dsh.so
EN
English中文
enterprise-compliance avatar

enterprise-compliance

enterprise-compliance

PluginSecurityFileStorage
Verification
L2 · Structured
Security
Critical
Health
Active
Trust
Silver

What it doesAI

Enterprise compliance plugin for SOC2/GDPR self-checks, sensitive data redaction, audit logging, and file scanning.

  • SOC2/GDPR automated compliance self-checks with scoring
  • Sensitive info redaction: email, phone, API keys, JWT, etc.
  • Audit logging of tool calls with persistent export (csv/json/text)

AI-generated from the repo README — for reference only.

Installation

dsh plugin --profile web add github:xiaoliang2/enterprise-compliance

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH VersionStatus
not statedDeclared — not tested

Requirements

  • • Node.js: not stated
  • • DSH: declared "not stated"
  • • External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SO AUDITCRITICAL2abc73
Security reviewAutomated review · daily
CRITICAL

Critical issues in blocking categories (hardcoded secrets, exfiltration endpoints, destructive operations, cryptomining). Treat this plugin as high risk.

1 critical·0 warning·0 info·10 files scanned
secrets ×1
Version binding
plugin version1.1.1dsh manifest
scanned commit2abc73a3cc052026-08-20
latest commit2abc73a3cc05

The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

Second-opinion scan (vet · parallel evaluation)
vet: suspicious

vet verdict: vet: suspicious · score 0

  • R2 · info [likely] — require()（客户端加载器 factory 形参注入，DSH bundle 标准写法）
  • R10 · info [heuristic] — 依赖清单：8 项（@deepseek-ai/cordis, @deepseek-ai/dsh-tools, @deepseek-ai/dsh-settings, @deepseek-ai/schemastery, @deepseek-ai/dsh-client-connection, @deepseek-ai/dsh-client-locale, @deepseek-ai/dsh-client-runtime, @deepseek-ai/dsh-client-ui-settings，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
  • R2 · info [likely] — require()（客户端加载器 factory 形参注入，DSH bundle 标准写法）
  • R2 · high [certain] — new Function / new AsyncFunction 动态执行
  • R2 · medium [likely] — require() 动态模块加载（npm 包内能力触达）

vet is advisory and does not change dsh’s four-tier level.

Risk: Critical1 critical · 0 warning · 0 info

• Static heuristic scan: done (10 files)

• Dependency vulnerabilities: requires deep audit (L3+)

• Permission sandboxing: requires runtime testing (L4+)

High-risk findings · 1 / 1

  • criticalHardcoded secret key (sk-…)snapshot/client.js:34
    const [text, setText] = React.useState('联系 test@example.com 或 13800138000，密钥 sk-1234567890abcdef1234567890')

Heuristic static scan — may produce false positives. Review the source yourself before trusting.

Activity

Last commit 2026-08-20 · activity: Active

• Repo created: 2026-08-20

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/xiaoliang2/enterprise-compliance

Was this page helpful?