dsh-dlp
Data-loss prevention and secret redaction plugin for DeepSeek Harness agents.
Install
$ dsh plugin --profile <name> add @deepseek-ai/[email protected]Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Unconditional tool guard denying credential file access, path traversal, and outbound secrets
- Pre-model and session-log secret redaction across tool results, injected contexts, and claimed inputs
- Fail-closed telemetry redaction covering message content, tool arguments, results, and workspace paths
- Payment card detection using Luhn validation and issuer range checks
- Sanitization of invisible Unicode injection characters and bidi overrides
- Confirmation prompts for modifications to agent config, rules, workflows, or authorization flags
- Structured audit logging with keyed hashes and CLI reporting via dsh-dlp report
Useful For
- Preventing autonomous DeepSeek Harness agents from accessing SSH keys, tokens, and local secret stores
- Scrubbing API keys and credentials from tool execution outputs before sending them back to LLM providers
- Securing enterprise DSH telemetry exports and maintaining zero-secret audit records
- Protecting workspace configuration and agent behavior rules from unprompted automated overwrites
Who It Fits
- Security engineers securing autonomous AI agent environments
- DeepSeek Harness workspace administrators handling proprietary or sensitive codebases
- Developers needing secret-leak prevention and audit trails in headless agent runs
Documented Limitations
- Runs in-process at agent UID and does not serve as a process or container sandbox boundary
- Shell command pattern matching is advisory and can be bypassed by complex path assembling or encoding
- Pattern-based detection does not detect high-entropy secrets without matching pattern templates or homoglyph variants
- Requires Node 22.19.0+ or Node 24+ and a runnable bundle like @deepseek-ai/dsh-headless
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 4 runtime, 13 development, 6 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as MIT.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- CharlotteN7/dsh-dlp
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 9e7d7a4 · 2026-10-16
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 0GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-09-29
- Last release
- 2026-09-05
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed security.
View plugin →Pre-execution safety net blocking destructive shell commands and secret leaks in coding agents.
View plugin →Local cross-agent memory and session history recall integration for DeepSeek Harness.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →