dsh-shadow-auditor

When autonomous DeepSeek Harness agents write code, stage files, or execute shell scripts, a quiet risk lingers: API keys and database credentials can slip into git diffs, or a stray rm -rf and fork bomb can run before anyone notices. dsh-shadow-auditor operates as an in-process security firewall that performs regex and entropy-based scanning before code reaches an LLM or version control, parses shell command ASTs to intercept destructive operations, and blocks network utilities like curl and wget from exfiltrating sensitive files such as .env or id_rsa, adding a deterministic safety net to every agent action.

The plugin ships with a configurable rules engine, a live audit dashboard, and a 0-to-100 deterministic risk score that includes a 10-minute rolling window with cumulative repeat-tag and consecutive high-risk penalties. A recursive redaction module iteratively sanitizes deeply nested tokens and passwords before they appear in logs or the Web UI. Compound command chains joined by &&, ||, or semicolons are segmented and verified individually, closing the loophole where an allowlisted prefix could mask a dangerous trailing command.

If your DeepSeek Harness workflow touches sensitive credentials, whether CI key rotation, database maintenance scripts, or multi-agent development pipelines, dsh-shadow-auditor provides a non-intrusive, zero-LLM-overhead security layer that lets your agents move fast while keeping your secrets and critical files firmly in place.