Plugins

WispOps (dsh-wisp-ops): multi-host server operations plugin for DeepSeek Harness — fleet inspection, disk & recent-file analysis with omics cleanup advice, security triage, scheduled per-server reports, human-approved sudo

Windows sandbox ACL-repair plugin for DeepSeek Harness (dsh) — fix the grantWrite failure (SetNamedSecurityInfoW Win32 5) and retry the command invisibly

Deterministic, one-way PII anonymizer for everything the DeepSeek Harness sends to the model: prompt, system prompt, context, and tool results

Read-only audit of whether a DSH plugin's HTTP routes are actually fenced, discovering the registered routes by reading plugin code and probing loopback only.

Plain-language trust dashboard for the dsh trust family: aggregates the nine channels (injection interception, write denials, egress blocks, custody-chain verification, tool-surface and prompt drift, leftover scans, forgotten compaction constraints, profile composition) into one right-sidebar panel with a single status light and event cards that translate engine jargon into sentences a non-security user can act on; the read and egress engines run from the package's own npm dependencies so those channels work even without the sibling plugins, and absent plugins simply show as not installed.

Encrypted local credential vault for DeepSeek Harness: sidebar record management, an info_records tool for pre-sign-in lookups, opt-in chat capture, per-record manual-only mode, and AES-256-GCM storage protected by Windows DPAPI, the macOS Keychain, or the Linux Secret Service.

Registers one agent tool, plugin_guard, that statically scans a DSH plugin package before it is installed and reports a verdict with the reasons: a missing or broken dsh.bundle.patch, a missing dsh.permissions block, install scripts, dangerous APIs and obfuscation, dependency risk, and source that is not indexed and therefore cannot be verified. Read-only: the scanned code is never imported, installed, evaluated or run.

Requires JDK 11+, the DM JDBC driver and SSH access to the target instance. Inspect Dameng database instances, assess security and recovery conditions, and generate filterable reports with shared evidence.

Describe the persona you want and the agent writes it: nickname, bio, taglines and links come from the host model, the avatar comes from your local asset library (or a path you give), then it fills your profile page and hands the picture to the site's own uploader. Dry-run by default - it only touches profile fields, never passwords or security settings.

Deterministic prompt-injection interception: tool results from file reads, repo searches and web fetches are scanned before they enter model context; high-severity findings quarantine-wrap or block, and credential-material files quarantine on the path alone.

Deterministic network egress gate: web fetches and searches are checked against a destination allowlist in tools/pre-execute and denied before they run; shell fetch-verbs are observed (enforcement opt-in).

Context firewall for DeepSeek Harness: credentials in successful plain-text tool results become opaque ⟦cloak:category:n⟧ placeholders before they reach the model, with originals kept only in a process-memory, agent-scoped vault. 36 built-in signature families (shared with the cloakpack git pre-push guard), key-name rules for unknown formats, custom regex rules, dry-run mode, an audit log, and the /cloak command.

Adversarial review gate for tool calls. It hooks `tools/pre-execute`: a local regex pass over destructive commands (`rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `format`, disk writes) and sensitive paths (`.env`, `id_rsa`, `.ssh`, `.git/`, `$DSH_HOME`) runs first with no latency, and only a hit is escalated to one review-model call that returns allow or deny. Plain reads and ordinary writes never enter that path, so everyday work pays no added delay. Every verdict is shown live in the Web GUI.

Writes a model-generated annotation into every DSH escalation approval prompt — what the command does, what the model intends, how risky it is and why, and what each choice means — and keeps a searchable history of past approvals at /dsh-approval/history, with a diagnostics page at /dsh-approval/diag.

基于 DeepSeek Harness 的 GitHub 插件静态安全审查预设，该项目代码由ai生成，主要框架由我搭建，通过“侦察员+审计员”双 Agent 协作、通过实验性ai自测攻防。主要功能有防死机上下文裁剪，有效防御投毒与提示词注入。包含21条安全红线、依赖树连坐排查与自动 YAML 校验，这是一名20岁非科班大学生的AI安全探索，欢迎大佬指导。本项目不能代替人工审计。请勿在生产环境或敏感凭证环境中使用。

deepseek harness的插件安全性自查

Agent 行为守护桌宠：跨 agent 监控可疑外传（加密打包直传对象存储 / DNS 外泄线索 / 敏感密钥被读），发现即告警，明确确认后按「一次一个」终止目标 agent；事件写入只追加 guard-events.jsonl，并通过 DSH host 工具 + MCP(stdio) 供其它 agent 查询

Control panel for a local credential-redaction gateway in DeepSeek Harness: gateway and model health, audit metrics, a dry-run leak tester, an exemption whitelist, encrypted key management, credential-protected model entries and deployment controls.

Adds an "approve for me" access mode whose approval requests are answered by an independent reviewer model instead of a person: the reviewer can read the workspace read-only, a reviewer that cannot run hands the request back to the human, and every decision is recorded with its rationale in an Approvals tab.

Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.

ESLint Security SAST bundle and model-facing scan tool for DeepSeek Harness.

Xbox 手柄硬件审批 dsh 插件 — Agent 高危工具调用需物理按键确认（A 批准 / B 驳回）

Read-only MCP server over the DSH plugin-certification registry, exposing a plugin certification grade, its snapshot and the five-dimension evidence behind it.

Semgrep SAST bundle and model-facing scan tool for DeepSeek Harness.