MIT-licensed, read-only DeepSeek Harness plugin that detects prompt injection, redacts PII, and audits the local DSH host for OWASP LLM / Agentic Top 10 posture with redacted, self-checksummed, reproducible reports.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-30
License
MIT
01What can it help you accomplish?
Detect prompt-injection attempts in DeepSeek Harness text before it reaches the model
allow / review / block verdicts, a riskLevel, and an inputSha256 for replayable, auditable decisions
Security-conscious DSH operators who need a read-only gate on untrusted or user-supplied input
Audit the local DeepSeek Harness install for OWASP LLM / Agentic Top 10 posture
11 read-only checks across config / sessions / plugins / paths / network / env / host with a redacted, self-checksummed report
Compliance reviewers and platform teams hardening a DSH host before production use
02How to install into DeepSeek Harness
Prerequisites
- DeepSeek Harness runtime, which supplies the `@deepseek-ai/dsh-tools >= 0.1.0-rc.7` peer dependency
- Node.js (the plugin's `lib/` imports only Node builtins; no extra runtime dependency is required)
Installation steps
- 01
Install from the npm registry: `dsh plugin add dsh-secure-audit` (installs the latest release)
$ dsh plugin add dsh-secure-audit
- 02
Or from a release tarball: `dsh plugin add ./dsh-secure-audit-0.2.7.tgz`
$ dsh plugin add ./dsh-secure-audit-0.2.7.tgz
- 03
Or from git source, pinning the commit: `dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>`
$ dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>
Verify the integration
- Reload the web profile (or restart the harness), then confirm the bundle is listed in `dsh profile.bundles`
- Confirm `dsh web --dump-config` shows the `secure-audit` row
Rollback
- Follow the backup-first uninstall / upgrade / rollback checklist in `docs/uninstall-rollback-checklist.md`; it covers removing the plugin without disturbing the host profile
03DSH integration and capability boundaries
Registers four tools and one skill at DeepSeek Harness host boot via the DSH runtime (dsh-tools peer dependency); invoked through the dsh plugin system.
Prompt-injection detection (security_scan_text)
untrusted text (optionally masked via maskText)→allow / review / block decision, riskLevel, and inputSha256 for replay
PII redaction (security_redact_text / security_redact_json)
text or structured JSON (with optional keyModes regexes)→redacted text / JSON with CN PII, emails, keys masked; structure preserved
Local security audit (security_audit)
scope[] of config / sessions / plugins / paths / network / env / host, profile quick|full→checks[] + summary pass/warn/fail/error/info, OWASP mappings, redacted reportSha256
Reads host config / sessions / plugins / paths / network / env / host via stat/readdir/readFile/env/os; opt-in `logFile` writes an append-only JSONL audit log (disabled by default)
04Who is it for? When not to use it?
Good for
- Security-conscious DSH operators who need a read-only gate on untrusted or user-supplied input
- Compliance reviewers and platform teams hardening a DSH host before production use
Not for
- Fail-open by default — on a scan budget timeout the decision downgrades to `allow` with a warning, so it cannot block availability; set `onTimeout: review|block` for fail-closed sensitive flows.
- Windows ACLs are not inspected by the file-permission checks (Node has no native ACL API), and live listening-port ground truth runs on Linux only (`/proc/net`); other platforms rely on env/config evidence.
05Compatibility, maintenance and safety notes
- Fail-open by default — on a scan budget timeout the decision downgrades to `allow` with a warning, so it cannot block availability; set `onTimeout: review|block` for fail-closed sensitive flows.
- Windows ACLs are not inspected by the file-permission checks (Node has no native ACL API), and live listening-port ground truth runs on Linux only (`/proc/net`); other platforms rely on env/config evidence.
- The opt-in live supply-chain check (`supplyChainLive: true`) sends installed plugin names + versions to registry.npmjs.org; offline inventory is the default and the live call is skipped under `profile: quick`.
MIT · actively maintained (latest release v0.2.7, 2026-08-30)
06Frequently asked questions
How do I install dsh-secure-audit into DeepSeek Harness?
Run `dsh plugin add dsh-secure-audit` to install the latest release from the registry; a release tarball (`dsh plugin add ./dsh-secure-audit-<version>.tgz`) or a pinned git source (`dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>`) also work. There is no build step or install script.
How do I confirm the tools registered after install?
Reload the web profile or restart the harness, then verify the bundle is listed in `dsh profile.bundles` and that `dsh web --dump-config` shows the `secure-audit` row.
Does the plugin write to or change my system?
No — the plugin never writes, deletes, or executes anything on the audited system; audit / redaction / scan paths are reads only, and the single write is an opt-in append-only `logFile` audit log disabled by default.
What does the local audit check, and is it portable?
It runs 11 read-only checks across config / sessions / plugins / paths / network / env / host mapped to OWASP LLM + Agentic Top 10. Note Windows ACLs are not inspected and live listening-port checks run on Linux only (`/proc/net`).
Is the detection deterministic and verifiable?
Yes — scan results carry `inputSha256` and reports carry `reportSha256`, so decisions and reports can be replayed and verified locally; redaction is applied on every output path.
07Related DSH workflows
tencentmeeting-cli
by tencentcloud
Tencent Meeting command-line tool with OAuth2 authorization for meeting, recording and attendance-report management.
dsh-auto-review
by perrylink
Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the session log (approval/asked -> autoReview/verdict -> approval/decided).
dsh-permission-rules
by perrylink
Claude Code-style declarative permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, session-log audit, and HMR reload.
dsh-sandbox-escalation-fix
by hakureimonika
Project per-session sandbox escalation schemas and suppress redundant escalation retries in DSH.
08Data and sources
Read-only security and compliance plugin for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).
Peer dependency: `@deepseek-ai/dsh-tools >= 0.1.0-rc.7`, provided by the DSH runtime.
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-30. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.