Introduction¶

DSH agent capabilities are typically based on local skills. In practice, sometimes it is also necessary to look up skill packages from skills.sh or public GitHub repositories, and install them locally to the machine after confirming their suitability.

dsh-skill-remote is a DeepSeek Harness plugin designed for this scenario: it lists remote candidate skills in the session skills directory and allows the model to invoke the installation tool when needed, thereby downloading the skill packages locally.

What is this¶

dsh-skill-remote is a DeepSeek Harness plugin maintained by CSY656, positioned as a Remote skills.sh/GitHub skill provider and installer plugin for DeepSeek Harness.

It mainly addresses two things:

1. Display remote skill candidates and local skills in the same location;
2. After the model confirms, install the remote skill package locally, handing it over to DSH’s built-in filesystem provider.

The license is MIT.

Core Features¶

Remote Skill Candidates¶

The plugin provides a remote skill provider, represented by the interface ctx.skills.

It can discover candidate skills from skills.sh or github.com URLs, appearing together with local skills in the session skills directory. Skill content is loaded on demand; it does not pull all remote content into the session at the start.

Install Skill Packages¶

The plugin provides the install_skill tool to the model.

After the model calls this tool, the plugin atomically downloads the skill package to:

$DSH_HOME/skills/<name>/

After installation, DSH’s built-in filesystem provider takes over the skill, and no restart is required.

Zero Network by Default¶

When remotes are not configured and no installation request has occurred, the plugin does not initiate network I/O.

In other words, it does not proactively scan network resources by default.

Supported URL Formats¶

The following introduces the three types of remote URLs supported by the plugin:

https://www.skills.sh/<owner>/<repo>/<skill>
https://github.com/<owner>/<repo>/tree/<ref>/<subpath>
https://raw.githubusercontent.com/<owner>/<repo>/<ref>/<subpath>/<file>

These URLs can be used for skill candidate discovery or as installation sources.

Installation and Activation¶

The plugin requires the DeepSeek Harness next branch, specifically:

dsh >= 0.1.0-rc.6

And the corresponding dsh-skill 0.1.0-rc.6.

When using the npm package, run:

dsh plugin --profile default add dsh-skill-remote

If you choose to install from GitHub source and the pnpm build allowance is triggered, you may need to first allow the package to build in the profile’s pnpm-workspace.yaml:

allowBuilds:
  dsh-skill-remote: true

Then run the corresponding add command again.

Typical Usage¶

Let the Agent Install a Specified Skill¶

The example below can be handed directly to the agent:

Install the skill at https://github.com/anthropics/skills/tree/main/skills/docx

After the steps above, the model will call install_skill and install the corresponding skill package to the local skills directory.

Pre-register Read-only Remote Sources¶

You can also pre-register read-only remote sources in the profile. Example configuration:

# profile cordis.patch.yml
- update:
    - id: skill-remote
      config:
        remotes:
          - https://github.com/anthropics/skills/tree/main/skills/docx

The configuration item is located at config.remotes.

Security Constraints¶

The plugin includes a set of hardcoded constraints to restrict the download and installation of remote skill packages:

The installation process is atomic: the skill package is first downloaded to the local staging directory, and only after successful validation is it renamed to the target location. Validation requires that SKILL.md exists; any failure will remove the staging directory.

Use Cases and Notes¶

Suitable for the following scenarios:

1. View skill candidates from skills.sh or public GitHub repositories in DSH;
2. Install remote skill packages to $DSH_HOME/skills/<name>/ after confirmation;
3. Add remote skill discovery capabilities to DSH in the plugin directory.

Notes to be aware of:

• The plugin runs with the current dsh process permissions. You should check the source code and license before installing.
• Only public repositories are supported: no reading, saving, or sending tokens; no OAuth or private repositories.
• Unauthenticated GitHub API rate limits apply: 60 req/h per IP.
• Remote sources are only discovered for direct children and do not recursively scan the entire repository.
• No version pinning capability: every load fetches the current ref tip; installation is the only way to persist.
• Installation executes the build logic inside the remote package, so ensure the source is trustworthy.

Conclusion¶

The value of dsh-skill-remote lies in: it brings remote skill candidates into the DSH skills directory and transforms “temporary loading” into a local installation that is checkable, rejectable, and fallback-able.

Repository URL:

https://github.com/CSY656/dsh-skill-remote