扫描报告 · @sakikotgw/pack-agent

扫描报告 · @sakikotgw/pack-agent

认证等级

DID

did:cha2a:package:@sakikotgw/pack-agent

身份锚点

sakikoTGW/pack-agent · npm 官方声明

来源

npm

插件版本

—

安装

dsh plugin add @sakikotgw/pack-agent

扫描日期

2026-08-14（6 天前）

扫描层级

静态扫描（自研规则 + GuardDog 复核 + OSV 依赖）

扫描器版本

dshlib-scan v0.1 · GuardDog 3.2.0 · OSV.dev

自研扫描：⚠️ 待审 · GuardDog 复核：⚠️ 待审 · OSV 依赖：未扫描

语义：扫描是提示信号，非安全审查。✅ 通过=无命中；⚠️ 待审=有命中需人工判断；❌ 失败=无法扫描。人工确认恶意→下架。本页全部内容由 dshlib 数据库派生（验证报告可核对证据）。认证等级与依赖漏洞正交：L4 认证覆盖插件包内容/来源/生态，不覆盖依赖安全（见收录与验证标准）。结论有有效期：插件或运行时更新后，本页结论可能过期（>30 天将标注待复核）。本库能力与边界：披露页。

1. 自研扫描（dshlib-scan）

硬编码密钥（132 处）

文件	行	命中
`package/dsh-plugin/lib/index.js`	8301	`token: ".cursor/skills"`
`package/dsh-plugin/lib/index.js`	8301	`token: "~/.cursor/skills"`
`package/dsh-plugin/lib/index.js`	8303	`token: ".cursor/rules"`
`package/dsh-plugin/lib/index.js`	8304	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8307	`token: ".cursor/mcp.json"`
`package/dsh-plugin/lib/index.js`	8308	`token: "~/.cursor/mcp.json"`
`package/dsh-plugin/lib/index.js`	8317	`token: ".claude/skills"`
`package/dsh-plugin/lib/index.js`	8317	`token: "~/.claude/skills"`
`package/dsh-plugin/lib/index.js`	8319	`token: "CLAUDE.md"`
`package/dsh-plugin/lib/index.js`	8320	`token: ".claude/rules"`
`package/dsh-plugin/lib/index.js`	8323	`token: ".mcp.json"`
`package/dsh-plugin/lib/index.js`	8324	`token: "~/.claude.json"`
`package/dsh-plugin/lib/index.js`	8333	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8334	`token: ".codex/skills"`
`package/dsh-plugin/lib/index.js`	8335	`token: "~/.codex/skills"`
`package/dsh-plugin/lib/index.js`	8338	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8339	`token: ".codex/AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8340	`token: "~/.codex/AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8343	`token: ".codex/config.toml"`
`package/dsh-plugin/lib/index.js`	8344	`token: "~/.codex/config.toml"`
`package/dsh-plugin/lib/index.js`	8354	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8355	`token: ".opencode/skills"`
`package/dsh-plugin/lib/index.js`	8356	`token: "~/.config/opencode/skills"`
`package/dsh-plugin/lib/index.js`	8359	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8360	`token: "~/.config/opencode/AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8363	`token: "opencode.json"`
`package/dsh-plugin/lib/index.js`	8364	`token: "~/.config/opencode/opencode.json"`
`package/dsh-plugin/lib/index.js`	8373	`token: "~/.openclaw/workspace/skills"`
`package/dsh-plugin/lib/index.js`	8376	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8379	`token: "config/mcporter.json"`
`package/dsh-plugin/lib/index.js`	8388	`token: "~/.hermes/skills"`
`package/dsh-plugin/lib/index.js`	8388	`token: "~/.agents/skills"`
`package/dsh-plugin/lib/index.js`	8388	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8389	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8390	`token: "~/.hermes/config.yaml"`
`package/dsh-plugin/lib/index.js`	8399	`token: ".dsh/skills"`
`package/dsh-plugin/lib/index.js`	8400	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8401	`token: "~/.dsh/skills"`
`package/dsh-plugin/lib/index.js`	8404	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8405	`token: "CLAUDE.md"`
`package/dsh-plugin/lib/index.js`	8407	`token: ".dsh/agent-pack.cordis.yml"`
`package/dsh-plugin/lib/index.js`	8415	`token: "data/skills"`
`package/dsh-plugin/lib/index.js`	8415	`token: "data/plugins"`
`package/dsh-plugin/lib/index.js`	8425	`token: ".gemini/skills"`
`package/dsh-plugin/lib/index.js`	8425	`token: "~/.gemini/skills"`
`package/dsh-plugin/lib/index.js`	8425	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8427	`token: "GEMINI.md"`
`package/dsh-plugin/lib/index.js`	8428	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8431	`token: ".gemini/settings.json"`
`package/dsh-plugin/lib/index.js`	8432	`token: "~/.gemini/settings.json"`
`package/dsh-plugin/lib/index.js`	8441	`token: ".windsurf/skills"`
`package/dsh-plugin/lib/index.js`	8441	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8443	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8444	`token: ".windsurf/rules"`
`package/dsh-plugin/lib/index.js`	8447	`token: ".windsurf/mcp_config.json"`
`package/dsh-plugin/lib/index.js`	8456	`token: ".github/skills"`
