技能创建器 v2.0：把 Skill 从需求走到可发布文档
技能创建器 v2.0（@indiv-guipi/guipi-skill-factory）是 SkillHub 上的全功能 Agent Skill，面向新建、安装、发布与更新技能。流程为重叠评估（整合/升级/新建）、SKILL.md 安全检查、创建或升级文档，并可选择发布到虾评、GitHub 与 ClawHub。文章说明定位、四步能力、SkillHub 提示词与 CLI 安装方式（含 Cursor 等 skills 目录），并给出可复现的典型对话路径与使用注意。
Read Morewukong-healthcheck-skill：用 Agent Skill 做 OpenClaw 主机安全审计与加固
wukong-healthcheck-skill（@user_8211d795/healthcheck-skill）是 SkillHub 社区版 it-ops-security 类 Skill，面向 OpenClaw 主机的安全审计、SSH/防火墙加固、更新与暴露面检查，无需 API Key。本文说明其定位、包内脚本与 openclaw 原生命令、通过 skillhub 安装到 Cursor/Claude Code 等 skills 目录的方法，以及 quick-start、CVE/Skill 扫描示例与使用边界，并提醒 healthcheck --* 为文档示例而非真实 CLI。
Read More专业工程级技能生成器：从创建到安全门禁的 Skill 全流程
介绍 SkillHub 社区 Skill @user_cae83fba/skill-creator-optimized-pro（v2.2.0）：支持从零新手引导创建 Skill、优化 SKILL.md、修复包结构与 YAML front matter、静态校验与 15 项安全 Gate 审计，并打包发布 SkillHub。说明 skillhub CLI 安装命令、各客户端 skills 目录与典型触发话术，并明确不用于一次性提示词润色或与 Skill 无关的开发。
Read Moreagentic-actions-auditor: Auditing Security Risks in AI Agent Integrations for GitHub Actions
agentic-actions-auditor is a Skill in the Trail of Bits skills marketplace for statically auditing GitHub Actions workflows that invoke Claude Code Action, OpenAI Codex, Gemini CLI, or GitHub AI Inference. It guides an Agent to discover workflows, identify AI steps, trace composite/reusable references, and detect vectors such as environment variable relay, expression injection, unsafe sandboxing, and wildcard user allowlists. It supports local Glob scanning and fetching remote repositories via the gh api. It is intended for security review before an Agent is integrated into CI, and does not perform runtime exploitation or automatic file modification.
Read More@deepwhale-cn/dsh-alert-relay: Auditing Alert Pipeline Configuration and Sensitive Data Leakage Risks
The alerting channels of DeepSeek Harness (DSH) often leak sensitive information due to insufficient controls. The @deepwhale-cn/dsh-alert-relay plugin introduced in this article is used to statically check alert pipeline configurations, ensuring that alerts send only summaries and necessary details rather than full stack traces or user data. It provides five core features: detecting whether alerts exist, validating delivery targets, identifying sensitive information, checking plaintext HTTP usage, and discovering secret URLs in logs. Users can install it through the dsh command or npx and run a demo mode to generate a check report. The plugin helps standardize alert delivery policies, works alongside the log-retention plugin, and aims to address chained security issues through the plugin ecosystem.
Read Moreid7869/dsh-security: DeepSeek Harness Security Audit Plugin
id7869/dsh-security is a standalone DSH plugin designed to reproduce codex-security-like security auditing capabilities in local or CI environments. It does not rely on external Python or Docker environments, using only Node.js built-in modules and local JSONL files for state storage. Its core features include a complete code auditing process, fingerprint-based deduplication, and zero static dependencies. Users can operate it using natural language or by manually executing various workflows (such as scanning, fixing, persisting, and tracking), ultimately generating multiple audit artifacts, including SARIF reports.
Read Moredsh-permission-matrix: DeepSeek Harness Permission Matrix Plugin
The DSH Permission Matrix plugin divides permissions into two dimensions—sandbox mode and approval policy—and recombines them into nine presets for fine-grained, risk-tiered control. It ensures safe and auditable operations through hard denials, four-level risk policies, password-based approval, and an optional LLM judge. The plugin offers audit logs, Git snapshots, and bot session support, with flexible configuration suitable for production environments with high security requirements.
