dsh-skill-pack-security

Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning / malicious patterns / five-dimension risk card) with findings that cite the matching skill sections. 适合需要审计插件安全、规避开源协议与恶意代码风险的开发者。

パッケージ

dsh-skill-pack-security

互換性

未検証

Harness ピア範囲

>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0

バージョン

2.2.17

ライセンス

Apache-2.0

最終更新

2026/09/25

Configuration

All tunables are Schemastery Config fields (changeable from cordis.yml). provider/cordis.patch.yml documents each key inline.

Key	Default	Meaning
`language`	`zh`	Edition to publish: the Chinese `skills/` or the English `skills-en/`; ignored when `skillsDir` is set
`watch`	`false`	Watch the packaged skills directory (static content, so disabled)
`skillsDir`	(unset)	Explicit skills root; overrides the `language`-derived default and must hold `/SKILL.md` bundles
`vet.enable`	`true`	Register the `plugin_vet` gate tool
`vet.timeoutMs`	`15000`	Tarball-fetch timeout in ms
`vet.maxFiles`	`800`	Scan file cap
`vet.maxFileBytes`	`262144`	Per-file byte cap
`vet.maxExtractBytes`	`67108864`	Extraction byte cap
`vet.maxDepNodes`	`600`	Dependency-tree node cap
`vet.maxFindingsPerCheck`	`12`	Findings cap per check
`vet.dataResponsibility`	`true`	Run the data-responsibility review (disable per deployment)
`vet.externalScanners`	`true`	Orchestrate `osv-scanner`/`npm audit` when their CLIs are present; `false` forces the built-in self-computed dependency scan
`vet.userAgent`	`dsh-skill-pack-security/2.2.17 (+https://github.com/PerryLink/dsh-skill-pack-security)`	Fetch user-agent
`vet.gate.policy`	`warn`	Install gate: `warn` (non-blocking) or `deny` (block on FAIL)

dsh-skill-pack-security

インストール

ドキュメント

Configuration