dsh-credential-manager

When using large language models for automation or executing shell commands, directly embedding API keys or sensitive credentials into the conversation poses significant security risks. dsh-credential-manager addresses this issue with a secure "reference" mechanism. It allows the model to create empty credential placeholders when needed, while the actual secret values are filled in by the user through a secure settings interface, ensuring a strict separation between the model's logic and sensitive data.

The core strength of this plugin lies in its robust isolation and seamless integration. By injecting DSH_CM_ environment variables, the plugin ensures that sensitive data exists only transiently within the shell execution environment and is never exposed in the transcript or web interface. With tools like credential_list and credential_create, users can manage credentials efficiently, including support for expiration tracking, allowing models to safely interact with external services without compromising security.

This plugin is ideal for developers and DevOps professionals who need to deploy secure automation workflows within DeepSeek Harness. Whether performing API calls, system administration, or CI/CD tasks, if the model requires access to protected resources, this tool acts as a reliable security gatekeeper. It requires no source code modifications and offers zero-configuration defaults, making it the optimal choice for enhancing model security and preventing credential leakage.