dsh-code-security
Deterministic code security review: 40+ rules, secret entropy detection, staged-diff review, SARIF export, baseline acceptance, SBOM-lite dependency inventory and health self-check.
确定性代码安全审查：40+ 规则、密钥熵检测、staged diff 审查、SARIF 导出、基线接受、SBOM-lite 依赖清单与健康自检。
How to install
dsh plugin add dsh-code-security About
dsh-code-security 让 agent 每次改完代码，先过一道本地安全扫描，修复完了才准交付。 DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff 增量审查 + 修复闭环 + 策略门禁。借鉴 Codex 安全技能的方法论（漏洞分级、证据优先、供应链分层、Agent 安全），实现为可复现工具。零运行时依赖。 工具 | 工具 | 作用 | 写操作 | | :-- | :-- | :-- | | secure_scan | 扫描文件/目录，输出 CWE/严重度/行号/代码片段证据 | 写状态 | | secure_diff | 只审查 git diff 新增行 | 写状态 | | secure_fix_verify | 修复后复扫：关闭 / 仍存在 / 新引入 | 写状态 | | secure_report | 按规则/文件聚合 + 门禁结论 | 否 | | secure_export | 导出 SARIF 2.1.0 / Markdown 报告 | 写文件审批 | | secure_baseline | 接受当前已知问题为基线，之后只按新增判定 | 审批门 | | secure_deps | SBOM-lite：解析依赖清单与版本约束风险 | 否 | | secure_policy_show | 查看 .code-security…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 1
- mo. downloads
- –
- Last push
- 2026-09-18
- Created
- 2026-08-15
Basic safety check
- Findings
- None
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- code-review, code-security, dsh-plugin, sast, security
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.