代码漏洞与 BUG 分析工具：工程审计与竞赛诊断一体的 Skill
SkillHub 社区 Skill「代码漏洞与BUG分析工具」（@user_b130948c/code-bug-analyzer，v1.0.0）面向代码审查、漏洞排查与算法分析。工程侧自动识别语言，按 Critical/High/Medium/Low 标注风险并给出修复对比；竞赛侧提供复杂度与 WA 边界诊断。支持粘贴、上传、OCR 与自然语言输入，并可生成竞赛 C++ 模板与多领域工程代码。无需 API Key，可通过 skillhub CLI 安装至 Cursor 等 skills 目录。
Read Moredsh-cn-mlps: Static MLPS Compliance Checks Based on GB/T 22239-2019
The DeepSeek Harness plugin `dsh-cn-mlps` is a compliance checking tool based on the GB/T 22239-2019 standard. It uses static analysis to scan code and configurations during the development stage, focusing on detecting issues such as default passwords, weak hashing algorithms, plaintext transmission, and debug information leakage. It helps developers remediate risks early and reduce remediation pressure in subsequent Multi-Level Protection Scheme assessments. This plugin focuses on static configuration checks and does not cover the physical environment, personnel management, or operational processes, nor can it replace professional assessments. After installation, you can run demos, list rules, and generate HTML reports via CLI commands.
Read Moredsh-ai-output-trust: Check Whether Code Directly Executes AI Output
The DeepSeek Harness plugin `dsh-ai-output-trust` is designed to detect high-risk output handling operations in large model applications. It primarily detects four high-risk usages: code execution, shell commands, SQL injection, and path traversal. By identifying variables with specific naming patterns (such as `ai*` / `llm*`), it locates potential risk points while avoiding false positives, and provides the ability to generate an HTML inspection report. This tool aims to help developers build a more secure trust boundary for AI outputs.
Read Moredsh-maintainer-doc-guard: DeepSeek Harness Long-Term Memory and Intent Guard
`dsh-maintainer-doc-guard` is a bundle for DeepSeek Harness, designed to address memory loss and intent drift caused by long-context compression. The bundle maintains project memory through the following mechanisms: 1. **Maintenance documentation reminder**: The system prompt forces the model to read maintenance documentation (such as `plan.md` and `conventions.md`) before each operation, re-dehydrating its memory. 2. **Precedent gate and intent gate**: Through a `tools/pre-execute` defense mechanism, it prevents the model from writing infrastructure code without reading precedent files and requires the model to clarify its intent before execution. 3. **Goal anchor**: The system prompt prioritizes the user's latest instructions, preventing the model from drifting from its original intent through self-derivation.
Read Moreid7869/dsh-security: DeepSeek Harness Security Audit Plugin
id7869/dsh-security is a standalone DSH plugin designed to reproduce codex-security-like security auditing capabilities in local or CI environments. It does not rely on external Python or Docker environments, using only Node.js built-in modules and local JSONL files for state storage. Its core features include a complete code auditing process, fingerprint-based deduplication, and zero static dependencies. Users can operate it using natural language or by manually executing various workflows (such as scanning, fixing, persisting, and tracking), ultimately generating multiple audit artifacts, including SARIF reports.
Read Morecot-lint: Detecting Chain-of-Thought Leakage in Code Repositories
`cot-lint` is a linter for detecting and fixing AI agent chain-of-thought leakage in code repositories. It specializes in identifying session artifacts in documentation, comments, and JSDoc, such as stale references and version markers. The tool is zero-dependency, supports multiple scan modes (including JSON output and deep scanning), and includes a built-in remediation skill, `cot-trim`. It uses strict rules to distinguish necessary standard references from ephemeral traces of thought, keeping codebase documentation clean and well suited for teams using AI-assisted coding and CI pipelines.
Read MoreIntroducing the dsh-secret-scan Plugin for DeepSeek Harness
DeepSeek Harness provides the `dsh-secret-scan` plugin for locally scanning codebases for sensitive information. The plugin works offline, is implemented in Node.js, and can recursively identify various credentials, including AWS keys, OpenAI API keys, and private keys. It generates a sanitized report that includes file paths, line numbers, and severity levels. It automatically skips directories such as `node_modules`, although heuristic scanning may produce a small number of false positives. After installation, it must be enabled in a configuration file, and it can be used by calling `secret_scan(root)`. It is recommended to manually verify findings before committing code to help prevent security risks.
Read Moredsh-code-runtime-container: Container-Isolated Code Execution Backend
`dsh-code-runtime-container` is a container isolation backend plugin for DeepSeek Harness, designed to address the insufficient isolation of the native worker-thread backend. It executes code via Docker/Podman and provides strict network, file system, resource, and permission restrictions. Users must configure the container image and be mindful of the security boundaries: this plugin does not protect the host kernel or the Docker socket, and it isolates code execution itself only, without restricting tool calls. It is suitable for running untrusted code in Code Mode.
Read Moredsh-code-security: DeepSeek Harness AI Code Security Review Plugin
`dsh-code-security` is a code security plugin in the DeepSeek Harness ecosystem. It enables code security scanning and policy gating through a deterministic rule engine and incremental review based on git diff. The plugin supports scanning (with CWE/severity evidence), closed-loop remediation verification, policy management, and SARIF/Markdown report export. Installation requires the official command and a compatible Node.js version. It provides a complete solution for Agent pre-delivery security checks, covering the full workflow from incremental review to remediation verification.
Read MoreOpenAI Official Security-Best-Practices: Performing Security Reviews of AI According to Languages and Frameworks
OpenAI has provided the `security-best-practices` Skill in the `curated` directory of the openai/skills repository. It includes 10 security specifications for common frameworks in Python, JavaScript/TypeScript and Go, and supports secure-by-default coding, passive inspection and structured security reporting. This article introduces its workflow, references library, Codex/Cursor installation methods and typical prompts, to help developers embed verifiable security review capabilities into AI-assisted programming.
Read MoreGit Repository Backup: A Comprehensive Plan for Regular Backups and Restorations
Git repository backup is crucial for ensuring code security, as it encompasses code, historical records, and branch information. Local corruption, accidental deletion by remote users, or platform failures can all lead to code loss, making regular backups essential. The core principles include multiple backups (local + remote), regular execution, and verification of recovery. For local backups: Copy the repository folder (using `cp -r` for Linux/Mac and direct copying for Windows), with regular updates. For remote backups: Utilize multi-platform backup strategies (e.g., associating two remote addresses) and export using `git bundle` to mitigate platform-specific risks. Automated backups are more reliable: Use `crontab` for Linux/Mac to schedule scripts, and Task Scheduler for Windows. In case of recovery, local corruption can be addressed by overwriting with backups, while remote corruption can be resolved by cloning or using `bundle` files. Key considerations: Separate backup paths, retain the `.git` directory, and conduct regular recovery tests. Adopting the habit of "regular local copying + multi-platform remote backups" ensures code security.
Read More