dsh-guardian
Agent security guardrail: intercepts and audits every tool call, requiring human confirmation on sensitive operations.
Agent 安全护栏：拦截并审计所有工具调用，命中敏感操作就要求人工确认。
How to install
dsh plugin add dsh-guardian About
dsh-guardian **Agent 安全护栏** · 基于 Cordis 时空可组合元内核的 DeepSeek Harness 插件。 在 Agent 每次工具调用前做安全审查，命中危险即拦截或要求人工确认。 --- 🎯 解决什么问题 LLM Agent（Claude Code / DeepSeek Harness）能自主执行 shell、读写文件、发网络请求。一旦被**提示注入**、**工具投毒**或**模型误判**带偏，可能在你不知情时 rm -rf、读取 .ssh/id_rsa、把密钥外泄到远程。本插件是一道**运行时安全网**： Agent 想执行工具 → guardian/check 前置审查 → 命中规则 → 拦截 / 人工批准 → 才放行 🛡️ 五大检测引擎 | 引擎 | 检测内容 | 借鉴来源 | |---|---|---| | **CMD/INJ** 危险命令 | rm -rf、dd、mkfs、fork炸弹、反弹shell、管道执行、提权 | Sigma 规则、PayloadsAllTheThings | | **CRED** 凭据保护 | 读 .ssh/.aws/.env/kubeconfig、/etc/shadow | mcp-safeguard CRED 系列 | | **SECRET** 密钥泄露 | AWS/GitHub/OpenAI/Anth…
Recommendation signals
Meta
- License
- MIT
- Language
- TypeScript
- GitHub stars
- 3
- mo. downloads
- 231
- Last push
- 2026-09-23
- Created
- 2026-08-14
Links
Basic safety check
- Findings
- None
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin, curated:0xsline/awesome-deepseek-harness
- Topics
- agent, dsh, dsh-plugin, llm-security, security
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.