`package/dsh-plugin/lib/index.js`	8456	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8458	`token: ".github/copilot-instructions.md"`
`package/dsh-plugin/lib/index.js`	8459	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8462	`token: ".vscode/mcp.json"`
`package/dsh-plugin/lib/index.js`	8463	`token: ".mcp.json"`
`package/dsh-plugin/lib/index.js`	8472	`token: ".agents/skills"`
`package/dsh-plugin/lib/index.js`	8472	`token: ".claude/skills"`
`package/dsh-plugin/lib/index.js`	8474	`token: "AGENTS.md"`
`package/dsh-plugin/lib/index.js`	8475	`token: "CLAUDE.md"`
`package/dsh-plugin/lib/index.js`	8477	`token: ".mcp.json"`
`package/src/adapters.ts`	61	`token: '.cursor/skills'`
`package/src/adapters.ts`	61	`token: '~/.cursor/skills'`
`package/src/adapters.ts`	63	`token: '.cursor/rules'`
`package/src/adapters.ts`	64	`token: 'AGENTS.md'`
`package/src/adapters.ts`	67	`token: '.cursor/mcp.json'`
`package/src/adapters.ts`	68	`token: '~/.cursor/mcp.json'`
`package/src/adapters.ts`	77	`token: '.claude/skills'`
`package/src/adapters.ts`	77	`token: '~/.claude/skills'`
`package/src/adapters.ts`	79	`token: 'CLAUDE.md'`
`package/src/adapters.ts`	80	`token: '.claude/rules'`
`package/src/adapters.ts`	83	`token: '.mcp.json'`
`package/src/adapters.ts`	84	`token: '~/.claude.json'`
`package/src/adapters.ts`	93	`token: '.agents/skills'`
`package/src/adapters.ts`	94	`token: '.codex/skills'`
`package/src/adapters.ts`	95	`token: '~/.codex/skills'`
`package/src/adapters.ts`	98	`token: 'AGENTS.md'`
`package/src/adapters.ts`	99	`token: '.codex/AGENTS.md'`
`package/src/adapters.ts`	100	`token: '~/.codex/AGENTS.md'`
`package/src/adapters.ts`	103	`token: '.codex/config.toml'`
`package/src/adapters.ts`	104	`token: '~/.codex/config.toml'`
`package/src/adapters.ts`	114	`token: '.agents/skills'`
`package/src/adapters.ts`	115	`token: '.opencode/skills'`
`package/src/adapters.ts`	116	`token: '~/.config/opencode/skills'`
`package/src/adapters.ts`	119	`token: 'AGENTS.md'`
`package/src/adapters.ts`	120	`token: '~/.config/opencode/AGENTS.md'`
`package/src/adapters.ts`	123	`token: 'opencode.json'`
`package/src/adapters.ts`	124	`token: '~/.config/opencode/opencode.json'`
`package/src/adapters.ts`	145	`token: '~/.openclaw/workspace/skills'`
`package/src/adapters.ts`	148	`token: 'AGENTS.md'`
`package/src/adapters.ts`	151	`token: 'config/mcporter.json'`
`package/src/adapters.ts`	173	`token: '~/.hermes/skills'`
`package/src/adapters.ts`	173	`token: '~/.agents/skills'`
`package/src/adapters.ts`	173	`token: '.agents/skills'`
`package/src/adapters.ts`	174	`token: 'AGENTS.md'`
`package/src/adapters.ts`	175	`token: '~/.hermes/config.yaml'`
`package/src/adapters.ts`	193	`token: '.dsh/skills'`
`package/src/adapters.ts`	194	`token: '.agents/skills'`
`package/src/adapters.ts`	195	`token: '~/.dsh/skills'`
`package/src/adapters.ts`	198	`token: 'AGENTS.md'`
`package/src/adapters.ts`	199	`token: 'CLAUDE.md'`
`package/src/adapters.ts`	201	`token: '.dsh/agent-pack.cordis.yml'`
`package/src/adapters.ts`	212	`token: 'data/skills'`
`package/src/adapters.ts`	212	`token: 'data/plugins'`
`package/src/adapters.ts`	222	`token: '.gemini/skills'`
`package/src/adapters.ts`	222	`token: '~/.gemini/skills'`
`package/src/adapters.ts`	222	`token: '.agents/skills'`
`package/src/adapters.ts`	224	`token: 'GEMINI.md'`
`package/src/adapters.ts`	225	`token: 'AGENTS.md'`
`package/src/adapters.ts`	228	`token: '.gemini/settings.json'`
`package/src/adapters.ts`	229	`token: '~/.gemini/settings.json'`
`package/src/adapters.ts`	238	`token: '.windsurf/skills'`
`package/src/adapters.ts`	238	`token: '.agents/skills'`
`package/src/adapters.ts`	240	`token: 'AGENTS.md'`
`package/src/adapters.ts`	241	`token: '.windsurf/rules'`
`package/src/adapters.ts`	244	`token: '.windsurf/mcp_config.json'`
`package/src/adapters.ts`	253	`token: '.github/skills'`
`package/src/adapters.ts`	253	`token: '.agents/skills'`
`package/src/adapters.ts`	255	`token: '.github/copilot-instructions.md'`
`package/src/adapters.ts`	256	`token: 'AGENTS.md'`
`package/src/adapters.ts`	259	`token: '.vscode/mcp.json'`
`package/src/adapters.ts`	260	`token: '.mcp.json'`
`package/src/adapters.ts`	269	`token: '.agents/skills'`
`package/src/adapters.ts`	269	`token: '.claude/skills'`
`package/src/adapters.ts`	271	`token: 'AGENTS.md'`
`package/src/adapters.ts`	272	`token: 'CLAUDE.md'`
`package/src/adapters.ts`	274	`token: '.mcp.json'`

