dsh-llmasking
Run the following command in DeepSeek Harness:
dsh plugin install yolorouter/dsh-llmasking
Paste the following prompt into your AI chat to install this plugin:
Run dsh plugin install yolorouter/dsh-llmasking in your DeepSeek Harness terminal to install the plugin; for a source install, clone https://github.com/yolorouter/dsh-llmasking and link it into your profile with dsh plugin link.
About this plugin
Every time you chat with an AI, API keys, phone numbers, project codes, and emails cross the wire in plaintext—yet your local session log, terminal UI, and tool executions all need the real values. dsh-llmasking draws the security boundary at the exact moment data leaves the process: placeholders on the wire, truth everywhere else.
It intercepts dsh's llm/stream waterfall, builds a frozen masked copy for the outbound request, then wraps the response stream so placeholders split across chunk boundaries are withheld and stitched at block close. Tool-call arguments are restored before execution so files and commands operate on real values. Detectors cover emails, bank cards (Luhn), IPs, international phones, cloud keys, PEM blocks, JWTs, git tokens, and high-entropy passwords, with optional CN packs (mobile, ID card ISO 7064, landline) and US packs (SSN, phone), plus custom keywords. Within a session, identical values map to identical placeholders; the secret family is redacted one-way. A monitor shadow mode lets you count before you enforce.
Built for developers and admins running dsh (deepseek-harness) whose conversations carry sensitive data. Zero network calls of its own, no user-file reads, all mappings in memory—process ends, everything is gone. Drop it into a profile and the boundary is in place.
Use Cases
- Conversations contain API keys, phone numbers, or emails that must be masked before reaching the LLM while local logs and UI keep the real values
- Tool executions need real arguments but the wire must carry placeholders, with transparent two-way restoration
- Compliance demands one-way secret redaction with zero third-party network calls and no extra services to run
Best For
- Developers running dsh or deepseek-harness whose prompts contain sensitive data
- Ops and security admins adding a transport-layer masking boundary to an AI gateway
- Platform teams concerned about PII or credential leakage in the LLM call chain
Related Plugins
Adds an Auto approval mode on the official workspace-write sandbox, classifying semantic risks, asking when ambiguous, and denying destructive operations.
Undo/rollback system for DSH: config & plugin snapshots, one-click undo/redo/restore, message-level revert, secret masking, safe mode, and offline WebUI/GUI/CLI rescue tools for when DSH won't start.
Packages all 87 SKILL.md files from upstream reverse-skill as a DeepSeek Harness plugin that auto-registers them for authorized reverse engineering, penetration testing, and security research.
Dockyard DSH is a native DeepSeek Harness plugin that unifies official OAuth/client sessions for Codex, Antigravity, Grok, Claude, and Cursor, providing account pool, model catalog, and quota status.