PerryLink/dsh-skill-pack-security ↗★ 11
dsh-skill-pack-security
Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning / malicious patterns / five-dimension risk card) with findings that cite the matching skill sections.
安装
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:PerryLink/dsh-skill-pack-security说明文档
阅读完整 README ↗Configuration
All tunables are Schemastery Config fields (changeable from cordis.yml). provider/cordis.patch.yml documents each key inline.
| Key | Default | Meaning |
|---|---|---|
language | zh | Edition to publish: the Chinese skills/ or the English skills-en/; ignored when skillsDir is set |
watch | false | Watch the packaged skills directory (static content, so disabled) |
skillsDir | (unset) | Explicit skills root; overrides the language-derived default and must hold /SKILL.md bundles |
vet.enable | true | Register the plugin_vet gate tool |
vet.timeoutMs | 15000 | Tarball-fetch timeout in ms |
vet.maxFiles | 800 | Scan file cap |
vet.maxFileBytes | 262144 | Per-file byte cap |
vet.maxExtractBytes | 67108864 | Extraction byte cap |
vet.maxDepNodes | 600 | Dependency-tree node cap |
vet.maxFindingsPerCheck | 12 | Findings cap per check |
vet.dataResponsibility | true | Run the data-responsibility review (disable per deployment) |
vet.externalScanners | true | Orchestrate osv-scanner/npm audit when their CLIs are present; false forces the built-in self-computed dependency scan |
vet.userAgent | dsh-skill-pack-security/2.2.16 (+https://github.com/PerryLink/dsh-skill-pack-security) | Fetch user-agent |
vet.gate.policy | warn | Install gate: warn (non-blocking) or deny (block on FAIL) |