dsh-plugin-safety: Safety Gating During DSH Plugin Installation
dsh-plugin-safety is a safety gating plugin for DeepSeek Harness (DSH) that intercepts installation requests to mitigate risks. It scores plugins by statically scanning source code (detecting issues such as RCE, secrets, and persistence mechanisms) and analyzing metadata (publication time and download counts). If a plugin is classified as high-risk or medium-risk (score ≥ 8), a review report is presented for the user’s decision; if it is safe or low-risk, installation is silently allowed. The plugin supports configuring whitelists, blacklists, and risk confirmation thresholds, and must be added to the desktop profile during installation. It is based on heuristic rules, so false positives and false negatives may occur, and it only intercepts installations initiated through the marketplace UI.
Read Moredsh-security-guard: Static and Runtime Security Plugin for DeepSeek Harness
`dsh-security-guard` is a DeepSeek Harness (DSH) security plugin maintained by `bigclawd`, designed to address potential malicious calls, prompt injection, and token waste within the plugin ecosystem caused by third-party code. The plugin is released under the MIT license; its core mechanism combines static scanning with runtime protection to ensure scanned code is not executed or imported. Its main features include rule-based static analysis of source files, runtime interception prior to dangerous tool calls, prompt steps, and file operations, and the categorization of results as `block`, `warn`, or `clean`, with support for JSON or human-readable report output. Rules use standard JSON format, support overriding by ID, and support Profile management.
Read More