DeepSeek Harness Plugin: dsh-plugin-guard (Static Audit and Isolation)

`dsh-plugin-guard` is a static security audit plugin for DeepSeek Harness, designed to address supply chain security risks of third-party plugins. It adopts a “gate” and “clinic” architecture, performing static auditing and hash locking before installation, and enforcing mechanical excision and capability restrictions after installation. Its core features include peer search, mechanical detoxification, and a P0-P2 risk-level-based scoring mechanism that can automatically block high-risk plugins. The tool does not execute target code or perform sanitization; developers must combine it with manual review to ensure security.