dsh-taintguard
Indirect prompt-injection guard for DeepSeek Harness: taints tool output by origin and gates privileged tool calls that follow untrusted content
AI Analysis
核心用途是防御间接提示词注入攻击。适合对 Agent 运行安全性要求极高，需要对敏感工具（如 bash、write 等）调用进行安全审计与拦截的用户。
Install
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:sashankh/dsh-taintguardREADME
Read the full README ↗Configuration
| Key | Default | Meaning |
|---|---|---|
mode | ask | ask routes a gated call to the operator, deny refuses it, observe only annotates. |
untrustedSources | web_fetch, web_search, read, read_image, mcp__* | Tools whose results carry externally controlled content. |
privilegedSinks | bash, pwsh, run_code, write, edit, str_replace_editor, cordis_*, schedule_create, subagent, send_message | Tools gated once the agent is tainted. |
egressSinks | web_fetch, bash, pwsh, run_code | Tools whose arguments are scanned for credentials on every call. |
canaries | [] | Marker strings that must never leave; any occurrence in an egress argument is refused. |
mediumQuorum | 2 | Medium-confidence signals required to taint when no high-confidence signal matched. |
maxScanChars | 20000 | Characters scanned per result and per argument set. |
annotateUntrustedResults | true | Whether to re-frame a tainted result as quoted data. |
Names are *-wildcard patterns over tool names. A pattern that matches nothing currently registered is legal, so mcp__* can be declared before any MCP server is configured.