dsh-trust-check
Adds a Settings page and a CLI that statically scan installed DeepSeek Harness plugins for capabilities, literal destinations, install scripts, and prompt injections, then show a verdict you can acknowledge.
在设置页和 CLI 里对已安装的 DeepSeek Harness 插件做静态扫描，列出能力、字面量去向、安装脚本和提示注入，并给出可确认的裁决。
How to install
dsh plugin add dsh-trust-check About
dsh-trust-check English DeepSeek Harness 插件静态信任审计：对已安装插件做**能力披露**——权限、注入、来源、安装脚本——代码判定、可复现、零 token。 不是"杀毒软件"，也不做安全承诺。它只做能证明的事：把插件**真实会碰什么、注入了什么、来源是否可核对**摊开给你看，结论每一条都附证据（文件 + 行号 + 片段），你可以自己复核。 安装 **设置页需要 dsh ≥ 0.1.0-rc.8（建议 0.1.1-rc.2）。** Web UI 依赖宿主模块表里的 @deepseek-ai/dsh-client-store；市场不会拦不匹配的升级，老宿主上装了设置页也会加载失败（dsh-client-store missed the module table）。 **CLI 不依赖 DSH 宿主**，旧 dsh 上仍可用 npx dsh-trust-check。 先确认宿主（只影响设置页）： sh dsh --version 过旧则：npm i -g @deepseek-ai/dsh@latest sh dsh plugin --profile web add dsh-trust-check 重启 dsh web，打开 **设置 → 插件体检**。已安装要升级：市场一键更新，或 dsh plugin --profile web add dsh…
Recommendation signals
Meta
- License
- MIT
- Language
- TypeScript
- GitHub stars
- 0
- mo. downloads
- –
- Last push
- 2026-08-31
- Created
- 2026-08-27
Basic safety check
- Findings
- None
- Sources
- curated:awesome-dsh-plugin.com, curated:awesome-dsh-plugin/awesome-dsh-plugin
- Topics
- audit, deepseek-harness, dsh-plugin, security
Related plugins
dsh-permission-rules
PerryLink/dsh-permission-rules
Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.
dsh-passwords
slywalker2006/dsh-passwords
Turns DeepSeek Harness into a server-grade multi-tenant platform: remote access + auto HTTPS, subuser permissions & token/daily quotas, sandbox enforcement, encrypted auth & audit log.
dsh-plugin-vetting
truelove-dreamer/dsh-plugin-vetting
Vets third-party plugins before you trust them: static scan for malicious patterns (exfiltration, credential access, obfuscation, persistence) and over-privileged path use, transitive-dependency coverage, official-package hash baseline for supply-chain tamper detection, and an optional plugin-tool call gate.
dsh-webui-auth
Yuuz12/dsh-webui-auth
WebUI authentication enforced at the HTTP/transport layer: four-layer login gate (resources, plugin bundles, /api, WebSocket), server-side sessions with HttpOnly cookies.