DeepSeek Harness Web adopts a plugin-based architecture. When the number of local Skills (especially winning Skills) increases, managing which Skills are active becomes cumbersome. dsh-skill-manager is designed to list the winning local Skills in the current session and project, and to provide invocation control over them without modifying the underlying filesystem.

Plugin Overview

  • Plugin name: dsh-skill-manager
  • Maintainer: SLin-code
  • License: MIT
  • Positioning: Minimal, security-focused local Skill manager for DeepSeek Harness Web.
  • Category: admin-security

Core Features

  1. Listing and retrieval: Lists the winning local Skills in the current DSH session and project. Supports searching by name, description, source, provider, and path.
  2. On-demand loading: Loads instructions only when a list row is expanded, reducing initialization overhead.
  3. Invocation control: Places “Automatic” and “/name” invocation controls directly on each row, without needing to enter the Skill detail page.
  4. Path and source: Displays the source, provider, and resolved file path.
  5. Read-only constraints: Keeps bundled, symbolic-link, runtime, and non-file Skills read-only.

Installation and Enablement

Before installation, ensure the environment meets the following dependency requirements:
* Node.js version: ^22.19.0 || >=24.0.0
* DSH Web profile compatibility with the 0.1.0-rc.7 or 0.1.1-rc.2 SDK family.

Run the following command to install the plugin:

dsh plugin --profile web add github:SLin-code/dsh-skill-manager

After installation, restart dsh web. In the browser interface, open Settings → Plugins → Skill Manager, select a session, and the plugin can be used.

To remove this plugin, run:

dsh plugin --profile web remove dsh-skill-manager

How It Works and Security Model

The plugin uses a client-Host dual-end architecture and ensures security through strict request validation and file operation mechanisms.

  • Browser-side constraints: The browser side only sends the current sessionId, the exact Skill name, and two invocation booleans (Automatic and /name) to the Host. The browser never provides filesystem paths.
  • Host-side validation: Before processing write operations, the Host revalidates YAML frontmatter and Skill identity, and rejects bundled and symbolic-link Skills.
  • Atomic replacement: Before writing, the Host acquires a cross-process lock and performs an atomic same-directory replacement operation to ensure file state consistency.
  • Content preservation: When replacing files, the plugin preserves existing body text and YAML comments as much as possible.

Applicable Scenarios and Notes

  • Applicable scenarios: Suitable for developers and operations personnel who need fine-grained management of DeepSeek Harness local Skill invocation policies.
  • Permission note: The plugin runs with the permissions of the current DSH process. Before installation, it is recommended to review the source code to confirm its security.
  • Ecosystem context: This plugin is maintained by the community and has no official affiliation with DeepSeek or High-Flyer AI. The community catalog serves only as a plugin index and does not participate in distribution.