文件

行

命中

package/dsh-plugin/lib/index.js

8301

token: ".cursor/skills"

package/dsh-plugin/lib/index.js

8301

token: "~/.cursor/skills"

package/dsh-plugin/lib/index.js

8303

token: ".cursor/rules"

package/dsh-plugin/lib/index.js

8304

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8307

token: ".cursor/mcp.json"

package/dsh-plugin/lib/index.js

8308

token: "~/.cursor/mcp.json"

package/dsh-plugin/lib/index.js

8317

token: ".claude/skills"

package/dsh-plugin/lib/index.js

8317

token: "~/.claude/skills"

package/dsh-plugin/lib/index.js

8319

token: "CLAUDE.md"

package/dsh-plugin/lib/index.js

8320

token: ".claude/rules"

package/dsh-plugin/lib/index.js

8323

token: ".mcp.json"

package/dsh-plugin/lib/index.js

8324

token: "~/.claude.json"

package/dsh-plugin/lib/index.js

8333

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8334

token: ".codex/skills"

package/dsh-plugin/lib/index.js

8335

token: "~/.codex/skills"

package/dsh-plugin/lib/index.js

8338

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8339

token: ".codex/AGENTS.md"

package/dsh-plugin/lib/index.js

8340

token: "~/.codex/AGENTS.md"

package/dsh-plugin/lib/index.js

8343

token: ".codex/config.toml"

package/dsh-plugin/lib/index.js

8344

token: "~/.codex/config.toml"

package/dsh-plugin/lib/index.js

8354

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8355

token: ".opencode/skills"

package/dsh-plugin/lib/index.js

8356

token: "~/.config/opencode/skills"

package/dsh-plugin/lib/index.js

8359

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8360

token: "~/.config/opencode/AGENTS.md"

package/dsh-plugin/lib/index.js

8363

token: "opencode.json"

package/dsh-plugin/lib/index.js

8364

token: "~/.config/opencode/opencode.json"

package/dsh-plugin/lib/index.js

8373

token: "~/.openclaw/workspace/skills"

package/dsh-plugin/lib/index.js

8376

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8379

token: "config/mcporter.json"

package/dsh-plugin/lib/index.js

8388

token: "~/.hermes/skills"

package/dsh-plugin/lib/index.js

8388

token: "~/.agents/skills"

