DeepSeek HarnessHub
提交插件

bigclawd/dsh-security-guard ↗★ 1

dsh-security-guard

DeepSeek Harness 的静态与运行时安全卫士。支持扫描插件和工作区的恶意代码、上下文注入及 Token 浪费，拦截危险的运行时工具调用与提示步骤，并提供 Web 扫描面板和用户白名单。

AI 分析

核心用于保障 DSH 运行安全。适合需要审计第三方插件、防范恶意代码注入和控制 Token 消耗的开发者与系统管理员。需在 Cordis 框架中配置规则目录和白名单。

开发工具
包名
dsh-security-guard
版本
0.1.0-rc.7
许可证
MIT
最近更新
2026年8月16日

安装

$npx -p @deepseek-ai/dsh dsh plugin --profile web add github:bigclawd/dsh-security-guard

说明文档

阅读完整 README ↗

🚀 Usage

Install

dsh plugin --profile default add dsh-security-guard

Host application

import { Context } from '@deepseek-ai/cordis'
import Guard from 'dsh-security-guard'

ctx.plugin(Guard, {
  rulesDir: 'config/guard-rules',          // optional overrides
  scan: { maxFiles: 5000, maxFileSize: 4 * 1024 * 1024, skipSegments: ['node_modules', '.git', 'dist', 'lib'] },
  runtime: { enabled: true, blockOnSeverity: ['block'], maxFindingsPerScan: 200 },
  allowlist: { file: 'data/guard-allowlist.json' },
  web: { enabled: true, path: '/scan' },
  installHook: { enabled: true, intervalMs: 5000 },  // auto-scan newly installed plugins
})

Install hook

The host emits no "package installed" event (dsh plugin add is a separate CLI process), so the guard watches the profile manifest ($DSH_HOME/profiles//package.json — the only file the CLI rewrites after a successful install). Every package added to its dependencies is statically scanned under node_modules; the report is recorded as a runtime event (source: install), emitted as a guard/install-scan event, and appended to guard-install-scans.jsonl in the profile directory. Disable with installHook: { enabled: false }.

Static scan

/scan ./plugin-dir                 # human-readable report
/scan ./plugin-dir --json          # machine-readable
/scan ./plugin-dir --json --out report.json

Or via the plugin_scan tool with parameters target, severity, json, out.