dsh-plugin-sentinel
Static pre-install security auditor for plugin bundles: lifecycle scripts, dynamic execution, credential-exfiltration combos, and patch-layer hazards, with zero dependencies and in-memory tar parsing.
插件安装前静态安全审计：生命周期脚本、动态执行、凭据外传组合特征与 patch 层风险；零依赖，tar 包全程内存解析不落盘。
How to install
dsh plugin add github:BotonJ/dsh-plugin-sentinel About
dsh-plugin-sentinel 🔒 **DSH 插件安检机** — 给 DeepSeek Harness 装一台插件安检机：在安装任何社区插件**之前**做纯静态安全审计，输出按严重度排序的结构化风险报告。 官方文档对 GitHub 安装方式的警告原话：prepare 脚本授权是 *"permission to execute the package's code on your machine at install time, outside any sandbox the agent runs under"*。DSH 生态 24 小时收录 288+ 社区插件——这台安检机就是为了让"先过安检再安装"成为一句话的事。 安装 sh dsh plugin --profile <你的profile> add github:<你的fork>/dsh-plugin-sentinel 或本地安装 dsh plugin --profile <你的profile> add ./dsh-plugin-sentinel 装好后对 DSH 说： 「帮我装 github:xxx/yyy 这个插件」→ 模型会先调 audit_plugin 过安检，block 则拒绝安装并说明风险 「巡检我当前 profile 装过的插件安不安全」→ audit_installed 提供的工具 | 工具 | 用途…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 1
- mo. downloads
- –
- Last push
- 2026-08-15
- Created
- 2026-08-15
Links
Basic safety check
- Findings
- curated 收录但无 npm 包/安装命令
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- deepseek-harness, dsh-plugin, security
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.