Preface¶

DeepSeek Harness (abbreviated as DSH) is an intelligent agent runtime open-sourced by DeepSeek, whose core concept is “Everything is a plugin”: models, tools, sessions, sandboxes, storage, and interfaces can all be mounted and replaced. The repository address is https://github.com/deepseek-ai/deepseek-harness. There is an independently maintained plugin directory in the community: https://deepseek-harness-plugin.com/zh-CN/plugins/. This is not an official app store of DeepSeek / Hyperchain, and the included entries need to be verified against GitHub again.

A local DSH environment usually stores API Keys, tokens, session content, and plugin loading boundaries at the same time. Opening listening to public networks, overly permissive credential files, unfixed plugin sources, and symbolic links in the session directory will all become real risks. The repository README clearly states the gaps in existing tools:
1. plugin-check only performs structure/compliance checks, and does not assess credential exposure and path escapes
2. session-health only performs health diagnostics, and does not judge source credibility
3. Manual one-by-one troubleshooting is scattered across configuration, permissions, ports, and plugin sources, which is not reproducible and difficult to document

dsh-security-audit targets this scenario: it performs a defensive, read-only security audit on the local DSH environment, and outputs a redacted, reproducible, locatable risk report. It does not automatically fix issues, connect to remote services, execute the audited plugins, or treat “unread” as “safe”.

This article is collated after checking against the community directory page, GitHub README, package.json, src/index.ts and src/rules.ts. The latest push time of the directory page is 2026-08-14, and the inclusion date is 2026-08-10. GitHub API showed 12 stars on 2026-08-17; the directory page still showed 11 stars at that time, and the star count shall prevail based on the repository’s first-hand data.

What is this¶

dsh-security-audit is a “tools and capabilities” plugin for DeepSeek Harness, maintained by omdsh-dev, with the repository at https://github.com/omdsh-dev/dsh-security-audit, licensed under MIT (LICENSE copyright statement is 2026 whiteicey). The main language is TypeScript. The version in package.json is 0.0.1, the package name is @deepseek-ai/dsh-security-audit, and it is marked as "private": true, so the installation entry is the GitHub repository, not a public npm package. This scoped name is only an internal package identifier, the maintainer is still omdsh-dev, do not interpret it as an official DeepSeek plugin.

It registers the tool security_audit (the row id in the profile is security-audit), and uniformly outputs JSON text. Scan-type actions carry verdict / riskVerdict / coverageVerdict and summary. The README states that it has been migrated to the npm dependency chain, and has been fully verified in the isolated @deepseek-ai/dsh@0.1.0-rc.6 consumer. package.json requires Node ^22.19.0 || >=24.0.0, with peer dependencies @deepseek-ai/cordis@^4.0.1, @deepseek-ai/dsh-tools and @deepseek-ai/dsh-invariants (the version range of the latter two is >=0.0.1-rc.1 <0.2.0).

Core Functions¶

The plugin splits local auditing into four scan surfaces, then aggregates them with report and lists the rule catalog with rules. There are six actions as follows.

The rules in src/rules.ts are static catalogs, not runtime guesses. Configuration-side rules include secret-in-settings (suspected tokens/keys/private keys appearing in non-credentials files), credential-file-permissions, inline-private-key (private key PEM or high-confidence secrets, severity is critical), and profile-path-outside-root. Plugin-side rules include plugin-unpinned-git (Git source with unpinned commit), plugin-path-outside-root, install-script, secret-like-file, as well as source code static capability rules dynamic-code-execution / process-execution-capability / network-capability. Session-side rules include session-symlink and session-suspicious-expansion. Network-side rules include listen-all-interfaces (listening on 0.0.0.0 / :: without authentication evidence), plaintext-http-external, and unknown-listener-state (unable to determine the actual binding status, clearly marked as info, not treated as pass).

The README writes the audit tool’s own boundaries into the security model, which determine how trustworthy it is:
1. Read-only: Does not modify or delete any files, does not execute the code of the audited plugins, and does not actively connect to remote targets. scan_network only parses configurations and classifies URLs, and never probes.
2. Secret redaction: Suspected secrets only return type, length, in-process random HMAC fingerprint, path and line number. The complete value does not enter the canonical output; this is guaranteed by the protocol, not truncation. The field redacted: true indicates that the redaction protocol has been followed.
3. Path fencing: Paths go through three checks: lstat (reject symlinks) → realpath → containment check. The root is fixed to $DSH_HOME parsed when the process starts, or the allowedRoots declared by the administrator in the plugin configuration. Model parameters cannot expand the reading scope.
4. Honest judgment: Four states: finding / pass / skipped / error. skipped (unsupported by platform or no permission) and error are not counted as pass, and the coverage is reduced to incomplete. The capability finding detected by source code static scanning only prompts manual confirmation, and does not judge maliciousness.
5. Budget: Files ≤ 200, plugins ≤ 200, sessions ≤ 1,000, findings ≤ 1,000; single source code file ≤ 1 MiB (total ≤ 64 MiB); canonical output ≤ 2 MiB; 10 seconds per action, 30 seconds for report. Overlimit will set truncated to true. Session zstd scanning truncates according to frame budget, and does not decompress the entire package.
6. Reproducible: The output has no timestamp, and paths are stably sorted. Tool parameters will be recorded in the session log, do not pass sensitive data into the parameters.

includeSourceScan defaults to false. When enabled, it will perform static capability scanning on plugin source code, which is slower and has more false positives. strict defaults to false; when enabled, medium findings will also be judged as fail. detail defaults to true, and sensitive evidence is always redacted.

