dsh-prompt-shield

In DeepSeek Harness, text returned by Web, MCP, browser, shell, file, and other tools lands in the model's next context at the tools/post-execute boundary with no gate in between. A single indirect prompt-injection hidden in that payload can steer the model into reading secrets, exfiltrating credentials, or overriding its own instructions—and the operator never sees the raw match. dsh-prompt-shield plugs exactly that gap: it scans every tool result before it is committed, using a set of deterministic rules that require no extra model call, no network service, and never surface the matched text in logs or block feedback.

The detection surface covers attempts to override system, developer, or user instructions; requests to read secrets and environment variables via tools or shells; exfiltration of credentials to external endpoints; forged system or authority markers paired with imperatives; zero-width and bidirectional Unicode obfuscation; instructions split across text blocks; and plausible single-layer Base64-encoded payloads. High-confidence rules ship in both English and Chinese. Each finding exposes only a rule ID, a confidence score, and a SHA-256-derived fingerprint—the matched text itself is never copied into model-facing output.

Three modes let you roll out safely: observe records a safe summary and leaves the result untouched; warn (the default) prepends a warning while preserving the original text, giving you a tuning window to watch false-positive rates; block replaces the tool result with a quarantine error so the raw payload never enters model context or durable storage. Tool-name include and exclude accept wildcards, and the default scans every tool because untrusted instructions can arrive through remote APIs just as easily as through repository files or shell output.

The plugin suits DSH workloads that depend on external tool returns—Web scraping, MCP servers, browser automation, shell pipelines—and want a lightweight, auditable deterministic layer on top of sandboxing, permission policy, and credential redaction. Keep in mind that v0.1.0 is a narrow defense, not a security proof: deterministic rules will miss novel phrasing and can flag documentation that merely quotes an attack. Image OCR, arbitrary cipher decoding, semantic model classification, and a management UI are not yet included. It complements, and does not replace, the isolation and review practices already in place.