dushaobindoudou/dsh-plugin-security ↗★ 2
dsh-plugin-security
Plugin security review for DeepSeek Harness: dependency advisories, contextual static evidence, a call-time gate for high-risk plugins, and reversible review-gated enforcement. 适合对第三方插件安全性有较高要求，需进行合规与风险管控的环境。
Install
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:dushaobindoudou/dsh-plugin-securityREADME
Read the full README ↗Configuration
Change these in the settings page; they are stored in $DSH_HOME/plugin-security/state.json.
| Option | Default | Behavior |
|---|---|---|
| Mode | report-only | off: no scans, call gate or enforcement. report-only: scan, record and gate calls; no automatic disabling. enforce: additionally auto-disable on a high-confidence malicious review. |
| Auto-disable threshold | critical | never turns automatic disabling off. Static matches or advisories alone never auto-disable. |
| Upgrade suggestions | off | Suggest upgrade commands for dependency advisories; never run silently. |
| Whitelist | built-in protected entries | Whitelisted plugins skip checks and the gate. This plugin, official @deepseek-ai/* packages and dsh-plugin-sentinel are always protected and cannot be disabled or uninstalled through this plugin. |
State directories/files use 0700/0600 where supported; the action log keeps at most 200 entries.