dsh-plugin-guard

Installing third-party plugins into DeepSeek Harness carries a real risk: a single package can embed prompt-injection payloads, credential-stealing chains, or destructive scripts that only become visible once the plugin is active. dsh-plugin-guard addresses this by performing a deterministic, fully offline static scan of the plugin files before they are loaded, returning a graded verdict of REVIEWABLE, CAUTION, or DO_NOT_INSTALL so you never have to execute untrusted code to discover a problem.

The scanner covers a broad set of threat classes, including prompt injection with bilingual hidden directives and tool-description poisoning, file ransomware and bulk destruction, credential and environment-variable exfiltration chains, supply-chain risks such as download-and-execute install scripts and unpinned dependencies, dynamic execution and privilege escalation like eval, subprocess, and disabled TLS verification, Unicode zero-width and bidirectional control-character spoofing, and DSH metadata parseability. Every scan is read-only, uses lstat to skip symlinks, and enforces hard caps on file size, total bytes, file count, and finding count. No network access and no API key are required, and scan evidence is truncated to prevent large hostile payloads from being re-injected into the model context.

It is well suited to developers, operators, and security reviewers who regularly install community plugins into Harness, as well as teams that want a lightweight, automatable gate in their plugin-acceptance workflow. A standalone CLI mode lets you scan a local directory without launching the Web UI at all. It is not a substitute for sandboxing, egress control, or human code review, but it adds a low-cost, repeatable checkpoint at the most critical moment: right before a plugin is activated.