dsh-taintguard: Indirect Prompt Injection Protection for DeepSeek Harness

dsh-taintguard is a security plugin for DeepSeek Harness designed to protect against indirect prompt injection attacks. It marks untrusted text with source-taint labels, restricts privileged invocations, and unconditionally refuses to pass credentials to network tools. It supports observe, ask, and deny modes, and, although its content detectors are limited, it effectively mitigates data exfiltration risks by relying on source tracking and credential interception.