Introduction¶

Plugins for DeepSeek Harness (DSH) run within the host process. Once enabled, plugins can typically access the shell, file system, network, and various credentials. Packages in the community directory come from diverse sources; installation scripts, native dependencies, external domains, and dangerous APIs may all be hidden in the manifest or source code. The common practice is to trust them by feeling after installation or to manually check the repository yourself; the former carries high risk, while the latter is time-consuming and prone to missing signals.

The positioning of dsh-warden is: before you click “Enable”, it performs static reading and cross-referencing on the target package, providing a 100-point score and a list of findings, without executing, proxying, or modifying any content of the audited plugin.

What is it¶

• Name: dsh-warden (npm package name, repository Daphne999/dsh-warden)
• Maintainer: Daphne999
• Category: admin-security (Admin / Security)
• Version (Source: package.json): 0.1.1
• License: MIT

In a nutshell: a pre-installation security checkup; read the code, compare with market claims, output risk conclusions, without running the audited package.

Core Features¶

Below are the capabilities explicitly written in the plugin’s documentation, all sourced from the project README and package.json.

Reading Manifest and Dependencies¶

1. Read package.json: Check installation scripts (e.g., preinstall / install / postinstall / prepare), native dependencies, and whether the manifest is complete.

Scanning Source Code (Static)¶

Perform pattern matching on the source code, including but not limited to:

• External domains
• child_process, eval, vm, dynamic Function
• Recursive deletion, writing startup items, credential-related paths (e.g., .ssh, .env, credentials.yaml, .npmrc)

Cross-referencing Market Registry¶

• Whether capability declarations match the scan results
• Compare with directory info (e.g., red-line flags, star count, whether installed solely via git)

Output¶

• 100-point score
• Judgment Tier: safe / caution / risky (README: ≥75 is safe, ≥50 is caution, otherwise risky)
• Line-by-line findings (including license, number of scanned files, domain list, etc. in examples)

The scoring weights are in a table in the README: installation scripts, credential paths, eval/vm are high-weight; child_process, native modules are medium-weight; external unknown domains, too few stars are low-weight. The documentation emphasizes: the score is not a verdict — for example, using child_process might be inherent to browser plugins, but it requires more of your awareness than pure UI plugins.

What it Explicitly Does Not Do¶

• Does not execute the audited plugin code
• Does not proxy downloads, does not modify package.json, does not touch node_modules
• Does not perform real behavior sandboxing, only performs static judgment of “detectable risks”

Installation and Enablement¶

Install according to the official README in DSH (web profile):

dsh plugin --profile web add dsh-warden

After installation, the agent will gain the audit tool (tool name is subject to runtime registration; the README example is warden_audit).

Typical Usage¶

Initiate an audit against an installed package name or local absolute path (convenient for development and debugging). README example:

warden_audit { "target": "dsh-ego-browser" }

target can be an installed package name or the absolute path of the plugin directory.

Output example (excerpted from README, illustrating the format rather than recommending a specific third-party package):

⚠️ dsh-ego-browser v0.9.8 —— 评分 74/100（caution）
license: MIT | 扫描文件 2 个
🟠 源码用到「child_process」：lib\index.js
🟠 源码用到「execSync / spawnSync」：lib\index.js
🟠 市场标注它拥有 shell 执行能力
ℹ️ 会连接 4 个外部域名：gh-proxy.com, www.w3.org, dsh.internal, example.com

After the above steps, you can treat caution as a signal to “read the findings” rather than equating it directly to malice.

Applicable Scenarios and Notes¶

Who is it for

• Want to quickly see installation scripts, external connections, and dangerous APIs before installing unfamiliar DSH plugins from the community directory
• Managing a multi-plugin environment and need to cross-reference market capability declarations with source code scan results

Must Note

1. Any DSH plugin ultimately runs with the current DSH process permissions; dsh-warden can only reduce the “information gap of things unseen before installation” and cannot replace your judgment on license, author, and business requirements.
2. Static scanning cannot cover runtime behavior; the README also states that unshare/container-level sandboxing is not used, positioning it as a “few-millisecond checkup” rather than a complete security audit report.
3. The community plugin directory is an independent site ecosystem with no official affiliation with DeepSeek / Hypersphere; directory fields like stars participate in low-risk weighting but should not be used as the sole basis for trust.

Conclusion¶

dsh-warden turns “opening package.json and source code, comparing with market claims, and providing scores and findings” into a single read-only call, suitable as a routine check before enabling. Directory page: https://www.skillhub.cn/plugins/Daphne999/dsh-warden; Source code and docs: https://github.com/Daphne999/dsh-warden.