Introduction

The plugin ecosystem of DSH leans towards “everything is a plugin”: once a plugin is installed into a profile, it participates in running with the permissions of the current dsh process. For profile maintainers, relying solely on the plugin name and description page is not enough; they also need to check what it declares and calls before installation, and monitor sensitive behaviors during runtime.

@jieai/dsh-plugin-vet addresses this workflow: pre-install audit and runtime watch.

What is this

Maintained by wulun811 and MIT licensed, @jieai/dsh-plugin-vet has one goal: Audit deepseek-harness (DSH) plugins before install, guard them at runtime.

It does not provide the plugin marketplace itself (catalog/distribution), nor is it an official app store. The default configuration is alarm-only: reports only, blocks nothing; it will not auto-uninstall, kill processes, or rewrite configs, nor will it block by default.

Core Capabilities

The following is divided into before and after installation.

Pre-install

  • Audit DSH plugins before install
  • Static verdict from deterministic scan
  • Pre-install audit protocol
  • Scorecard output for human/model decision
  • Supply-chain checks (typosquat, OSV)
  • Exfiltration and ransomware detection
  • Integrity baseline

Runtime

  • Runtime guard / runtime watch
  • T1 sentinel (memory/fd/child-process monitoring)
  • T2 hooks (fs/child_process/network interception)
  • N7 confirmation blocking
  • Honeypot lures / canaries

Installation

First ensure Node >= 22.19, then add the plugin to the target profile:

dsh plugin --profile <profile> add @jieai/dsh-plugin-vet

This step performs dependency resolution and validation. The first installation into a larger profile may take a few minutes.

If using a local tarball:

dsh plugin --profile <profile> add ./jieai-dsh-plugin-vet-<version>.tgz

After the above steps, you need to add an insert mount entry to cordis.patch.yml when mounting:

- insert:
  - id: plugin-vet
    config:
      mode: report
      autoScan: true

Here, mode: report corresponds to the default reporting mode, and autoScan: true enables the pre-install scan process.

Typical Usage

To enable runtime guarding from the default report mode:

runtimeGuard: watch

Once enabled, you will get:

  • T1 sentinel (memory/fd/child-process monitoring)
  • T2 hooks (fs/child_process/network interception)
  • N7 confirmation blocking

N7 confirmation blocking is part of the explicit scope. If deny mode or paranoid tier is explicitly used, plugin loads will be rolled back, and blocking will occur based on the threshold.

Use Cases and Notes

Suitable for auditing DSH plugins before installation in a profile, especially in scenarios that require checking supply chain, exfiltration/ransomware-related behavior, integrity baselines, and runtime sensitive calls.

A few notes:

  • It is by default a monitoring/reporting tool and does not execute handling for you.
  • It does not provide catalog/distribution; do not treat it as a plugin store.
  • Plugins run with the current dsh process permissions; check the source code and MIT license before installing.
  • runtimeGuard: watch, deny mode, and paranoid tier are all explicit scopes; confirm your understanding of the interception boundaries before enabling them.

Links

  • GitHub: https://github.com/wulun811/dsh-plugin-vet
  • Catalog Page: https://www.skillhub.cn/plugins/wulun811/dsh-plugin-vet