Introduction

DeepSeek Harness (DSH) uses a plugin-based architecture, and developers often need to install external plugins. Before installation, they usually can only see descriptions or demos, making it difficult to know exactly what permissions a plugin will touch or what content it will inject at runtime. dsh-trust-check provides static capability disclosure. It is code-based, provides file line numbers and source snippets as evidence, consumes no tokens, and does not provide a “security/trust” conclusion.

Installation and Enablement

If you want to use the Health Check feature in the DeepSeek Harness Settings page, the host version must meet:

dsh --version
# 确保版本 >= 0.1.0-rc.8

Install the plugin:

dsh plugin --profile web add dsh-trust-check

To upgrade, you can specify latest:

dsh plugin --profile web add dsh-trust-check@latest

After installing, restart dsh web and go to Settings → Plugin Health Check.

Usage

The plugin provides both Web UI and CLI usage modes; both use the same logic.

Web UI

The Web UI depends on @deepseek-ai/dsh-client-store in the host module table. If the host is too old or the module is missing, the Settings page may fail to load. The CLI does not depend on the DSH host and remains usable on older dsh versions.

CLI

The CLI does not depend on the DSH host and is suitable as a CI gate or local audit tool.

# 审计默认 profile web
npx dsh-trust-check

# 审计其他 profile
npx dsh-trust-check --profile work

# 审计任意已解压的包目录（无需 profile、无需 DSH）
npx dsh-trust-check --dir ./path/to/plugin

# 指定 spec 并输出 JSON
npx dsh-trust-check --dir ./pkg --spec npm:foo@1.0.0 --json

# 用退出码做脚本 / CI 闸门
npx dsh-trust-check --dir ./pkg --exit-code

--dir and --profile are mutually exclusive. The output of --json is in the AuditResponse shape.

Core Features

The plugin extracts static facts from plugin source code:

  • Capability Surface: detects shell, file read/write, network, credentials, sub-agents, LLM calls, and environment variables.
  • Injection Surface: detects override or disable operations in cordis.patch.yml, as well as systemPrompt injection.
  • Provenance Surface: verifies the source (repository in package.json) and checks whether the version or commit is locked.
  • Cost Surface: estimates the token cost of skill text and system-prompt injection (reference value).

Report Interpretation

The report uses a decision-first layout, with the reading order as follows:

  1. Decision: view badges, the action sentence, and risk notes.
  2. Scan: view capability chips, injection summary, and provenance.
  3. Forensics: view evidence (file:line + source snippet).

Common verdicts:
* Red line present: a hard red line is matched; default to disabled; continue only after the risk is confirmed.
* Risk confirmed: the current red-line risk has been confirmed.
* Needs review: no hard red line is present, but privileged capabilities or patch changes exist.
* Capabilities as expected: the current capabilities are consistent with the destination fingerprints.
* No static risk signals: no red line or privileged capability is observed; this is not a security guarantee.

Red Lines (High-Confidence Risks)

The following cases should be blocked by default:
1. Declares install / postinstall / preinstall install scripts (prepare is not a red line).
2. cordis.patch.yml overrides / disables the core bundle of @deepseek-ai/*.
3. Reads credential/key values (such as credentials.resolve, keytar.getPassword, etc.) and has network access.
4. Plaintext http:// outbound connection (literal) to a non-localhost, non-RFC 1918 private IP and has network access.
5. Literal IP outbound connection to a non-loopback, non-documentation example network, and non-RFC 1918 private network (10/8, 172.16/12, 192.168/16) and has network access.

Integration and API

The plugin exports a stable API for pre-installation confirmation dialogs or CI gates:

import { auditPlugin, collectPlugin, verdict } from 'dsh-trust-check'

const report = auditPlugin(collectPlugin(extractedDir, spec))

// verdict 返回 'red' | 'review' | 'clear'
// verdict(report) === 'red'     → 命中高置信度风险信号，建议默认挡住
// verdict(report) === 'review'  → 带特权能力，建议展示能力清单
// verdict(report) === 'clear'   → 静态扫描未检出，不代表安全

Notes

  • Not antivirus: the plugin makes no security guarantees and provides no endorsement. Filtering policies are determined by the integrator and the user.
  • Static limitations: static scanning may miss capabilities loaded dynamically (such as import('node:' + …)).
  • Dependency tree not expanded: directory traversal skips node_modules.
  • Exit codes: the default exit code is always 0. With --exit-code, 0 means no findings, 1 means needs review, 2 means red line, and 3 means scan failure.

Summary

dsh-trust-check is a static audit tool for DeepSeek Harness plugins. It provides capability disclosure and provenance verification through code analysis and is suitable for quick screening before installing plugins.

Directory Page | GitHub