dsh-plugin-audit: A Security Audit Plugin for DSH Third-Party Plugins
`dsh-plugin-audit` is a security audit plugin for DeepSeek Harness (DSH), maintained by `jkrandom-sudo`. It provides static permission profiling and runtime sentinel functionality, helping administrators evaluate the permission surface of third-party plugins before running them. Core features include: 1. **Static permission profiling**: Uses `plugin_audit` to scan plugin directories, source code, and configuration files, generating permission reports with file line number evidence, displaying all network surfaces, for manual review only, without making final risk judgments. 2. **Runtime sentinel**: Listens for tool invocation events, triggering approval requests when credential path references, access to non-whitelisted hosts, or writes to home directory dotfiles are involved; if no approval channel exists, it directly rejects. The sentinel only checks tool names and arguments.
Read MoreConduct Permission Profiling Before Installing Third-party DSH Plugins with dsh-plugin-audit
dsh-plugin-audit is a DeepSeek Harness development and runtime plugin maintained by jkrandom-sudo. It performs static permission profiling on third-party plugin source code, listing files, processes, hosts, environment variables and credential paths along with line numbers; the runtime sentry will request your approval first when tool invocations touch credentials or make outbound connections to unknown hosts. It is licensed under MIT, and the current version is 0.1.2.
Read More