Preface¶

DeepSeek Harness (dsh) splits agent capabilities into two layers: plugins and skills. Plugins modify the runtime environment, while skills are SKILL.md files with YAML frontmatter: they are called by models or users by name, and define how to constrain a specific type of task. The problem is that skill files are not stored in a single directory. DSH itself has ~/.dsh/skills and ~/.agents/skills, projects have .dsh/skills and .agents/skills, and if you also use Codex or Claude, there will be additional ~/.codex/skills and ~/.claude/skills. Skill repositories on GitHub are another source of skills. To enable or disable a single skill, you often have to manually find the file, rename it, and then confirm whether the /skills list has refreshed.

dsh-skill-manager does something straightforward: it adds a “Skill Management” section to the DSH Web settings page, aggregates the above sources into a single list, allows hot toggling via switches, and supports installing skills from local ZIP files or GitHub repositories. This article is organized after cross-checking with the community directory page, GitHub repository README, package.json, and source code.

What is this¶

dsh-skill-manager is a skill management plugin for the DeepSeek Harness Web interface, maintained by sulfide2085, licensed under MIT, and primarily written in JavaScript. The version number in package.json is 0.1.0. The repository is tagged under the GitHub dsh-plugin topic. At the time of writing, the GitHub repository has 9 stars; the numbers on the community directory page may lag behind, so refer to the repository page for the latest data.

It solves the problem of “scattered skills and needing to manually modify files to enable/disable them”:
- Consolidates and displays skills from DSH, Agents, project directories, as well as Codex and Claude directories
- Uses renaming SKILL.md ↔ SKILL.md.disabled for hot toggling, with the filesystem watcher taking effect in approximately 200ms
- Discovers and installs skills from local ZIP files or GitHub skill repositories, and the installed skills will immediately appear in ~/.dsh/skills and be enabled

The official DeepSeek Harness repository’s slogan is “Everything is a plugin”. The community directory page deepseek-harness-plugin.com introduced in this article is an independent site and has no official affiliation with DeepSeek / Fangxin. It should not be treated as an official app store. There are also repositories with similar names in the community (such as dsh-skill-manager-ytxue), please use the github:sulfide2085/dsh-skill-manager given on the directory page when installing.

Core Features¶

Consolidated Skill List by Source¶

The plugin registers a settings.section on the settings page, with the section ID skill-manager, a sort value of 17, and the interface copy “Skill Management”, located between “Plugins” and “Agent Presets”.

The list combines two sets of data: currently enabled skills in the registry, and disabled (*.disabled) entries already on disk. The interface groups skills by source, and the grouping tags in the source code include:

Each card displays the name, description, source, invocation policy (model only / user only / model + user / disabled), and enabled status. Skills installed from GitHub will have an additional source label. Clicking a card expands the full text of the skill. There is a manual refresh button next to the title; the list will automatically refresh after a successful ZIP or repository installation. There is also a separate search box in the local list that only filters already installed skills.

When no session is open, only user-level and global skills are displayed. Project-level skills depend on the current session’s working directory; without a cwd, project roots like .dsh/skills cannot be scanned.

The scan priority is clearly defined in lib/skill-files.js: project .dsh > project .agents > project .codex > project .claude > user .dsh > user .agents > user .codex > user .claude. The skill from the higher-priority root takes precedence in case of duplicate names; enabled entries take precedence over disabled entries for the same name.

Hot Toggling and Directory-level Enable/Disable¶

Enabling or disabling skills in the DSH / Agents directories is implemented via renaming:
- Enable: SKILL.md.disabled → SKILL.md
- Disable: SKILL.md → SKILL.md.disabled

The DSH skill-filesystem provider monitors these files, and the README states that it takes effect in approximately 200ms without requiring a gateway restart. Codex and Claude follow the same .disabled convention. Disabling only changes the filename and does not delete the content, and it can be re-enabled at any time.

Skills in the Codex / Claude directories are all disabled by default, and will only appear in the official /skills registry after being explicitly enabled in the panel. The enabled list for third-party directories is stored in the state file dsh-skill-manager.json under the DSH home directory (default path ~/.dsh/dsh-skill-manager.json).

There is also a directory-level switch on the group header to operate the entire source directory at once. Skills from bundled / runtime sources have no disk files, cannot be edited, and their switches are grayed out.

Local ZIP Installation¶

The “ZIP Installation” button on the interface allows you to select a local .zip file (max 64 MiB). The host side uploads the file in base64, uses the built-in ZIP parser to decompress it (supports store and deflate), and performs CRC32 checks and entry name security checks (rejects absolute paths, drive letters, .. segments, and NUL characters). It then searches the package for skills:
- Directory bundles: directories containing SKILL.md
- Flat skills: .md files with valid frontmatter in the root directory

After deduplication, the skills are installed into ~/.dsh/skills and kept in an enabled state. An error will be reported if there are no skills in the package; if a skill with the same name already exists, it will be skipped and a conflict prompt will be shown. Symbolic link entries will be ignored and will not be materialized to disk.

The README and source code both note that the following features are not yet implemented: zip-bomb decompression budget, symlink materialization, ZIP64. Encountering a ZIP64 archive will directly result in an error message “ZIP64 archives are not yet supported”.

GitHub Skill Search and Installation¶

The “GitHub Skill Marketplace” is not a centralized store, but rather: you first add the repository coordinates (owner / repository name / branch, branch can be left blank), and the plugin then pulls the GitHub archive of that repository, scans it for SKILL.md files, searches by keyword, and installs them one by one.

