Preface¶

DSH supports installing third-party plugins. Once a plugin enters a profile, it may access files, processes, the network, environment variables, and credential paths. dsh-plugin-audit provides static permission profiling and a runtime sentinel to help administrators assess a plugin’s permission surface before running it.

What This Is¶

dsh-plugin-audit is a security audit plugin for DeepSeek Harness, maintained by jkrandom-sudo, licensed under MIT, with a current version of 0.1.4. It does two things: it statically scans third-party plugins with plugin_audit, and it requests approval for high-risk tool calls at runtime.

Core Features¶

Below, we first introduce static profiling, then the runtime sentinel.

Static Permission Profiling¶

plugin_audit scans a plugin directory. It examines the plugin source directory, package.json, and cordis.patch.yml, then returns a permission profiling card with file and line number evidence.

The static scanner reports every network surface it discovers. It does not apply whitelist filtering based on allowedHosts, nor does it make a final risk determination; the report serves as evidence for manual review.

Runtime Sentinel¶

dsh-plugin-audit listens to DSH’s tools/pre-execute event. When a pending tool call matches any of the following rules, the sentinel requests approval:

1. Tool arguments reference a credential path;
2. The tool call sends data externally, and the target host is not in allowedHosts;
3. A write tool targets a dotfile under the home directory.

If no approval channel is available, the plugin rejects the tool call rather than silently allowing it.

The sentinel only checks tool call names and arguments; it does not read files or environment variables, nor does it inspect session content beyond the call arguments.

Read-Only Constraint¶

The scanner is read-only by convention. Every report carries writesPerformed: false. An optional invariant companion can enforce this flag.

The scanner’s scan boundaries are as follows:

• Up to 400 files, with a single-file limit of 256 KB;
• Skips node_modules, .git, lib, and dist;
• Does not follow symbolic link targets;
• Based on source text rather than AST, so strings and comments may also be reported;
• Packages containing only build artifacts receive at least a NOTICE level;
• Plugins do not make network calls and have no telemetry; hosts in reports are extracted from scanned text and are never accessed.

Installation and Enablement¶

First, install it into the web profile:

dsh plugin --profile web add dsh-plugin-audit

After the above step, use plugin_audit in the profile where the plugin is installed.

To remove the plugin:

dsh plugin --profile web remove dsh-plugin-audit

Typical Usage¶

In a session, you can use an example like this:

Audit the plugin at ~/some-third-party-plugin with plugin_audit

You can also invoke the tool directly:

{
  "path": "/absolute/path/to/plugin",
  "format": "markdown"
}

Here, path points to the plugin directory to audit, and format is set to markdown.

Configuration¶

The sentinel and allowed hosts are configured via the profile’s cordis.patch.yml:

sentinelEnabled: true
allowedHosts:
  - example.com
  - api.example.com

sentinelEnabled controls whether the runtime sentinel is enabled; allowedHosts configures allowed external hosts. The static scanner is not affected by allowedHosts.

Compatibility¶

Applicable Scenarios and Notes¶

It is suitable for the following scenarios:

• Reviewing a plugin’s permission profile before installing DSH third-party plugins;
• Intercepting tool calls that reference credential paths, access unknown hosts, or write to home dotfiles at runtime;
• Configuring different allowedHosts for different profiles.

Note: DSH plugins run with the current DSH process’s permissions. Before installation, inspect the source code, license, and configuration items. The audit card is evidence, not a security conclusion; for sensitive plugins, manually review findings related to files, the network, processes, and credentials.

Links¶

GitHub repository: https://github.com/jkrandom-sudo/dsh-plugin-audit

Catalog page: https://www.skillhub.cn/plugins/jkrandom-sudo/dsh-plugin-audit