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"575410e55a4bf62d2c559285"},{"id":"HT-EXEC-001","title":"直接创建宿主子进程","severity":"low","confidence":"low","layer":"static","path":"tests/tesseract-node24-boot.test.js","pathClass":"test-example-docs","line":10,"evidence":"node:child_process","remediation":"通过 DSH 的受控 subprocess/shell seam 执行，并公开命令、参数及审批策略。","note":"位于测试、示例或文档目录","hash":"575410e55a4bf62d2c559285"},{"id":"HT-DATA-001","title":"同一模块同时接触凭据与网络","severity":"medium","confidence":"medium","layer":"static","path":"index.js","pathClass":"source","line":2446,"evidence":"credential access at line 2446 + outbound network at line 3211","remediation":"拆分能力边界，限定目的域名，并提供不会发送凭据值的可验证证明。","hash":"685e7ee9ff886d4ef27b4336","review":{"verdict":"functional","reason":"resolveApiKey 通过 credentials.resolve(ref) 或环境变量取得用户自配置的 DeepSeek API Key，用于重建原生 llm-deepseek 适配器发起官方请求，属于视觉链复用官方路由的必要功能，凭据流向用户已配置的 DeepSeek 服务而非第三方。","model":"sonnet@p2","reviewedAt":"2026-08-21T11:17:27.628Z"}},{"id":"HT-PERMISSION-002","title":"覆盖敏感宿主能力","severity":"medium","confidence":"high","path":"cordis.patch.yml","line":40,"evidence":"override: id=attachment-local config[maxImageBytes,maxImagePixels,maxImageDimension]","remediation":"安全关键 seam 的替换必须逐项解释、最小化，并接受人工复核；用户安装前应知晓该能力被谁接管。","note":"改写配置 attachment-local","layer":"dsh-semantics","pathClass":"cordis","hash":"0d7a35a3ae909fb451ebff1a"},{"id":"HT-VULN-001","title":"依赖存在已知漏洞","severity":"medium","confidence":"medium","path":"pnpm-lock.yaml","pathClass":"manifest","line":1,"evidence":"phin@2.9.3 GHSA-x565-32qp-m3vf fixed in 3.7.1","remediation":"升级 phin 至 3.7.1 或更高版本。","layer":"vulnerability","hash":"fd6841fc904afd02ac4ac4a2"}],"counts":{"critical":0,"high":0,"medium":3,"low":8},"rawCounts":{"critical":0,"high":11,"medium":3,"low":17},"vulnerabilities":[{"id":"GHSA-x565-32qp-m3vf","aliases":[],"package":"phin","version":"2.9.3","severity":"medium","fixed":"3.7.1","summary":"phin may include sensitive headers in subsequent requests after redirect"}],"coverage":{"source":"complete","manifest":"complete","bundleConfig":"complete","dependencies":"lockfile-present","vulnerabilities":"complete","identity":"complete","artifact":"not-compared","llmReview":"complete","dynamicRuntime":"not-run","humanReview":"not-run"},"inventory":{"filesScanned":168,"bytesScanned":2436344,"truncated":false,"lockfiles":["pnpm-lock.yaml"],"pathClasses":{"test-example-docs":89,"markdown":13,"cordis":1,"source":57,"manifest":1,"yaml":7}},"limitations":["此结果为源码静态检测，不等同于无漏洞证明。","尚未比对 npm 发布包与源码的一致性，也未执行隔离运行和人工复核。","危险能力可能是插件功能所需，需结合用途与证据人工判断。"],"limitationKeys":["static-analysis-only","no-artifact-runtime-human-review","capability-needs-context"],"review":{"model":"sonnet","reviewedAt":"2026-08-22T08:19:37.145Z","summary":null,"intentMatch":null,"findingsReviewed":1,"findingsCandidates":1,"fromCache":1,"usage":null}},"timeline":[{"scannedAt":"2026-08-22T08:19:37.145Z","commit":"9e9a938e53a70715a23c7b9650b652506e537419","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:16:27.921Z","commit":"361579b37425e849160884a57cf30c2f4e5c95bb","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T13:16:11.886Z","commit":"361579b37425e849160884a57cf30c2f4e5c95bb","policyVersion":"HT-DSH-0.2.2","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T11:17:27.628Z","commit":"bcf1a56823a833ae111e9c412f09f667d353ae55","policyVersion":"HT-DSH-0.2.1","verdict":"caution","status":"static-complete"},{"scannedAt":"2026-08-21T10:44:49.252Z","commit":"d6e91f555289471eb1f81e450f44b7e40c5efedf","policyVersion":"HT-DSH-0.2.0","verdict":"caution","status":"static-complete"}],"events":[{"kind":"commit-change","from":"361579b37425e849160884a57cf30c2f4e5c95bb","to":"9e9a938e53a70715a23c7b9650b652506e537419","commit":"9e9a938e53a70715a23c7b9650b652506e537419","policyVersion":"HT-DSH-0.2.2","at":"2026-08-22T08:19:37.145Z"},{"kind":"policy-change","from":"HT-DSH-0.2.1","to":"HT-DSH-0.2.2","commit":"361579b37425e849160884a57cf30c2f4e5c95bb","policyVersion":"HT-DSH-0.2.2","at":"2026-08-21T13:16:11.886Z"},{"kind":"policy-change","from":"HT-DSH-0.2.0","to":"HT-DSH-0.2.1","commit":"bcf1a56823a833ae111e9c412f09f667d353ae55","policyVersion":"HT-DSH-0.2.1","at":"2026-08-21T11:17:27.628Z"},{"kind":"first-scan","from":null,"to":"caution","commit":"d6e91f555289471eb1f81e450f44b7e40c5efedf","policyVersion":"HT-DSH-0.2.0","at":"2026-08-21T10:44:49.252Z"}]}