dsh-guardwall
Vets local, npm, and GitHub plugin source before installation, blocks configured high-risk tool calls at runtime, audits output secret patterns, and writes HMAC-chained local audit logs.
在安装前体检本地、npm 与 GitHub 插件源码，运行时拦截命中配置阈值的高风险工具调用，审计输出中的密钥模式，并写入 HMAC 链式本地审计日志。
How to install
dsh plugin add github:iiiweiii/dsh-guardwall About
dsh-guardwall DeepSeek Harness 的安全插件：**安装前体检 + 运行时护栏**，装前把关、装后看门、全程留痕。 **安装前体检**：权限清单 · 静态风险扫描 · A–D 信任评分 · 安装门禁（D 级拒绝） **运行时拦截**：危险工具调用直接拦截（破坏性命令、凭据、SSRF、反向 shell） **输出审计**：密钥/内网 IP/数据库串泄露检测 **篡改检测审计**：HMAC 链式哈希 + 尾部 checkpoint，内容修改与日志截断可检测 **热加载**：自定义规则与阈值改完秒级生效，不用重启 **零第三方运行时依赖**：仅使用 Node 内置模块，减少依赖供应链攻击面 安装 bash dsh plugin --profile web add dsh-guardwall 验证挂载： bash dsh --profile web --dump-config | grep -A2 'id: guardwall' npm 尚未发布时可用 GitHub 通道：dsh plugin --profile web add "github:iiiweiii/dsh-guardwall#main" 第一层 · 安装前体检 **"装这个插件 = 给了它什么权限？"** —— 装之前先回答： bash npx guardwall check <spec> # 体检…
Recommendation signals
Meta
- License
- MIT
- Language
- JavaScript
- GitHub stars
- 2
- mo. downloads
- –
- Last push
- 2026-08-23
- Created
- 2026-08-21
Links
Basic safety check
- Findings
- curated 收录但无 npm 包/安装命令
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- audit, deepseek-harness, dsh-plugin, guardrail, secret-detection, security, ssrf
Related plugins
dsh-auto-mode
NanmiCoder/dsh-auto-mode
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
sofagent
KongFangXun/sofagent/tree/main/engine/dsh-plugins/cordis-plugin-sofagent-audit
Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.
dsh-vault
Ox0400/dsh-vault
Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.