dsh-sound-lab

语音控制插件（安洁莉娜「hirari do～」）

PluginMedia

Verification

L2 · Structured

Security

Critical

Health

Active

Trust

Silver

What it does

语音控制插件（安洁莉娜「hirari do～」）

Installation

dsh plugin --profile web add dsh-sound-lab

Install method: npm · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SOCRITICALSCAN7 FILES

9ec773

Security reviewAutomated review · daily

CRITICAL

Critical issues in blocking categories (hardcoded secrets, exfiltration endpoints, destructive operations, cryptomining). Treat this plugin as high risk.

2 critical·3 warning·10 info·7 files scanned

network ×1code-exec ×1

Version binding

plugin version1.2.1dsh manifest

scanned commit9ec77335ed162026-08-19

latest commit9ec77335ed16

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Risk: Critical2 critical · 3 warning · 10 info

• Static heuristic scan: done (7 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 5 / 5

criticalKnown data-exfiltration endpoint (webhook / paste service)tools/api/tts_api.py:242
('0x0.st', 'https://0x0.st', 'file', None, 'text'),
criticalChild process module usage (Node.js)tools/install.mjs:21
import { spawnSync, spawn } from "node:child_process";
warningFilesystem write operationslib/index.js:239
await fs.writeFile(CONFIG_FILE, JSON.stringify(Object.assign({}, cfg, { [TTS_CONFIG_KEY]: next }), null, 2), "utf8");
warningFilesystem write operationslib/index.js:453
await fs.writeFile(MANIFEST_FILE, JSON.stringify({ [MANIFEST_KEY]: sounds }, null, 2), "utf8");
warningFilesystem write operationslib/index.js:535
await fs.writeFile(CONFIG_FILE, JSON.stringify(body, null, 2), "utf8");

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-18 · activity: Active

• Repo created: 2026-08-19

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/miiaowuwu/dsh-sound-lab