dushaobindoudou/dsh-plugin-security ↗★ 2
dsh-plugin-security
提供依赖预警、静态证据扫描及高危调用拦截 适合对第三方插件安全性有较高要求，需进行合规与风险管控的环境。
安裝
$
npx -p @deepseek-ai/dsh dsh plugin --profile web add github:dushaobindoudou/dsh-plugin-security說明文件
閱讀完整 README ↗Configuration
Change these in the settings page; they are stored in $DSH_HOME/plugin-security/state.json.
| Option | Default | Behavior |
|---|---|---|
| Mode | report-only | off: no scans, call gate or enforcement. report-only: scan, record and gate calls; no automatic disabling. enforce: additionally auto-disable on a high-confidence malicious review. |
| Auto-disable threshold | critical | never turns automatic disabling off. Static matches or advisories alone never auto-disable. |
| Upgrade suggestions | off | Suggest upgrade commands for dependency advisories; never run silently. |
| Whitelist | built-in protected entries | Whitelisted plugins skip checks and the gate. This plugin, official @deepseek-ai/* packages and dsh-plugin-sentinel are always protected and cannot be disabled or uninstalled through this plugin. |
State directories/files use 0700/0600 where supported; the action log keeps at most 200 entries.