dsh-safeguard: DeepSeek Harness Plugin for Intercepting Dangerous Commands and API Keys

dsh-safeguard is a security plugin for DeepSeek Harness designed to block dangerous commands and API key leaks. It uses regex-based heuristic rules to intercept high-risk operations such as `rm -rf` and `git push --force`, as well as API key exposure, before tool execution. Users can configure toggles, add custom rules, and specify an allowlist. The plugin provides `guard_list` and `guard_check` to assist with debugging, but it only performs interception and does not provide sandbox isolation or signature verification. It should be used in conjunction with other security measures.