When running for the first time, if there is no repos field in the state file, two repositories will be pre-configured and saved to disk:
- anthropics/skills (branch main)
- obra/superpowers (branch main)

If the user empties the repository list, the empty array will be retained, and these two repositories will not be automatically added again.

The download behavior can be verified in lib/skill-repo.js:
- Branch fallback order: specified branch → main → master
- Maximum archive size 128 MiB, single download timeout 60 seconds, 2 retries by default for network failures
- Cache stored in ~/.dsh/cache/dsh-skill-manager, default expiration time 30 minutes
- Default download source is https://github.com; you can use the environment variable DSH_SKILL_GITHUB_BASE to replace it with a mirror prefix
- Download proxy is not yet implemented

The installation target is also the user-level ~/.dsh/skills. After installation, the list will refresh, and the GitHub source will be visible on the card.

Installation and Activation¶

The installation command given on the community directory page can be run in the DeepSeek Harness terminal:

dsh plugin add github:sulfide2085/dsh-skill-manager

The dsh CLI will parse the plugin from GitHub and install it into the current profile. This plugin declares "platform": "web" in its client manifest, so the interface only appears on the Web settings page. If you are not using the default profile, you can explicitly specify it according to the official documentation, for example:

dsh plugin --profile web add github:sulfide2085/dsh-skill-manager

For reproducible installations, pin the commit hash to the end of the repository. The form given on the directory page is:

dsh plugin add github:sulfide2085/dsh-skill-manager#commit

Replace commit with the actual commit hash. The official documentation also recommends pinning commits for git sources to avoid accidental changes to running code from subsequent pushes to the repository.

If you are cloning the repository and installing it locally, the command from the README is:

dsh plugin --profile web add .

You need to restart DSH Web after updating the code. The README explains that the host manifest is registered when the gateway starts, and without a restart, the new interface will return 404.

The plugin runs with the permissions of the current dsh process and may execute code during installation. Please review the source code repository and the MIT license before installing.

Typical Usage¶

The following steps are all from the README and the settings page copy, and can be done directly in the Web UI without additional configuration.

1. Open Skill Management
Launch DSH Web (the official default address is http://127.0.0.1:3080), go to Settings, and find “Skill Management”. Opening it for the first time will read the skills visible in the current session; without a session, project-level directories will not appear.

2. View and Toggle Skills
The list is grouped by source. The switch on the right side of each card: after toggling it on or off, the SKILL.md in the corresponding directory will be renamed, and DSH, Codex, and Claude will all refresh according to their respective conventions in approximately 200ms. The group header switch acts on the entire source directory. The switches for bundled / runtime skills are grayed out, which is expected behavior.
Click the card to view the full text. The local search box only filters already installed skills, and will not search GitHub.

3. Install a Skill via ZIP
Package the skill into a zip (either a directory bundle or a flat .md file), select the file in “ZIP Installation”. After a successful installation, you will be prompted with the number of installed skills; conflicting names will be skipped. The installed location is ~/.dsh/skills, and it will then be visible to /skills and the model.

4. Discover Skills from GitHub Repositories
Fill in the owner and repository name in “GitHub Skill Marketplace”, the branch can be left blank. After adding the repository, use the marketplace search box to search by keyword, and you can click “Install” one by one for the matched items. The repository list can be removed at any time. If network access to GitHub archives is unstable, the README / source code provides DSH_SKILL_GITHUB_BASE as a mirror base address, and you need to prepare an available prefix yourself.

Applicable Scenarios and Notes¶

It is suitable for the following types of users:
- Those who have placed skills in DSH Web, Codex, and Claude, and do not want to manually rename files between ~/.dsh, ~/.agents, ~/.codex, and ~/.claude
- Those who need to temporarily disable a batch of skills by task to reduce skill noise in the model context
- Those who want to select a few skills from GitHub skill repositories (such as public SKILL.md collections) and install them into DSH
- Those who have an existing skill zip and want to install it to the user-level directory and enable it immediately

Before using it, you need to know the boundaries:
- Only covers the Web settings page. The client platform in package.json is web, do not expect it to draw the same panel for TUI or headless profiles.
- Permissions and trust. The plugin and the skills it pulls run under the permissions of the current dsh process. ZIP and GitHub archives will be decompressed and written to files locally; please check the source, license, and SKILL.md content before installing.
- Disabling does not equal deleting. .disabled only prevents the provider from registering the skill, the file still exists.
- Project skills depend on sessions. You cannot see skills under the project root without an open session; this is not a broken list.
- ZIP / download limits. Local zip ≤ 64 MiB; GitHub archive ≤ 128 MiB, 60-second timeout; ZIP64, zip-bomb budget, symlink materialization, and download proxy are not supported.
- Duplicate-named plugins. The installation command shall be subject to github:sulfide2085/dsh-skill-manager on the directory page, do not just search by name on npm or GitHub search results and click the first one.

The repository has written 100 test cases using Node’s built-in node:test, covering ZIP parsing and security filtering, repository coordinates and caching, host remote methods, and client bundle loading. If you need to verify modified behavior, you can run npm test in the plugin directory.

Summary¶

dsh-skill-manager does not introduce a new skill format, it only aggregates the SKILL.md files already scattered across DSH, Agents, Codex, and Claude directories into the settings page, uses filesystem conventions for hot toggling, and adds two installation paths via ZIP and GitHub archives. For users who are already using DSH Web and maintaining multiple sets of skills, it turns the process of “renaming files, refreshing the list, and confirming whether /skills is visible” into switches and buttons on the panel.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-skill-manager/

GitHub: https://github.com/sulfide2085/dsh-skill-manager