dsh-mask
PII masking middleware for DeepSeek Harness that replaces sensitive data with placeholders before reaching the model.
Install
$ dsh plugin --profile web add github:PerryLink/dsh-maskPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Pre-step request masking for phone numbers, emails, Chinese ID cards, bank cards, keys, and optional IP addresses
- Post-execution tool output masking across tools/post-execute events
- Host-side restore table management isolated to memory and controlled dsh_mask storage domain
- /mask slash command supporting status inspection, runtime toggles, and selective placeholder restoration
- mask_test tool for dry-run testing snippet masking without plaintext exposure
Useful For
- Preventing customer and developer PII from being sent to external LLM providers
- Sanitizing sensitive credentials and phone numbers before writing interaction logs
- Controlled local unmasking of sanitized model outputs during interactive sessions
Who It Fits
- DeepSeek Harness developers working with sensitive corporate or customer data
- Security and compliance engineers enforcing data loss prevention (DLP) policies
- Teams operating under strict privacy frameworks in DeepSeek Harness profiles
Documented Limitations
- Pure-host regex detection is limited to structured formats; person and address detection requires external NER which is not bundled and will fail at load if enabled
- Phone and ID card detectors exclusively match mainland China formats
- Display-layer automatic unmasking in the browser client is not bundled; unmasking requires manual /mask restore commands
- Session event logging on harness versions like 0.1.7-rc.2 skips mask/* event emission due to unsupported envelope structures
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 1 runtime, 16 development, 8 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as Apache-2.0.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-mask
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 0b3adb6 · 2026-10-16
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 14GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-10-12
- Last release
- 2026-10-10
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Agent skill for DeepSeek Harness that turns ideas, plans, and codebases into interactive architecture diagrams.
View plugin →Persistent multi-model agent teams with dynamic DAG orchestration, run monitoring, and token insights for DeepSeek Harness.
View plugin →Session lifecycle manager for DeepSeek Harness with search, restore, idle cleanup, and diagnosis.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →