← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · PlutoKeating/dsh-lark-bot

自研扫描：⚠️ 待审 · GuardDog 复核：未扫描 · OSV 依赖：未扫描

1. 自研扫描（dshlib-scan）

verified

True

findings

{'data_exfiltration': [{'file': 'dsh-lark-bot-main/docs/API.md', 'line': 1178, 'match': 'secret` 与 `lark_request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/docs/security/2026-08-17-impostor-repo-evidence/api-snapshots/npm-official-dsh-feishu-bot-latest.json', 'line': 1, 'match': 'token) accepts the call and the message card is delivered to the target scope wi', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/docs/security/2026-08-17-impostor-repo-evidence/api-snapshots/npm-official-dsh-lark-bot-latest.json', 'line': 1, 'match': 'token) accepts the call and the message card is delivered to the target scope wi', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/package.json', 'line': 115, 'match': 'token) accepts the call and the message card is delivered to the target scope wi', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/release-highlights/v0.18.0.md', 'line': 4, 'match': 'secret forms plus `lark_request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/bridge/channel.ts', 'line': 466, 'match': "secretService']>['request", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/bridge/channel.ts', 'line': 472, 'match': 'secretRequests!.get(input.scope, request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/bridge/channel.ts', 'line': 478, 'match': 'secretRequests!.cancel(input.scope, request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/bridge/channel.ts', 'line': 688, 'match': 'secret request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/commands/index.ts', 'line': 1228, 'match': 'secretService!.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/commands/index.ts', 'line': 1329, 'match': 'secretService.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/commands/models.ts', 'line': 421, 'match': 'secretService.request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/commands/session-projection.ts', 'line': 68, 'match': 'tokens.length > 0 && !request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/notify/secret-tool.ts', 'line': 27, 'match': "token || !sessionId) throw new Error('lark_request", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/notify/sinks/qq.ts', 'line': 45, 'match': 'token = await this.fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/src/skill/dsh-lark-bot.ts', 'line': 16, 'match': 'credentials protocol, and registered channel tools. Re-read status after a chang', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/test/commands/models.test.ts', 'line': 145, 'match': 'secretService = { request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-lark-bot-main/test/commands/models.test.ts', 'line': 193, 'match': 'secretService = { request', 'label': '凭据字段进入网络请求'}], 'dangerous_commands': [{'file': 'dsh-lark-bot-main/docs/DSH_RC8_AUDIT.md', 'line': 21, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/docs/PLAN.md', 'line': 138, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/release-highlights/v0.17.2.md', 'line': 6, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/release-highlights/v0.19.2.md', 'line': 6, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/adapters/dsh/sdk-adapter.ts', 'line': 284, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/adapters/dsh/sdk-server.ts', 'line': 91, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/adapters/dsh/sdk-server.ts', 'line': 97, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/adapters/dsh/web-adapter.ts', 'line': 321, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/adapters/types.ts', 'line': 100, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/guardian.ts', 'line': 136, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/guardian.ts', 'line': 138, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/guardian.ts', 'line': 139, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/guardian.ts', 'line': 142, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/guardian.ts', 'line': 143, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/run.ts', 'line': 994, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/run.ts', 'line': 995, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/run.ts', 'line': 996, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/run.ts', 'line': 999, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/cli/commands/run.ts', 'line': 1000, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/src/session/projection-bridge.ts', 'line': 672, 'match': 'shutdown', 'label': '系统关机'}, {'file': 'dsh-lark-bot-main/test/adapters/dsh/web-adapter.test.ts', 'line': 73, 'match': 'shutdown', 'label': '系统关机'}], 'excessive_permissions': [{'file': 'dsh-lark-bot-main/scripts/probe-dsh-compat.mjs', 'line': 335, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/scripts/release-notes.mjs', 'line': 40, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/card/config-cards.ts', 'line': 410, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/card/question-card.ts', 'line': 104, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/guardian/control.ts', 'line': 38, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/guardian/process.ts', 'line': 131, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/guardian/process.ts', 'line': 257, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/guardian/process.ts', 'line': 258, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/service/macos-launchd.ts', 'line': 147, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/src/upgrade/versions.ts', 'line': 28, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/bridge/run-flow.test.ts', 'line': 1695, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/bridge/run-flow.test.ts', 'line': 1724, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/notify/approval-handler.test.ts', 'line': 82, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/notify/ask-handler.test.ts', 'line': 32, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/notify/plan-handler.test.ts', 'line': 42, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-lark-bot-main/test/notify/secret-handler.test.ts', 'line': 10, 'match': 'exec(', 'label': '命令执行'}], 'hardcoded_secrets': [{'file': 'dsh-lark-bot-main/src/card/run-renderer.ts', 'line': 157, 'match': "token: 'down-small-ccm_outlined'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/card/run-renderer.test.ts', 'line': 127, 'match': "token: 'PRIVATE_INPUT_CANARY'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/compat-approval-fixture.test.ts', 'line': 28, 'match': "token: 'compat-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/compat-approval-fixture.test.ts', 'line': 34, 'match': "token: 'compat-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/config/security.test.ts', 'line': 27, 'match': 'sk-abcdef1234567890abcdef', 'label': 'OpenAI API key'}, {'file': 'dsh-lark-bot-main/test/core/logger.test.ts', 'line': 20, 'match': "token: '[redacted]'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/core/logger.test.ts', 'line': 30, 'match': "token: 'secret-one'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 19, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 35, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 40, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 61, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 91, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 110, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 132, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 145, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 163, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 181, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 193, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 205, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 216, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 235, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 247, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 270, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 283, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 310, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 322, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 349, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 360, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 380, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 388, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 405, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 415, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 437, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 442, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/server.test.ts', 'line': 466, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/sinks/channel-store.test.ts', 'line': 57, 'match': "secret: 'super-long-token-value'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/sinks/qq.test.ts', 'line': 12, 'match': "secret: 'appId:clientSecret'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/sinks/qq.test.ts', 'line': 48, 'match': "secret: 'appIdOnly'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/sinks/wechat.test.ts', 'line': 12, 'match': "secret: 'bot-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/notify/sinks/wecom.test.ts', 'line': 7, 'match': "secret: 'webhook-key'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/test/onboard/sink-qr.test.ts', 'line': 147, 'match': "token: 'bot-token'", 'label': '明文凭据'}, {'file': 'dsh-lark-bot-main/tsup.config.ts', 'line': 15, 'match': "secret: 'src/notify/secret-tool.ts'", 'label': '明文凭据'}]}

mode

git-refresh

branch

main

2. 第三方复核（GuardDog 3.2.0）

未复核。

3. 依赖漏洞（OSV.dev）

未查询。