dsh-plugin-guard: A Security Check Tool for DeepSeek Harness Plugins

dsh-plugin-guard is an offline static security scanning plugin designed specifically for DeepSeek Harness (DSH). It aims to address the risks associated with introducing third-party plugins by using static analysis to detect high-risk signals such as prompt injection, file corruption, credential leakage, supply chain poisoning, and Unicode spoofing. By default, the tool operates in read-only mode without code execution, and supports scanning via Harness commands or independent command-line execution. Developers should note that static scanning can only detect known risks and cannot replace sandboxing or manual review, while the exit code only indicates the risk level.