dsh.so
EN
English中文
dsh-plugin-stock avatar

dsh-plugin-stock

DSH 股票监控插件 - 实时行情、K线、持仓监控、AI 对话式查询（仅监控）

PluginFinance
Verification
L1 · Found
Security
High
Health
Active
Trust
Unrated

What it does

DSH 股票监控插件 - 实时行情、K线、持仓监控、AI 对话式查询（仅监控）

Installation

dsh plugin --profile web add github:yllyx/dsh-plugin-stock

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOHIGH-RISKSCAN11 FILES
77a3f2
Security reviewAutomated review · daily
HIGH-RISK

Critical findings in non-blocking categories (dynamic code execution, shell execution, install scripts, obfuscation). Common in CLI/terminal plugins but worth reviewing.

7 critical·4 warning·17 info·11 files scanned
shell ×4code-exec ×3
Version binding
plugin version—
scanned commit77a3f2d09ff62026-08-19
latest commit77a3f2d09ff6

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: High7 critical · 4 warning · 17 info

• Static heuristic scan: done (11 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 11 / 11

  • criticalChild process module usage (Node.js)plugin/lib/backend-manager.js:12
    import { spawn } from "node:child_process";
  • criticalChild process module usage (Node.js)plugin/publish-and-submit.js:10
    import { execSync } from "node:child_process";
  • criticalShell command execution (exec / execSync)plugin/publish-and-submit.js:101
    execSync("node publish.js --publish --yes", { stdio: "inherit" });
  • criticalChild process module usage (Node.js)plugin/publish.js:22
    import { execSync, spawn } from "node:child_process";
  • criticalShell command execution (exec / execSync)plugin/publish.js:96
    return execSync(cmd, { stdio: "pipe", encoding: "utf-8", ...opts }).trim();
  • criticalShell command execution (exec / execSync)plugin/publish.js:190
    execSync("node test_apply.js", { stdio: "inherit" });
  • criticalShell command execution (exec / execSync)plugin/publish.js:239
    const output = execSync("npm pack --dry-run 2>&1", { encoding: "utf-8" });
  • warningHTTP request to a raw IP addressplugin/backend/launch.sh:26
    echo "访问 http://127.0.0.1:8765/docs 查看 API 文档"
  • warningHTTP request to a raw IP addressplugin/lib/backend-manager.js:80
    const resp = await fetch(`http://127.0.0.1:${this.port}/health`);
  • warningHTTP request to a raw IP addressplugin/lib/backend-manager.js:203
    return `http://127.0.0.1:${this.port}`;
  • warningHTTP request to a raw IP addressplugin/lib/client.js:15
    const PLUGIN_API_BASE = "http://127.0.0.1:8765";

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-19 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/yllyx/dsh-plugin-stock

Was this page helpful?