Introduction

One of the design principles of DeepSeek Harness (DSH) is a plugin-based architecture. The Team Skill Base is the central hub for storing and managing Skills, but in practical development, retrieving and installing Skills from the Skill Base often requires manual operations or external tools. internal-skill-workshop is a DSH Web plugin. By providing a visual directory interface, it addresses the need to directly browse, log in to, and install team Skills within a DSH environment.

What Is This?

This is a team directory client plugin. It connects to the configured Skill Base server through the DSH Settings interface and provides the following capabilities:
* Configuration management: Provides a DSH settings entry for managing the Team Skill Base address.
* Default address: Administrators can preconfigure a shared server address in the configuration file, so team members do not need to enter it manually each time.
* Public browsing: Browse Skills in the public directory without an account.
* Private access: Log in via a verification code mechanism to access private Skills.
* One-click installation: Download and install Skills into the DSH user Skill directory.
* Metadata display: Display information such as author, version, visibility, type, compatible tools, and tags.

Installation and Enablement

Use the official installation command to add the plugin to DSH Web.

dsh plugin --profile web add internal-skill-workshop

After installation, restart DSH Web and then open Settings -> Internal Skill Workshop in the interface.

Configuration and Usage

Basic Configuration

Administrators can predefine the default Skill Base address for this plugin in the DSH cordis.patch.yml configuration file.

- id: internal-skill-workshop
  config:
    baseUrl: https://skills.company.example

Members can also save a personal address in the plugin interface. Personal configuration overrides the default configuration.

Usage Workflow

  1. Open Settings -> Internal Skill Workshop.
  2. Confirm or enter the root address of the Skill Base (make sure it does not include the /api suffix).
  3. You can immediately search and browse public Skills.
  4. To view private Skills, select Get code. You are redirected to the Skill Base page. Log in, copy the generated verification code, and paste it back into the plugin.
  5. Select the target Skill and click Install to complete the installation.

Security and Credentials

This plugin never asks you to enter the Skill Base password. It obtains access tokens through a secure workflow:

  • Verification code mechanism: The plugin generates a one-time verification code valid for 5 minutes. Users log in on the Skill Base page and exchange this code for a Skill Base personal access token (PAT).
  • Storage location: The DSH host stores the PAT in $DSH_HOME/internal-skill-workshop/credentials.
  • Permission control: The stored file is set to owner-read-only where the platform supports it.
  • Security boundary: The browser communicates with the host only through Loopback DSH RPC. The host validates Skill Base URLs and rejects remote HTTP, credentials, query strings, fragments, and redirects. Installation is performed by staging the data and then applying an atomic rename.

Limitations and Notes

This plugin imposes limits on resources and requests, as follows:

  • File size: Downloaded archives are limited to 50 MB, extracted content is limited to 100 MB, and file entries are limited to 2,000.
  • Response limit: JSON responses from the Skill Base are limited to 5 MB.
  • Compatibility: Requires Node.js version >= 18.
  • Update mechanism: The current version does not support updating or replacing existing Skills that contain local modifications. Before installation, it checks whether the target directory exists and refuses to overwrite it.
  • Protocol requirement: HTTPS is required when connecting to remote servers, except in local development environments.

This plugin focuses on client-side directory browsing and installation. It does not include or deploy the Skill Base server itself.