DeepAtlas (dsh-deepatlas) — DeepSeek Harness Task-Aware Plugin Navigation
DeepAtlas is a task-aware plugin navigation and auditing tool for DeepSeek Harness (DSH), aimed at mitigating plugin risks arising from the large DSH ecosystem. It scans the GitHub ecosystem, recommends plugins based on task requirements, and audits them across multiple dimensions, including provenance, code, and dependencies, while supporting local storage and controlled installation. DeepAtlas is in Public Preview and requires DSH version 0.1.1-rc and Node.js. Users can use the `deepatlas` command suite to complete the full workflow from status checking, scanning, and retrieval to auditing and confirmed installation. The tool emphasizes permission security: index and audit data are stored locally, and installation is executed only after explicit user authorization, ensuring evidence-based decision-making for plugin usage.
Read More@jieai/dsh-plugin-vet: DSH Plugin Pre-installation Audit and Runtime Guards
@jieai/dsh-plugin-vet is an MIT-licensed tool maintained by wulun811, specifically designed to provide security audits and runtime monitoring for the DeepSeek-Harness (DSH) plugin ecosystem. Given that DSH plugins run with process permissions, this plugin aims to address the needs of pre-installation audits and runtime monitoring but does not provide a plugin marketplace or default interception and mitigation functions. Its core capabilities are divided into two parts: pre-installation audits generate scorecards through deterministic static scanning, perform supply chain checks (such as typosquatting and OSV), detect data exfiltration and ransomware behavior, and establish integrity baselines; runtime monitoring enables T1 Sentinels (monitoring memory, file descriptors, and subprocesses) and T2 Hooks (intercepting filesystem, subprocess, and network calls), supporting the N7 confirm blocking mechanism. The default configuration is in report-only mode.
Read More@shaoshi/dshscan: DSH Plugin Security Scanner
@shaoshi/dshscan is a security scanner designed for DSH plugins, addressing the security risks arising from plugins running with the current process privileges. This tool is open-sourced under the MIT license. Its core functionalities include dual-channel scanning (static and semantic), built-in DSH-specific attack surface rules (such as plugin tree injection, malicious browser-side code, etc.), and integration with npm dependency auditing. It supports various input forms, including plugin names, GitHub repositories, local directories, or ZIP packages. The output comprises JSON or HTML reports that include risk scores, severity levels, and security recommendations. The tool features offline static scanning capabilities, offers optional LLM-based semantic analysis, and supports batch scanning, custom rules, policy file configuration, and web dashboard visualization. Additionally, it provides a built-in Benchmark evaluation set to test recall rates and...
Read More