Read Moredsh-trust-check: Static Capability Disclosure of the DeepSeek Harness Plugin
`dsh-trust-check` is a static plugin audit tool for DeepSeek Harness (DSH). It analyzes plugin source code to statically disclose capability surfaces (e.g., read/write, network), injection surfaces, and provenance surfaces, providing file line numbers and source excerpts as evidence, without consuming tokens and without issuing a “secure” conclusion. The tool supports both Web UI and CLI modes (including CI gates) and returns three verdicts: Red, Requires Confirmation, and No Risk. Core features include detecting high-confidence risks such as installation scripts, core bundle overwrites, credential reads, and plaintext HTTP connections outside the internal network. The plugin exports a stable API for integrators to quickly screen plugins before installation.
Read More@goodandready/dsh-shadow-auditor: Background Security Auditing and Command Firewall for DeepSeek Harness
`dsh-shadow-auditor` is a security plugin for DeepSeek Harness (DSH) that acts as a background firewall to protect the Agent runtime environment. It provides three core capabilities: real-time scanning of code diffs to intercept API keys and credentials; AST-based analysis to block destructive terminal commands (such as `rm -rf`); and a configurable security rules engine with an audit dashboard. The plugin supports English, Chinese, and Russian, and requires explicit user override before executing dangerous scripts, effectively preventing leakage of sensitive information and accidental data destruction.
Read Moredsh-windows-settlement-proof: Offline Content-Addressed Evidence for Windows Control Plane Changes
`dsh-windows-settlement-proof` is a DSH plugin for management security, designed to verify that Windows control-plane changes (such as services and scheduled tasks) have converged to their intended state. Through static evidence comparison and fixed hash locking, it provides secure convergence verification without executing any commands or reading sensitive business data. It operates with zero execution risk, outputting only public counts, boolean values, and SHA-256 digests, making it suitable for scenarios requiring strict auditing of change implementation.
Read MoreDSh Duty Separation Proof
`dsh-duty-separation-proof` is a post-hoc audit plugin in the DeepSeek Harness (DSH) ecosystem that aims to offline, deterministically prove whether a workflow complies with duty-separation policies. Built on a receipt chain, the tool verifies rules such as identity and hash binding, process ordering, mutually exclusive subjects, quorum, and receipt continuity, then generates a content-addressed compliance report. It does not support real-time control; it only provides static validation and evidence generation based on input data, without performing authorization or managing real-time state.
Read Moremcp-cap: Pinning Changes to the MCP Server's Capability Surface
`mcp-cap` is a DSH plugin designed to address the opacity and potential security risks of MCP server capability declarations. It secures and audits servers by refusing to execute tools and applying the principle of least privilege. Core features include rejecting sensitive operations such as `tools/call`, sealing declared capabilities into a lock file to create an audit record, and detecting capability changes. Once installed, users can inspect, lock, and compare a server’s capability surface through commands such as `inspect`, `seal`, and `verify`. Its exit codes clearly indicate capability changes or upgrades, helping users prevent unauthorized privilege escalation.
Read MoreIntroducing the DeepSeek Harness Plugin: dsh-perm-gate
`dsh-perm-gate` is the permission gate plugin for DeepSeek Harness, combining approval, classification, and gating into a single package. It uses a fixed priority chain and a fail-closed mechanism to ensure that high-risk operations cannot be bypassed. Core features include command blacklists, session authorization, LLM-based risk-tier adjudication, and adjudication learning. The plugin supports a pure-function rule engine, an audit log stream, and an automatic review mode, resolving cross-plugin version coupling issues while providing a unified audit trail and fine-grained control.
