In the plugin ecosystem of DeepSeek Harness (DSH), code security scanning is a common requirement in AI agent development and operations. To address how to automatically detect vulnerabilities, leaked secrets, and compliance issues in code, xby-scan-code provides an AI-based solution.

What It Is

This is a DSH plugin maintained by xby-skill, primarily used for performing security reviews of code. It is licensed under the MIT License. Its core purpose is to scan for security vulnerabilities, detect leaked secrets and credentials, and check whether code meets relevant regulatory compliance requirements.

Installation

Run the following command in your terminal to install the plugin:

dsh plugin --profile web add github:xby_skill/xby-scan-code

Core Features

The plugin provides the following key capabilities:

  • set_xby_apikey: Sets the API key in chat. This action is automatically persisted and remains valid after restarting the process.
  • scanCode: Performs a comprehensive scan to detect security vulnerabilities, secrets, and compliance issues.
  • scanVulnerabilities: Quickly scans for vulnerabilities in the code.
  • detectSecrets: Detects exposed secrets, API keys, and credentials.
  • suggestSecureFix: Generates secure code remediation suggestions for discovered vulnerabilities.
  • checkCompliance: Checks whether code meets regulatory compliance requirements. Supported standards include GDPR, HIPAA, SOC2, and PCI DSS.

Usage and Configuration

Before use, you need to obtain an API key first. Please visit the Xiao Benyang official website to register and obtain a key, then enter it in the DSH chat interface using the set_xby_apikey command.

Notes

The plugin runs with the permissions of the current DSH process. Before installation, review the source code and license (this project is MIT-licensed). This tool relies on an external API key service.

Summary

xby-scan-code is an auxiliary tool focused on static code security review, suitable for development workflows that require automated code auditing. For more details, refer to the community directory or the GitHub repository.