package/dsh-plugin/lib/index.js

8388

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8389

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8390

token: "~/.hermes/config.yaml"

package/dsh-plugin/lib/index.js

8399

token: ".dsh/skills"

package/dsh-plugin/lib/index.js

8400

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8401

token: "~/.dsh/skills"

package/dsh-plugin/lib/index.js

8404

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8405

token: "CLAUDE.md"

package/dsh-plugin/lib/index.js

8407

token: ".dsh/agent-pack.cordis.yml"

package/dsh-plugin/lib/index.js

8415

token: "data/skills"

package/dsh-plugin/lib/index.js

8415

token: "data/plugins"

package/dsh-plugin/lib/index.js

8425

token: ".gemini/skills"

package/dsh-plugin/lib/index.js

8425

token: "~/.gemini/skills"

package/dsh-plugin/lib/index.js

8425

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8427

token: "GEMINI.md"

package/dsh-plugin/lib/index.js

8428

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8431

token: ".gemini/settings.json"

package/dsh-plugin/lib/index.js

8432

token: "~/.gemini/settings.json"

package/dsh-plugin/lib/index.js

8441

token: ".windsurf/skills"

package/dsh-plugin/lib/index.js

8441

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8443

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8444

token: ".windsurf/rules"

package/dsh-plugin/lib/index.js

8447

token: ".windsurf/mcp_config.json"

package/dsh-plugin/lib/index.js

8456

token: ".github/skills"

package/dsh-plugin/lib/index.js

8456

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8458

token: ".github/copilot-instructions.md"

package/dsh-plugin/lib/index.js

8459

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8462

token: ".vscode/mcp.json"

package/dsh-plugin/lib/index.js

8463

token: ".mcp.json"

package/dsh-plugin/lib/index.js

8472

token: ".agents/skills"

package/dsh-plugin/lib/index.js

8472

token: ".claude/skills"

package/dsh-plugin/lib/index.js

8474

token: "AGENTS.md"

package/dsh-plugin/lib/index.js

8475

token: "CLAUDE.md"

package/dsh-plugin/lib/index.js

8477

token: ".mcp.json"

package/src/adapters.ts

token: '.cursor/skills'

package/src/adapters.ts

token: '~/.cursor/skills'

package/src/adapters.ts

token: '.cursor/rules'

package/src/adapters.ts

token: 'AGENTS.md'

package/src/adapters.ts

token: '.cursor/mcp.json'

package/src/adapters.ts

token: '~/.cursor/mcp.json'

package/src/adapters.ts

token: '.claude/skills'

package/src/adapters.ts

token: '~/.claude/skills'

package/src/adapters.ts

token: 'CLAUDE.md'

package/src/adapters.ts

token: '.claude/rules'

package/src/adapters.ts

token: '.mcp.json'

package/src/adapters.ts

token: '~/.claude.json'

package/src/adapters.ts

token: '.agents/skills'

package/src/adapters.ts

token: '.codex/skills'

package/src/adapters.ts

token: '~/.codex/skills'

package/src/adapters.ts

token: 'AGENTS.md'

package/src/adapters.ts

token: '.codex/AGENTS.md'

package/src/adapters.ts

100

token: '~/.codex/AGENTS.md'

package/src/adapters.ts

103

token: '.codex/config.toml'

package/src/adapters.ts

104

token: '~/.codex/config.toml'

package/src/adapters.ts

114

token: '.agents/skills'

package/src/adapters.ts

115

token: '.opencode/skills'

package/src/adapters.ts

116

token: '~/.config/opencode/skills'

package/src/adapters.ts

119

token: 'AGENTS.md'

package/src/adapters.ts

120

token: '~/.config/opencode/AGENTS.md'

package/src/adapters.ts

123

token: 'opencode.json'

package/src/adapters.ts

124

token: '~/.config/opencode/opencode.json'

package/src/adapters.ts

145

token: '~/.openclaw/workspace/skills'

package/src/adapters.ts

148

token: 'AGENTS.md'

package/src/adapters.ts

151

token: 'config/mcporter.json'

package/src/adapters.ts

173

token: '~/.hermes/skills'

package/src/adapters.ts

173

token: '~/.agents/skills'

package/src/adapters.ts

173

token: '.agents/skills'

package/src/adapters.ts

174

token: 'AGENTS.md'

package/src/adapters.ts

175

token: '~/.hermes/config.yaml'

package/src/adapters.ts

193

token: '.dsh/skills'

