Introduction

The DeepSeek Harness (DSH) ecosystem relies heavily on third-party plugins. Installing plugins of unknown origin from the plugin marketplace or community marketplace can lead directly to code injection or permission risks if executed as-is. dsh-plugin-safety is an installation-time safety gate plugin. It intercepts installation requests initiated from the marketplace and performs static scanning and metadata review for plugins sourced from npm or GitHub before any code is executed. Through a scoring mechanism, safe plugins are passed silently, while risky plugins trigger a review report, allowing users to decide whether to continue installation.

Core Mechanism

This plugin intercepts installation requests by wrapping DSH’s window.fetch. When a user clicks Install in the marketplace UI, the request is intercepted and forwarded to the host-side /api/plugin-safety/check endpoint.

The scanning process mainly has two parts:

  1. Source Code Static Scanning: For npm tarballs or GitHub repository archives, it extracts JS/TS source code. Checks include lifecycle scripts (install/prepare), remote code execution chains (eval/new Function), hardcoded public IPs, persistence mechanisms (autostart scripts), secret file access, child process execution, and so on.
  2. Metadata Signal Analysis: It retrieves metadata from the npm registry or GitHub API. Checks include publish time (<7 days), download count, star count, license declaration, repository archive status, and package name similarity (spoofing detection).

The scan result returns a verdict (safe / caution / high-risk / unknown). If it is safe, the request is allowed as-is; otherwise, a dialog is shown with the score and evidence. The user can choose “Install Anyway”, “Cancel”, or “Trust and Add to Whitelist”.

Installation and Enablement

To install this plugin, add it to DSH’s desktop profile.

  1. Enter the profile directory:
    cd ~/.dsh/profiles/desktop
  1. Add the plugin using pnpm (replace with the actual path):
    pnpm add file:/绝对路径/dsh-plugin-safety
  1. Modify the profile’s package.json and append dsh-plugin-safety to the dsh.profile.bundles list.
  2. Restart DSH Desktop to make the plugin take effect.

Configuration

In the DSH Settings page under “Plugins → Installation Safety”, you can adjust the following parameters:

  • Enable Checking: Enabled by default. When disabled, all installation requests are allowed directly without scanning.
  • Minimum Risk Requiring Confirmation:
    • caution: Any risk that requires confirmation triggers a dialog.
    • risky: Only high-risk (≥ 20 points) plugins are blocked.
  • Whitelist: Supports npm package names, GitHub repository URLs, or URLs. Matching rules are allowed directly without scoring.
  • Blacklist: Same as above. Matching rules immediately return a high-risk block.

Decision Rules

The plugin scores target plugins using heuristic rules; the total score determines the risk level.

Static Scanning Score Items

  • High risk (12-14 points): remote code execution chain (download + eval + child process), dynamic code execution (eval/new Function/vm), suspicious lifecycle scripts (download and execute), hardcoded public IP or cloud metadata address, data exfiltration signals, persistence mechanisms, secret paths co-occurring with file I/O, child process execution / writing to the home directory.
  • Medium risk (8-10 points): listening ports, shell command interpreter invocations, lifecycle scripts (install: 8 points, prepare: 4 points), large Base64 payloads, decryption routines, native module chains, access to secret environment variables, plaintext HTTP external connections.
  • Low risk (3-5 points): fetching external URLs, compilation chain during installation, native build declarations (gypfile).
  • Very low risk (1 point): missing integrity checks, single maintainer.

Metadata Signal Additions

  • Published less than 7 days ago: +7
  • Very low download count: +3~5
  • No repository or license: +2~3
  • Very low star count: +2~5
  • Repository is archived: +5
  • Package name spoofing (Levenshtein distance ≤2 after stripping punctuation): +8

Risk Level Judgment

  • risky: total score ≥ 20 points.
  • caution: total score ≥ 8 points, or a critical finding exists, or scanning is incomplete (e.g., corrupted archive, file count exceeds limit).
  • safe: otherwise.
  • unknown: target cannot be resolved or scanning fails.

Limitations and Cautions

This plugin is based on heuristic rules, not mathematical proof, so false positives or false negatives may occur. It does not provide absolute code-level security guarantees.

  • Interception Scope: Only installations initiated from the marketplace UI are intercepted (including the two-step preview/execute flow of Community Market). Running pnpm add directly in a terminal or manually modifying the profile bypasses this process.
  • Update Checking: The marketplace “Update” request body does not include the source URL, so updates cannot be safety-checked.
  • API Rate Limiting: If GitHub API rate limiting is triggered, metadata signals will be absent (scored as 2 points with a notice), while source code scanning remains unaffected.
  • Dependency Source: The plugin itself is published via npm; when installed, it scans itself, forming a closed loop.

Use Cases

Suitable for developers with high requirements for plugin security, or when using a community marketplace and wanting to perform a second review of packages from unknown sources.