dsh-security-doctor

In the DeepSeek Harness plugin ecosystem, every cordis patch and third-party package runs with your own privileges. The official list itself warns that installing a plugin means executing third-party code as yourself, yet nothing turns the question of Am I safe right now into a single click. dsh-security-doctor fills that gap: a one-click, read-only security health check that runs automatically after install, pops a graded report from the sidebar, never executes the code it inspects, defaults to zero outbound calls, and requires no API key.

Three layers of capability. First, a graded audit with a 0-to-100 ring score, high-severity items pinned to the top, trend comparison, and a remediation prescription sheet. It covers eight check categories including JS expression injection, security-layer patch tampering, third-party plugin inventory, outbound and obfuscation pattern scanning, credential file permission checks, instruction-file hash tracking, endpoint configuration review, and protection policy value auditing. Export as Markdown or JSON. Second, an AI deep-review loop: copy a structured review prompt for a suspicious plugin, hand it to your own Agent for semantic judgment, paste the verdict back, all anchored to a code fingerprint, zero API calls. Third, Guard Mode (experimental, off by default): in-process outbound domain auditing plus a high-value file change sentinel, fully local, and reversible on uninstall.

Built for developers and team admins who run DSH Web, have installed third-party plugins, care about credential file permissions and network egress, and want auditing that never reads content and detection that never modifies files. Zero runtime dependencies, zero install scripts, zero build step, MIT licensed, works on three platforms with Node 22 or higher.