dsh-netguard：出网护栏（SSRF 防护）
`dsh-netguard` 是 DeepSeek Harness (DSH) 插件，旨在通过 `netguard` 服务和 `fetch_url` 工具防止 SSRF 攻击。该插件提供严格的出网安全防护，包括只允许公网访问、DNS 解析检查、重定向逐跳复查、流式大小限制、超时控制及端口黑名单等功能。文章详细介绍了其安装配置、典型用法（支持 JS 调用及模型工具调用），并指出了其在 DNS 重绑定、代理感知及内容安全等方面的局限性。
Read Moredsh-netguard: Egress Policies and Host Allowlist Plugin for DeepSeek Harness
`dsh-netguard` is a plugin for DeepSeek Harness (DSH) that addresses shortcomings in its sandbox mechanism for controlling network traffic. The plugin provides hostname checks, parameter pre-checks, and audit logging, operating in audit-only mode by default. During installation, ensure Harness version compatibility and explicitly enable `fetchProvider` in the configuration. When deploying it, an audit-before-enforcement approach is recommended; however, note that it cannot detect URLs passed through variables and cannot fully prevent data leakage via proxy channels.
Read More