技能安全扫描修复：扫描并处理 Skill 文件中的高风险内容
技能安全扫描修复是 SkillHub 社区技能 @user_5f9c21aa/skill-security-scanner-pro（v1.0.0，it-ops-security），用于扫描并修复 Skill 文件中的高风险内容，并在需要时检查漏洞与验证修复。无需 API Key。本文介绍其定位、可核实功能、通过 skillhub CLI 与 Cursor 等目录的安装方式，以及对话式典型用法与使用注意。
Read More自创技能安全检测技能：第三方 Skill 八大维度安全扫描
SkillHub 社区技能「自创技能安全检测技能」（@user_c64d3056/sin129，v1.0.0）面向第三方 Skill，从恶意代码、高危调用、硬编码密钥、Prompt 注入、权限越权、依赖安全、数据合规与源码篡改等八个维度扫描，输出风险评分、等级、检测报告与审核建议。无需 API Key。文章说明定位、八维能力、skillhub CLI 安装到 Cursor/Claude Code 等 skills 目录的步骤，以及上线前审核与定期巡检等场景；安装与路径以 SkillHub 官方文档为准。
Read Moreskill-scanner：安装前本地静态扫描 Agent Skill 安全风险
skill-scanner 是 SkillHub 社区 Skill（@user_87fe1a85/gwchen17，v1.0.0），由腾讯朱雀 Lab A.I.G（AI-Infra-Guard）支撑，在安装或使用任意 Agent Skill 前做 100% 本地静态安全分析，文件与凭据不外传。无需 API Key，兼容 Cursor、Claude Code、Windsurf、OpenClaw 等。文章说明核心能力、skillhub CLI 安装路径与对话触发语，并区分其与日常开发调试类请求的边界。
Read MoreDeepSeek Harness Security Guard Plugin
`dsh-security-guard` is a security plugin for DeepSeek Harness (DSH) that uses static scanning to assess the security of third-party plugins and prevent risks such as token leakage, malicious network connections, and code obfuscation. It includes 28 built-in detection rules covering multiple scenarios, including token handling, data exfiltration, dynamic execution, obfuscation, network listening, supply chain integrity, and persistence. The plugin supports startup self-checks, DSH tool registration, alerting mechanisms (with Webhook support), a local web dashboard, and remote rule updates. To install it, exit DSH Host and use the official loading method. While the plugin is running, we recommend checking the source code and license.
Read Morexby-bbot: BBOT Security Scanning Plugin
xby-bbot is a plugin for DeepSeek Harness (DSH) that integrates the BBOT security scanning tool into DSH through an MCP server. The plugin supports core features such as configuring API keys, listing modules and presets, launching scan tasks, monitoring progress, and retrieving results. Users can directly manage security testing within DSH workflows. When using it, attention should be paid to permission considerations and dependency installation requirements to ensure that the scanning process complies with applicable standards.
Read MoreIntroducing the dsh-secret-scan Plugin for DeepSeek Harness
DeepSeek Harness provides the `dsh-secret-scan` plugin for locally scanning codebases for sensitive information. The plugin works offline, is implemented in Node.js, and can recursively identify various credentials, including AWS keys, OpenAI API keys, and private keys. It generates a sanitized report that includes file paths, line numbers, and severity levels. It automatically skips directories such as `node_modules`, although heuristic scanning may produce a small number of false positives. After installation, it must be enabled in a configuration file, and it can be used by calling `secret_scan(root)`. It is recommended to manually verify findings before committing code to help prevent security risks.
Read Moredsh-deployment-validation: DSH Skill: Deployment Validation and Configuration Management
Addressing the cumbersome configuration validation and difficulty of scanning sensitive information in DeepSeek Harness development, this skill, maintained by satan9394, provides deployment verification, configuration management, and schema and key scanning capabilities. The plugin aims to automate security checks of configuration structure, but installation commands and usage details are currently missing, requiring reference to the source code. Since it runs with the current process privileges, users must trust the environment and verify the license before use.
Read MoreSecurStack DSH Plugin: Invoking SecurStack Scanning, Policies, and Diagnostics in DeepSeek Harness
The SecurStack DSH plugin is an adapter for DeepSeek Harness, designed to enable agent workflows to directly invoke the existing `securstack` CLI without the need to re-implement security tools. The plugin primarily provides four core functions: executing repository security scans via CLI, performing policy threshold checks, running local diagnostics, and returning structured JSON results when the CLI supports it. It reuses existing SecurStack authentication methods (such as API Key or command-line login) and strictly adheres to conservative boundaries; version 1 does not include low-level logic such as scanning engines, encryption, or Shielding operations. Ensure the environment is Node.js 20 or higher before installation and enable it via the `dsh plugin` command. The plugin is suitable for...
Read MoreEligahyu/dsh-sentinel-scanner: Read-Only Security Scanning for DSH Plugins
Eligahyu/dsh-sentinel-scanner is a read-only static security scanning tool for DeepSeek Harness (DSH) plugins, designed to perform supply chain and security risk assessment before code execution. The tool detects risks such as command execution, credential access, data exfiltration, and obfuscation through 51 AST-based heuristic rules, outputting a risk score from 0 to 100 along with a security verdict, but never executes the scanned code. It offers multiple integration methods: as a DSH Agent Tool plugin, a standalone CLI (`dsh-sentinel`), a GitHub Action, or a JavaScript API. Core features include three scanning modes—source code, package artifacts, and profiles—with support for pre-publishing npm packages.
Read More