← 返回扫描报告总表 · ← dshlib 图书馆

扫描报告 · zhu1090093659/dsh-trading

自研扫描：⚠️ 待审 · GuardDog 复核：未扫描 · OSV 依赖：未扫描

1. 自研扫描（dshlib-scan）

verified

True

findings

{'dangerous_commands': [{'file': 'dsh-trading-main/.agents/notes/implemented/process/2026-08-31-shadow-profile-pr-review.md', 'line': 30, 'match': 'rm -rf node_modules/', 'label': 'rm -rf 危险删除'}, {'file': 'dsh-trading-main/.agents/notes/implemented/process/2026-09-10-sdk-upgrade-npm-0.1.5-rc.1.md', 'line': 158, 'match': 'rm -rf @dshtrading/', 'label': 'rm -rf 危险删除'}, {'file': 'dsh-trading-main/scripts/profile-config-preflight.sh', 'line': 151, 'match': 'rm -rf <profile>/node_modules/@dshtrading/', 'label': 'rm -rf 危险删除'}, {'file': 'dsh-trading-main/scripts/refresh-trading-web-profile.sh', 'line': 46, 'match': 'rm -rf "$PROFILE/node_modules/@dshtrading/', 'label': 'rm -rf 危险删除'}, {'file': 'dsh-trading-main/scripts/refresh-trading-web-profile.sh', 'line': 48, 'match': 'rm -rf "$PROFILE"/node_modules/@dshtrading/', 'label': 'rm -rf 危险删除'}, {'file': 'dsh-trading-main/spikes/impl-b/EVIDENCE.md', 'line': 32, 'match': 'rm -rf ~/.dsh-trading-presets/', 'label': 'rm -rf 危险删除'}], 'data_exfiltration': [{'file': 'dsh-trading-main/.agents/skills/dsh-trading-release/SKILL.md', 'line': 84, 'match': 'tokenized HTTP URL、curl', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/src/plugin.ts', 'line': 52, 'match': "tokenRef' | 'timeoutMs'>, overrides: { fetchImpl?: typeof globalThis.fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/flash-service.test.ts', 'line': 21, 'match': "token: () => 'sk-test', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/flash-service.test.ts', 'line': 35, 'match': "token: () => 'sk-test', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/macro-service.test.ts', 'line': 37, 'match': "token: () => 'sk-test', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/mcp.test.ts', 'line': 32, 'match': 'token, fetch', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/tools.test.ts', 'line': 49, 'match': "token: () => 'sk-test', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/tools.test.ts', 'line': 152, 'match': "token: () => 'sk-test', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-okx/src/rest.ts', 'line': 102, 'match': 'credentials.secret, signaturePrehash(timestamp, method, request', 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/packages/connector-tushare/test/trade-gate.test.ts', 'line': 37, 'match': "token: 't', fetch", 'label': '凭据字段进入网络请求'}, {'file': 'dsh-trading-main/spikes/impl-crypto-news/cryptopanic-api-doc.html', 'line': 141, 'match': 'api_key": "/web-api/api-regenerate-key/", "settings_sources_list": "/web-api/sou', 'label': '凭据字段进入网络请求'}], 'excessive_permissions': [{'file': 'dsh-trading-main/desktop/scripts/stage-pnpm.mjs', 'line': 52, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/desktop/src/runtime.cjs', 'line': 200, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/desktop/src/runtime.cjs', 'line': 212, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/base/test/gate.test.ts', 'line': 15, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/base/test/gate.test.ts', 'line': 88, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/base/test/gate.test.ts', 'line': 97, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/base/test/gate.test.ts', 'line': 100, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/base/test/gate.test.ts', 'line': 103, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/client-ui-strategies/src/client/toolview-parse.ts', 'line': 126, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/client-ui-strategies/src/client/toolview-parse.ts', 'line': 137, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/client-ui-trading/src/client/market-vocab.ts', 'line': 48, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/client-ui-updater/src/semver.ts', 'line': 22, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-eastmoney/src/rest.ts', 'line': 89, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-eastmoney/src/rest.ts', 'line': 113, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-eastmoney/src/rest.ts', 'line': 113, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-eastmoney/src/rest.ts', 'line': 113, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-hithink/src/rest.ts', 'line': 61, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-hithink/src/rest.ts', 'line': 65, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-jin10/src/parse.ts', 'line': 82, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-jin10/src/parse.ts', 'line': 95, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-okx/src/rest.ts', 'line': 148, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-stooq/src/rest.ts', 'line': 96, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-stooq/src/rest.ts', 'line': 108, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 71, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 105, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 131, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 169, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 188, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 200, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 205, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 521, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-tencent/src/rest.ts', 'line': 674, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-xysz/src/rest.ts', 'line': 73, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-xysz/src/rest.ts', 'line': 79, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/connector-xysz/src/rest.ts', 'line': 86, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-cn/src/fundamentals.ts', 'line': 50, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-cn/src/fundamentals.ts', 'line': 141, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-cn/src/fundamentals.ts', 'line': 201, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-cn/src/news.ts', 'line': 141, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-hk/src/fundamentals.ts', 'line': 76, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-hk/src/fundamentals.ts', 'line': 131, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/packages/kit-hk/src/news.ts', 'line': 203, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 221, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 268, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 285, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 298, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 300, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/i18n-audit.mjs', 'line': 304, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/sync-profile-overrides.mjs', 'line': 53, 'match': 'execSync(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/test-audit.mjs', 'line': 140, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/scripts/test-audit.mjs', 'line': 171, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-hithink-kline-futures/verify.mjs', 'line': 22, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-hithink-news-recon/verify.mjs', 'line': 28, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-jin10-mcp/verify.mjs', 'line': 58, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-jin10-mcp/verify.mjs', 'line': 64, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-us/stooq-probe.mjs', 'line': 44, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-us/stooq-probe2.mjs', 'line': 33, 'match': 'exec(', 'label': '命令执行'}, {'file': 'dsh-trading-main/spikes/impl-us/stooq-probe3.mjs', 'line': 15, 'match': 'exec(', 'label': '命令执行'}], 'hardcoded_secrets': [{'file': 'dsh-trading-main/docs/connectors-guide.md', 'line': 80, 'match': 'token: "sk-你的金十 MCP Token"', 'label': '明文凭据'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/plugin.test.ts', 'line': 59, 'match': "token: 'sk-settings'", 'label': '明文凭据'}, {'file': 'dsh-trading-main/packages/connector-jin10/test/plugin.test.ts', 'line': 94, 'match': "token: 'sk-settings'", 'label': '明文凭据'}, {'file': 'dsh-trading-main/packages/connector-tushare/test/template.test.ts', 'line': 61, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-trading-main/packages/connector-tushare/test/template.test.ts', 'line': 87, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-trading-main/packages/connector-tushare/test/template.test.ts', 'line': 118, 'match': "token: 'test-token'", 'label': '明文凭据'}, {'file': 'dsh-trading-main/spikes/impl-service-seam-gate/net-verify.mjs', 'line': 26, 'match': "secret: 'spike-placeholder'", 'label': '明文凭据'}], 'manifest_contract': [{'file': 'cordis.patch.yml', 'line': 0, 'match': 'id: agent-presets', 'label': '重复 loader id「agent-presets」（2 次声明）——可能触发 duplicate loader entry 崩溃'}]}

mode

git-refresh

branch

main

2. 第三方复核（GuardDog 3.2.0）

未复核。

3. 依赖漏洞（OSV.dev）

未查询。