Read Moreaxelfreeman/hermes-security-audit
Hermes Agent in the DeepSeek Harness (DSH) ecosystem faces host security risks when running on Linux servers and therefore requires security auditing. axelfreeman/hermes-security-audit is a security auditing plugin designed specifically for Hermes Agent. Based on a set of open-source tools, it provides ten core detection features: virus scanning, Rootkit detection, mining process identification, credential leakage checks, port auditing, SSH brute-force protection, Docker escape detection, Cron job review, SUID/SGID vulnerability analysis, and outbound connection monitoring. Users can easily load the plugin via Hermes Agent's built-in commands, trigger audits with natural-language instructions, and obtain results, from
Read Moredsh-dependency-audit: Dependency Security Audit: OSV.dev Vulnerability Scanning + Outdated npm Dependency Detection
The `dsh-dependency-audit` plugin for DeepSeek Harness (DSH) is designed to address the dependency security and version maintenance pain points in agent development. Built on pure Node.js, it queries OSV.dev and the npm registry to provide dependency auditing capabilities. It supports batch scanning of known vulnerabilities (including IDs, severity levels, and fixed versions) and detection of outdated dependencies. Users must enable the plugin in `package.json` and can then call functions such as `audit_vulnerabilities` and `audit_outdated` to check the project's security status. Together with license compliance and secret scanning plugins, it forms a three-part security suite; however, be aware of the security risks involved in running third-party code locally.
Read Morejohnxu22786/auditrail: DeepSeek Harness Security Audit and Session Forensics
`auditrail` is a Bundle plugin in the DeepSeek Harness (DSH) ecosystem that fills the gap in security auditing. By subscribing to DSH streams, it fully records tool call chains, sensitive operations, and session details, and uses SQLite WAL mode and hash chains for secure storage and tamper detection. The plugin supports sensitive operation marking, privacy masking, multi-dimensional query and export, and terminal session replay, providing a security baseline for compliance review and risk traceability in AI agent environments.
Read Morereview-gate: DeepSeek Harness Hard Code Review Gate Plugin
`review-gate` is a DeepSeek Harness plugin designed to turn code review into a hard gate. It uses deterministic static rules and optional LLM assistance to classify code issue severity, and combines a team voting mechanism to block non-compliant merge operations. The plugin supports audit log tracking, CI integration, and reuse of a lessons-learned library, ensuring code quality compliance for teams with high security requirements.
Read MoreDeepSeek Harness Plugin Introduction: dsh-loader-settlement-proof
`dsh-loader-settlement-proof` is a DeepSeek Harness administrative security plugin designed to generate deterministic, content-addressed offline JSON evidence for verifying plugin loading, tool schemas, lifecycle states, and binding relationships. It supports offline auditing, collision detection, and byte verification, and works in CLI and MCP environments. Note that the plugin only verifies the integrity of settlement receipts, does not perform actual loading or execution, and must be installed from a specified commit hash.
Read Moredsh-code-scan: Add Semgrep Code Scanning Capabilities to DeepSeek Harness Agent
The dsh-code-scan plugin is designed to address the challenges of integrating code security scanning tools with the DeepSeek Harness Agent. It wraps Semgrep and provides the Agent with a single tool interface, `code_scan`. The Agent only needs to provide a directory path, after which the plugin runs the scan locally and outputs a Chinese Markdown report grouped by file, line number, and severity level. The plugin includes a context protection mechanism that limits output to a maximum of 200 results to prevent context overflow, along with fault-tolerant handling. Before use, ensure that Semgrep is installed and configured locally. The installation command is `dsh plugin --profile web add dsh-code-scan`; the changes take effect after restarting the `dsh web` process.
Read Moredsh-security-compliance: Security Auditing and Compliance Skills
satan9394/dsh-security-compliance is a security audit and compliance skill plugin for DeepSeek Harness (DSH). Inspired by the wshobson/agents framework, it is designed to assist developers with compliance checks. Since no official installation command is provided, users need to review the source code themselves. The plugin runs with the permissions of the current process and may pose potential security risks; users should carefully verify its source and functionality. Please note that it is only a community project and has no official affiliation with DeepSeek or High-Flyer.
Read MoreStatic Security Audit Plugin for DeepSeek Harness Dynamic Cordis Plugin
The `dsh-plugin-security-audit` plugin for DeepSeek Harness (DSH) aims to provide a zero-token static security audit for dynamic plugins. It uses 16 rules to scan source code during the `cordis_define` and `cordis_run` stages, identifying dangerous capabilities, data exfiltration, and anti-patterns. The plugin adopts a fail-open design, triggering user approval only when Critical or High-level risks are detected and injecting the risk report into the conversation flow. It is installed via npm and helps developers identify high-risk patterns, but it does not provide hard blocking functionality.
