Preface¶

A common scenario in the DSH environment is: a plugin needs to be added to a profile, or needs to be provided as an Agent Tool for the agent. In this case, developers must first determine whether the plugin contains behaviors such as command execution, credential access, data exfiltration, obfuscation, or unsafe installation scripts.

The following introduces Eligahyu/dsh-sentinel-scanner. It is a read-only security, supply-chain, and health scanner designed for DeepSeek Harness (DSH) plugins, applicable to plugin source trees, published npm packages, DSH profiles, and CI pipelines.

What Is This¶

Eligahyu/dsh-sentinel-scanner is a read-only security, supply-chain, and health scanner for DeepSeek Harness plugins, maintained by Eligahyu, under the MIT license.

Its core positioning is: performing static checks on plugins before running the plugin code, and outputting structured reports. The scan results include a 0-100 risk score, along with a safe / review / risky / dangerous verdict.

The same set of capabilities is available in the following forms:

• DSH Agent Tool plugin: sentinel_scan, sentinel_scan_profile, sentinel_audit_package
• Standalone CLI: npm package deepseek-harness-sentinel, with the executable command dsh-sentinel
• GitHub Action, supporting SARIF upload
• JavaScript API for programmatic integration

It is not a runtime sandbox or a plugin executor. Verified documentation confirms: scanned code is never executed.

Core Capabilities¶

The following are the capabilities covered in this article.

Static Detection Rules¶

It uses 51 heuristic rules with AST-based taint analysis.

Detectable issue types include:

• command execution
• dynamic code evaluation
• credential access
• data exfiltration
• obfuscation
• unsafe lifecycle scripts
• persistence
• native binaries
• manifest escape paths
• package drift

Scan Modes¶

Three scan modes are provided:

• source
• package
• profile

Among them, profile is used for DSH profile scenarios, package for package-level scenarios, and source for source tree scenarios.

Pre-install Quarantine¶

For npm tarballs, it can perform a pre-install quarantine without executing lifecycle scripts.

The verified process is: download the tarball, verify integrity, unpack into quarantine, scan, and clean up. It does not run npm install.

Reports and CI¶

It supports:

• SBOM export
• SARIF output
• CI policy enforcement

In CI, it can affect the exit code based on risk levels and scan completeness.

Privacy and External Queries¶

The verified documentation includes:

• Secrets are always redacted in reports
• Optional OSV lookup is disabled by default
• When OSV lookup is enabled, only the package name and version are sent

TypeScript Boundary¶

The verified documentation states: TypeScript parser limits are reported as a capability boundary instead of falsely failing every TypeScript scan.

That is, when encountering TS parsing boundaries, the report reflects the capability boundary rather than directly marking all TypeScript scans as failures.

Installation and Activation¶

Installing as a DSH Plugin¶

If you wish to use it as a DSH Agent Tool plugin, the provided command is:

dsh plugin --profile web add github:Eligahyu/dsh-sentinel-scanner

After installation, it can be called via DSH Agent Tools:

sentinel_scan
sentinel_scan_profile
sentinel_audit_package

Using as a Standalone CLI¶

The standalone CLI npm package is deepseek-harness-sentinel, with the executable command dsh-sentinel.

Requirements:

Node.js ^22.18.0 or >=24.11.0

It can be run temporarily:

npx deepseek-harness-sentinel ./path/to/plugin

Or installed as a project dependency:

npm install --save-dev deepseek-harness-sentinel
npx dsh-sentinel ./path/to/plugin

Peer dependencies are optional:

@deepseek-ai/cordis
@deepseek-ai/dsh-tools

Typical Usage¶

The following examples are all from verified usage.

Generating JSON Report¶

npx deepseek-harness-sentinel ./plugin --json --out sentinel.json

This step scans ./plugin and writes the results to sentinel.json.

Scanning Package Artifacts and Outputting SARIF¶

npx deepseek-harness-sentinel ./plugin --mode package --format sarif --out sentinel.sarif

This step uses package mode and outputs a SARIF file.

Setting Failure Policies in CI¶

npx deepseek-harness-sentinel ./plugin --fail-on high --fail-on-incomplete --strict-exit-codes

This step means: when there are high-level results or an incomplete scan, CI can fail based on the exit code.

Auditing npm Packages Before Installation¶

npx deepseek-harness-sentinel audit-install some-plugin@1.2.3

This step is used for pre-install auditing. Verified documentation states: it does not run npm install, but rather downloads the tarball, verifies integrity, unpacks into quarantine, scans, and cleans up.

Comparing Source Tree with Published Package¶

npx deepseek-harness-sentinel diff ./plugin some-plugin@1.2.3

This step compares the local source tree with the specified npm package.

Viewing the Rules Catalog¶

npx deepseek-harness-sentinel --rules

This step prints the complete rule catalog.

Applicable Scenarios and Considerations¶

This tool is suitable for two types of users:

• Plugin consumers: checking third-party plugins before installation or activation
• Plugin authors and maintainers: checking for dangerous behaviors, packaging drift, incomplete scans, and manifest issues before publishing

What needs to be clear is that this is heuristic static analysis, not a security proof. The meaning of a finding is: review the evidence, rather than directly concluding the plugin is malicious.

Meanwhile, DSH plugins run within the permission scope available to the current dsh process at runtime. Therefore, you should still check the source code, license, and scan results before installation.

Practical considerations include:

• Static analysis does not execute the scanned code
• TypeScript parsing boundaries are reported as capability boundaries
• Secrets are redacted in reports
• Optional OSV lookup is disabled by default
• When OSV lookup is enabled, only the package name and version are sent
• Peer dependencies @deepseek-ai/cordis and @deepseek-ai/dsh-tools are optional

Conclusion¶

The value of Eligahyu/dsh-sentinel-scanner lies in making the pre-install inspection of DSH plugins a repeatable action that can be integrated into CI and can produce reports. For developers who need to enable third-party plugins, publish plugins, or add Agent Tools to DSH profiles, it provides a static inspection entry point that does not execute the scanned code.

Repository address:

https://github.com/Eligahyu/dsh-sentinel-scanner

If searching in the DSH plugin directory, the entry name is:

Eligahyu/dsh-sentinel-scanner