dsh-security-guard

Name: dsh-security-guard
Author: bigclawd

PluginConfirmed pluginCommunity

bigclawd/dsh-security-guard · updated 16 days ago

View source ↗

Installation

dsh plugin --profile default add dsh-security-guard

dsh plugin --profile web add github:bigclawd/dsh-security-guard

Plugins in this repository

dsh-security-guardv0.1.0-rc.7✓
Static and runtime security guard for the DeepSeek Harness: scans plugins and workspaces for malicious code, context injection and token waste (block/warn/clean), intercepts dangerous runtime tool calls and prompt steps, and exposes /scan, plugin_scan, the scan web panel and a user-managed allowlist. Fully static analysis — never executes scanned code.
package.json
package.json
dsh.bundle.patch
cordis.patch.yml
Official core packages (9)
- @deepseek-ai/cordis^4.0.0shared
- @deepseek-ai/dsh-agent^0.1.0-rc.6shared
- @deepseek-ai/dsh-commands^0.1.0-rc.6shared
- @deepseek-ai/dsh-fs^0.1.0-rc.6shared
- @deepseek-ai/dsh-invariants^0.1.0-rc.6shared
- @deepseek-ai/dsh-llm^0.1.0-rc.6shared
- @deepseek-ai/dsh-session^0.1.0-rc.6shared
- @deepseek-ai/dsh-tools^0.1.0-rc.6shared
- @deepseek-ai/schemastery^3.18.1shared

Paths are pinned to commit c8c541f4b5fc

Overview

Security guard for DeepSeek Harness (dsh): static scan for malicious code, prompt injection and token waste, runtime interception, /scan, plugin_scan, web panel and allowlist | DeepSeek Harness 安全守卫插件：恶意代码/提示词注入静态扫描、运行时拦截、/scan、plugin_scan、Web 面板与白名单

Repository check result

Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.

Static repository check

Sep 1, 2026, 5:41 AM

High risk

Checked commit: c8c541f4b5fc
Evidence Score: 76/100
Static risk: High risk
Files scanned: 5
Findings: 5

Evidence breakdown

Source provenance25/25

Install documentation25/25

Maintenance12/20

Compatibility evidence5/20

Security signals3/10

Compatibility confidence: Limited

Install-time scripts (2)

prepacknode scripts/copy-rules.mjs
preparepnpm build

Findings (5)

Highinstall.script
package.jsoninstall-time
```
"prepare": "pnpm build"
```
Highinstall.script
package.jsoninstall-time
```
"prepack": "node scripts/copy-rules.mjs"
```
Highinstall.script
samples/malicious-demo/package.jsoninstall-time
```
"postinstall": "node src/postinstall.js"
```
Mediumobfuscation.child-process
samples/malicious-demo/src/postinstall.js:3obfuscation
```
const cp = require('node:child_process')
```
Mediumobfuscation.child-process
samples/malicious-demo/src/postinstall.js:6obfuscation
```
const whoami = cp.execSync('whoami').toString().trim()
```

Not run

Dependency advisory database scan
Installation execution test
Runtime behavior verification

Scanner 1.0.0 · Scorer 1.0.0