Read MoreIntroducing the DeepSeek Companion Enterprise Plugin
DeepSeek Companion Enterprise is an enterprise-grade companion plugin built on DeepSeek Harness, designed to address security, collaboration, and efficiency challenges in agent development. It provides comprehensive security auditing and data loss prevention (DLP) capabilities, featuring a built-in rule engine and prompt injection detection; supports team collaboration and knowledge management with session snapshots, automatic experience distillation, and intelligent recommendations; and offers robust task orchestration and automation capabilities, including multi-step pipelines, self-healing execution, and intelligent routing. The plugin also integrates a Prompt Engineering workbench, a multi-model arena, and cost governance. Data is stored only in the local sandbox, with no user tracking; users can install and enable it via the command line.
Read Moredsh-insight — Plugin Evaluation Center
The DeepSeek Harness (DSH) plugin `dsh-insight` integrates plugin discovery, quality scoring, security auditing, and environment recipes into a single decision-making tool. Core features cover requirement recommendations, one-click environment deployment, health rankings, local security scanning, and installation decisions. The plugin depends on specific versions, supports standalone unit tests, makes no network requests by itself, and features clear security mechanisms. Users find plugins via `plugin_guide`, deploy environments with `recipe`, and use `plugin_verdict` to produce a final installation recommendation based on combined quality scores and security scan results.
Read Moredsh-plugin-finder: Search and review community plugins in DSH
`dsh-plugin-finder` is an open-source plugin for DeepSeek Harness designed to address the challenges of third-party plugin discovery and security auditing. It provides two core functions: real-time search and source code auditing. `search_dsh_plugins` enables the real-time retrieval of DSH plugins on GitHub, sorting them by star count and displaying descriptions along with installation commands. `audit_dsh_plugin` performs a read-only audit on candidate repositories, including downloading source code into a sandbox (limited to 50MB), checking installation manifests, scanning for seven categories of dangerous code patterns, and generating a "trial-to-production" installation plan that includes rollback steps. This plugin adheres strictly to the read-only principle and performs no installation actions; it caches search results in memory for 5 minutes to reduce the load on API calls. Users can install via command or temporarily...
Read Moredsh-security-audit: DSH Native Security Audit and Data Desensitization Risk Report
dsh-security-audit is a native security audit plugin (admin-security) for DSH, maintained by omdsh-dev. It scans configuration and credential metadata, plugin sources, session structures, and network exposure surfaces in a read-only manner, outputting desensitized and reproducible JSON risk reports. It provides six actions: scan_config, scan_plugins, scan_sessions, scan_network, report, and rules. It does not perform automatic repairs, connect to the internet, or execute audited plugins. It is compatible with DSH 0.1.0-rc.8 and can be installed via `dsh plugin add` from GitHub or npm pack.
Read Moredsh-secure-audit: DSH Read-Only Security and Compliance Audit Plugin
dsh-secure-audit is a read-only security plugin (admin-security) for DeepSeek Harness maintained by PensiveFei. It provides security_scan_text for prompt injection detection, security_redact_text/security_redact_json for PII and JSON redaction, security_audit for local configuration auditing, and security-review skill. The plugin does not write to or execute the audited system; reports are redacted and include reportSha256 self-verification. Installation: dsh plugin add dsh-secure-audit; requires Node ≥20 and @deepseek-ai/dsh-tools >=0.1.0-rc.7.
Read MoreConduct a read-only security audit of the local DeepSeek Harness using dsh-security-audit
`dsh-security-audit` is a native security audit plugin for DeepSeek Harness maintained by omdsh-dev. It performs read-only scans of configurations, credential metadata, plugin sources, session structures and network attack surfaces, and outputs desensitized and reproducible risk reports. This article verifies the installation commands, six actions, rule boundaries and precautions against the community directory page and GitHub README.
Read More1. Auditing-Security: Systematically Audit Code Repositories with Agent Skill
### Introduction to awesome-cursor-skills Selected Skill auditing-security: Write review steps including OWASP Top 10, key leakage, injection and dependency vulnerabilities into SKILL.md for agents such as Cursor to conduct systematic audits of business code according to the 7-step checklist. The content covers installation methods, prompt examples, and the complementary relationship with Skill supply chain security tools such as SkillScan.
Read More