dsh-plugin-safety: Safety Gating During DSH Plugin Installation

dsh-plugin-safety is a safety gating plugin for DeepSeek Harness (DSH) that intercepts installation requests to mitigate risks. It scores plugins by statically scanning source code (detecting issues such as RCE, secrets, and persistence mechanisms) and analyzing metadata (publication time and download counts). If a plugin is classified as high-risk or medium-risk (score ≥ 8), a review report is presented for the user’s decision; if it is safe or low-risk, installation is silently allowed. The plugin supports configuring whitelists, blacklists, and risk confirmation thresholds, and must be added to the desktop profile during installation. It is based on heuristic rules, so false positives and false negatives may occur, and it only intercepts installations initiated through the marketplace UI.