Introduction

The core philosophy of DeepSeek Harness (DSH) is “everything is a plugin.” For developers, reproducing security audit capabilities similar to OpenAI codex-security in local or CI environments usually requires introducing an additional Python environment, a vector database, or complex dependency chains. id7869/dsh-security is a standalone plugin that borrows only the methodology of codex-security and rebuilds the complete audit workflow of “discover → validate → report” within DSH’s native capabilities.

Core Features

The plugin exists as a standalone DSH plugin (including skills and workflows) and does not depend on external Python or Docker environments.

  1. Complete audit workflow: covers code inventory, threat modeling, candidate vulnerability discovery, independent validation, deduplication, severity re-rating, report generation, and sealing.
  2. Deduplication mechanism: performs two-stage review based on fingerprints (djb2/FNV-1a) and historical records (coarse filtering into SAME/DISTINCT, deep confirmation via canonical+merged) to avoid duplicate alerts.
  3. Local persistence: uses only local JSONL files to store state (the state/ directory), without relying on SQLite or Mnemon.
  4. Zero static dependencies: lib/index.js references only Node.js built-in modules, has no static peer dependencies such as @deepseek-ai/dsh-skill, and does not require building node_modules after installation.

Installation and Enablement

Before installation, ensure the environment meets the following requirements:
* DSH version ≥ 0.1.5-rc.1
* Node.js ≥ 22

It is recommended to install via local clone + link:

# 1) clone 到本地工作区
git clone https://github.com/id7869/dsh-security.git C:\gh-workspace\dsh-security

# 2) link 到 DSH profile（以 web 为例）
dsh plugin --profile web add "C:\gh-workspace\dsh-security"

# 3) 重新启动该 profile 使插件生效
dsh --profile web

After installation, type “list the available skills for dsh-security” in a DSH session, and you should see the entry skill dsh-security-run.

Usage

Trigger it directly with natural language in a session. The plugin automatically selects the corresponding workflow or skill based on intent. Supported operations include:
* “Scan this repository”
* “Fix this vulnerability”
* “Ingest this alert”

Run Workflows Manually

You can also directly invoke the native workflow tool in a session and pass parameters to execute the plugin’s built-in scripts.

Scan (workflow/scan.js)

{
  "repo": "C:/path/to/your/repo",
  "skillDir": "C:/path/to/dsh-security/skills",
  "outputDir": "C:/path/to/output",
  "stateDir": "C:/path/to/dsh-security/state",
  "mode": "standard",
  "maxDiscoveryRuns": 5,
  "stopAfterNoNew": 2,
  "classify": false
}

Diff Scan (workflow/diff.js)

Audits only changed files, intended for code review.

{
  "repo": "C:/path/to/your/repo",
  "skillDir": "C:/path/to/dsh-security/skills",
  "outputDir": "C:/path/to/output",
  "stateDir": "C:/path/to/dsh-security/state",
  "baseRef": "main",
  "headRef": "HEAD"
}

Fix (workflow/fix.js)

Fixes the specified finding and revalidates it.

{
  "repo": "C:/path/to/your/repo",
  "skillDir": "C:/path/to/dsh-security/skills",
  "outputDir": "C:/path/to/output",
  "stateDir": "C:/path/to/dsh-security/state",
  "verify": true,
  "findings": [{ "title": "SQL injection in POST /login handler", "location": {"file": "src/index.js", "line": 17}, "category": "SQL injection", "severity": "high", "remediation": "改用参数化查询" }]
}

Ingest Existing Findings (workflow/triage.js)

Imports vulnerabilities from external findings (such as external scanners) into DSH’s audit system.

{
  "repo": "C:/path/to/your/repo",
  "skillDir": "C:/path/to/dsh-security/skills",
  "outputDir": "C:/path/to/output",
  "stateDir": "C:/path/to/dsh-security/state",
  "findings": [{ "title": "Possible XSS in search", "location": {"file": "src/index.js"}, "category": "XSS" }]
}

Track (workflow/track.js)

Exports findings to an external ticketing system or locally.

{
  "repo": "C:/path/to/your/repo",
  "skillDir": "C:/path/to/dsh-security/skills",
  "outputDir": "C:/path/to/output",
  "stateDir": "C:/path/to/dsh-security/state",
  "destination": "auto",
  "findings": [{ "id": "csf_1234567890abcdef", "title": "XSS" }]
}

Outputs and Directory Structure

After running the plugin, the following core files are generated in outputDir and stateDir:

  • State files: findings.jsonl (reportable findings), findings-index.jsonl (index), scans.jsonl (scan summary), dedupe-groups.jsonl (deduplication groups).
  • Audit reports: findings.json, report.md, exports/results.sarif (SARIF format), coverage.json (code coverage snapshot).
  • Metadata: scan-manifest.json (generated during the seal stage and includes hash verification).
  • Directory structure:
    • skills/: contains stage-specific skills such as inventory, discover, validate, dedupe, report, and seal.
    • workflow/: orchestration scripts such as scan.js, diff.js, fix.js, triage.js, and track.js.
    • state/: local JSONL workbench used for cross-scan deduplication and historical recall.

Notes

  • Runtime permissions: the plugin runs under the DSH process permissions; ensure the DSH process has read/write access to the target repository.
  • Ecosystem affiliation: this plugin is a community project maintained by user id7869 and has no official affiliation with DeepSeek or the official app store.
  • License: MIT License.

Summary

id7869/dsh-security provides a solution for completing the full security audit process inside DSH. By reusing DSH’s own model capabilities and combining local JSONL deduplication and persistence, it closes the loop from discovery to remediation without adding additional environmental overhead. The related source code and documentation are available in the GitHub repository.