package/src/adapters.ts

194

token: '.agents/skills'

package/src/adapters.ts

195

token: '~/.dsh/skills'

package/src/adapters.ts

198

token: 'AGENTS.md'

package/src/adapters.ts

199

token: 'CLAUDE.md'

package/src/adapters.ts

201

token: '.dsh/agent-pack.cordis.yml'

package/src/adapters.ts

212

token: 'data/skills'

package/src/adapters.ts

212

token: 'data/plugins'

package/src/adapters.ts

222

token: '.gemini/skills'

package/src/adapters.ts

222

token: '~/.gemini/skills'

package/src/adapters.ts

222

token: '.agents/skills'

package/src/adapters.ts

224

token: 'GEMINI.md'

package/src/adapters.ts

225

token: 'AGENTS.md'

package/src/adapters.ts

228

token: '.gemini/settings.json'

package/src/adapters.ts

229

token: '~/.gemini/settings.json'

package/src/adapters.ts

238

token: '.windsurf/skills'

package/src/adapters.ts

238

token: '.agents/skills'

package/src/adapters.ts

240

token: 'AGENTS.md'

package/src/adapters.ts

241

token: '.windsurf/rules'

package/src/adapters.ts

244

token: '.windsurf/mcp_config.json'

package/src/adapters.ts

253

token: '.github/skills'

package/src/adapters.ts

253

token: '.agents/skills'

package/src/adapters.ts

255

token: '.github/copilot-instructions.md'

package/src/adapters.ts

256

token: 'AGENTS.md'

package/src/adapters.ts

259

token: '.vscode/mcp.json'

package/src/adapters.ts

260

token: '.mcp.json'

package/src/adapters.ts

269

token: '.agents/skills'

package/src/adapters.ts

269

token: '.claude/skills'

package/src/adapters.ts

271

token: 'AGENTS.md'

package/src/adapters.ts

272

token: 'CLAUDE.md'

package/src/adapters.ts

274

token: '.mcp.json'

越权能力（17 处）

文件	行	命中
`package/dsh-plugin/lib/index.js`	5535	`exec(`
`package/dsh-plugin/lib/index.js`	5542	`exec(`
`package/dsh-plugin/lib/index.js`	5558	`exec(`
`package/src/adapters.ts`	409	`exec(`
`package/src/adapters.ts`	421	`exec(`
`package/src/adapters.ts`	423	`exec(`
`package/src/adapters.ts`	425	`exec(`
`package/src/adapters.ts`	450	`exec(`
`package/src/adapters.ts`	476	`exec(`
`package/src/adapters.ts`	478	`exec(`
`package/src/adapters.ts`	480	`exec(`
`package/src/adapters.ts`	484	`exec(`
`package/vendor/agent-knowledge/summary.ts`	37	`exec(`
`package/vendor/agent-knowledge/summary.ts`	60	`exec(`
`package/vendor/agent-knowledge/summary.ts`	78	`exec(`
`package/vendor/agent-knowledge/summary.ts`	96	`exec(`
`package/vendor/agent-knowledge/summary.ts`	115	`exec(`

文件

行

命中

package/dsh-plugin/lib/index.js

5535

exec(

package/dsh-plugin/lib/index.js

5542

exec(

package/dsh-plugin/lib/index.js

5558

exec(

package/src/adapters.ts

409

exec(

package/src/adapters.ts

421

exec(

package/src/adapters.ts

423

exec(

package/src/adapters.ts

425

exec(

package/src/adapters.ts

450

exec(

package/src/adapters.ts

476

exec(

package/src/adapters.ts

478

exec(

package/src/adapters.ts

480

exec(

package/src/adapters.ts

484

exec(

package/vendor/agent-knowledge/summary.ts

exec(

package/vendor/agent-knowledge/summary.ts

exec(

package/vendor/agent-knowledge/summary.ts

exec(

package/vendor/agent-knowledge/summary.ts

exec(

package/vendor/agent-knowledge/summary.ts

115

exec(

.env.LOG_TOKENS) │ console.log("|", cst.prettyToken(source)); │ if (this.atScalar) { ──────────────────────────────────────── Assessment: High risk (8.0/10) 3 risks detected

扫描报告 · `@sakikotgw/pack-agent`

1. 自研扫描（dshlib-scan）

硬编码密钥（132 处）

越权能力（17 处）

2. 第三方复核（GuardDog 3.2.0）

3. 依赖漏洞（OSV.dev）