The output envelope given in the README is as follows (example, not a real scan result):

{"tool":"security_audit","version":1,"root":"$DSH_HOME","platform":"win32","strict":false,
 "verdict":"fail","riskVerdict":"fail","coverageVerdict":"complete",
 "summary":{"critical":0,"high":1,"medium":0,"low":0},
 "findings":[{"code":"secret-in-settings","severity":"high","state":"finding",
   "evidence":{"path":"$DSH_HOME/.env","line":13,"secretKind":"api-key","secretLength":35,
               "fingerprint":"b99e1887d861d7be","redacted":true}}],
 "truncated":false}

Installation and Activation¶

The installation command given on the community directory page is as follows, run it in the DeepSeek Harness terminal:

dsh plugin add github:omdsh-dev/dsh-security-audit

For reproducible installation, the directory page recommends pinning the commit hash:

dsh plugin add github:omdsh-dev/dsh-security-audit#<commit>

The repository README supplements the profile writing method for DSH 0.1.0-rc.6. web and headless are different profiles: installing to web will not automatically overwrite headless; dsh run uses headless by default.

# Interactive (web) profile
dsh plugin --profile web add github:omdsh-dev/dsh-security-audit

# One-time task (headless) profile
dsh plugin --profile headless add github:omdsh-dev/dsh-security-audit

The package’s dsh.bundle.patch (cordis.patch.yml) will insert the plugin into the profile’s layer stack after installation, with the row id security-audit. Missing peer dependencies will be installed via the profile’s profiles/node_modules fallback. Windows paths use forward slashes.

Verify the installation:

dsh --profile web --dump-config | grep security-audit

The README also mentions using the npm pack artifact as a source installation, as well as the old scenario of local paths (monorepo / junction / manually modifying profile layers). Prioritize GitHub source for daily use.

The plugin runs with the permissions of the current dsh process, and may execute code during installation. Please check the source code repository and license before installing.

Typical Usage¶

After installation, the running verification method given in the repository is to let the Agent call report:

dsh run "Run the report action of security_audit to check the security risks of the local DSH environment"

You can also run it by surface, for example, only check the configuration or only check the plugin source. The tool parameters are as follows.

There are two administrator declaration items in the plugin configuration in the source code: allowedRoots (additional absolute paths allowed as scan roots) and allowedEndpoints (endpoint allowlist, normalized scheme+host+port exact match, no wildcards). Model parameters cannot modify these two items to expand the scope.

The README states that build and test dependencies include TypeScript / vitest, and the test coverage includes redact, paths, config, plugins, sessions, network, permissions, report, register, totaling 112 test cases. This is the repository’s own description, not a third-party review.

Applicable Scenarios and Notes¶

It is suitable for users who are already running DSH locally, have installed several third-party plugins, and need to create a documentable report for configuration, credential permissions, plugin sources, session directories, and listening surfaces. Using report to check riskVerdict and coverageVerdict before CI or release is more reproducible than saying “I have checked it” verbally. Rules like plugin-unpinned-git are also suitable for reminding: community plugins should pin commits as much as possible.

Please note the following points, all from the repository’s own boundary descriptions, not additional extensions:
- This is a diagnostic tool, it does not automatically modify files, uninstall plugins for you, or tighten permissions for you.
- When coverageVerdict is incomplete, it means there are skipped or error entries, and the unscanned parts cannot be treated as safe.
- The listening status of scan_network is inferred at the configuration level; unknown-listener-state means the actual binding status is uncertain, not “no problem”.
- After enabling includeSourceScan, findings related to eval / network / process are only static capability prompts, which require manual review of their usage, and the plugin will not be marked as “malicious”.
- Tool parameters will be recorded in the session log, do not pass real keys as parameters.
- It audits from the perspective of the local $DSH_HOME, not conducting offensive and defensive assessments of the entire DeepSeek Harness plugin model. There are other third-party discussions and audit repositories on GitHub, which are not the same project as this plugin.

Summary¶

dsh-security-audit aggregates the configuration, plugin sources, session structure, and network exposure of the local DSH into a redacted JSON report, and writes its own read-only, fencing, and honest judgment into the contract. The installation command shall prevail on the community directory page:

dsh plugin add github:omdsh-dev/dsh-security-audit

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-security-audit/

GitHub: https://github.com/omdsh-dev/dsh-security-audit