dsh-taintguard

Every time your agent fetches a web page, reads an external repository, or calls an MCP tool, third-party text lands in the same context channel as your own instructions, and the model has no reliable way to tell them apart. A tampered README or a page laced with hostile directives can coax the agent into running a shell command or exfiltrating a file. dsh-taintguard is a runtime guard built to sever that indirect prompt-injection chain inside DeepSeek Harness.

Rather than making the model immune to injection, it narrows what untrusted text can reach. Once a tool result originates from a declared untrusted source, privileged calls such as bash, write, or send_message are gated; if an argument carries credential material matched by fixed-shape patterns (AWS key IDs, GitHub tokens, sk- keys, PEM headers, JWTs, and any user-registered canaries), the call is refused in every mode. On the AgentDojo v1.2.1 benchmark the provenance path intercepts 100 percent of injection-driven consequential calls, while the content detector adds auxiliary telemetry. Three operating modes, observe, ask, and deny, let you shadow-test on real traffic before enforcing.

If you run agents on DeepSeek Harness that consume external data through web_fetch, web_search, file reads, or MCP tools, especially in unattended or semi-attended deployments, dsh-taintguard slots in as a lightweight runtime monitor behind your sandboxing and least-privilege setup. It adds no tools, opens no sockets, and costs the model only a 265-character reframe on the affected result, a modest price for a hard block on credential egress and unauthorised privileged calls.