DeepSeek Harness PluginManifest Valid

dsh-security-doctor

A DSH Web UI sidebar plugin for local, read-only security checkups and severity-graded reports.

UI & ProductivityTerminal & TUIDeveloper ToolsSecurity & PolicySkills & WorkflowsRemote Execution

0GitHub Stars0ForksUpdated2026-09-11

Install

$ dsh plugin --profile web add github:ChenChen913/dsh-security-doctor#v1.1.0

Plugin Overview & Capabilities

AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.

source-grounded

dsh-security-doctor installs into the DeepSeek Harness Web profile and adds a Security Checkup sidebar workflow. It inventories selected DSH configuration and plugin risks, checks credential-file permissions, fingerprints instruction files, and presents bilingual reports. An experimental, opt-in guard mode adds limited outbound-request auditing and file-change monitoring.

Key Capabilities

Adds a sidebar security-checkup button and runs an initial local check after installation.
Produces 0–100 severity-graded reports with prioritized findings, remediation guidance, trend comparison, Markdown copy, and JSON export.
Scans DSH configuration and Cordis patches for !!js expressions and changes targeting approval, sandbox, or permission protections.
Inventories profile dependencies and flags third-party plugins, unlocked Git references, and postinstall scripts.
Statically scans non-official plugin source for outbound domains, eval or base64-related indicators, credential-access intent, and code-tree fingerprint changes.
Checks permissions for ~/.dsh/.credentials.yaml without reading its contents, including Windows ACL account checks.
Hashes supported instruction files and reports additions or changes across checks.
Supports AI-review prompt copying and pasting conclusions back with a code fingerprint anchor.
Offers an experimental opt-in guard mode with in-process http/https request auditing and periodic file-change snapshots.

Useful For

Review a local DSH Web installation before or after adding third-party plugins.
Identify risky configuration expressions or patches that may weaken DSH protections.
Check whether a credential file has potentially unsafe permissions.
Track changes to DSH configuration and workspace instruction files.
Prepare structured prompts for an external AI-assisted review of suspicious plugin code.

Who It Fits

DeepSeek Harness Web users
Developers maintaining local DSH profiles and plugins
Security-conscious users reviewing third-party DSH extensions

Documented Limitations

Static scanning is a preliminary check and may miss obfuscated content, runtime-constructed addresses, or behavior not visible in source.
A combined credential-access and outbound-network finding is file-level co-occurrence, not proof of data flow.
Official @deepseek-ai/* packages are treated as a trust baseline and are not scanned; transitive dependencies are covered.
Guard-mode attribution is best-effort and can be spoofed by advanced code; it does not cover fetch or raw sockets.
The file sentinel can miss changes made and reverted between polling intervals; large files use size and mtime fingerprints.
POSIX permission bits do not represent complete ACL information, and some session- or agent-level policy overrides are not read.
The README states that DSH Web must be restarted after installation because running instances do not hot-load the plugin.

DSH Compatibility

Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.

Not tested yetNo runtime compatibility tests have been published yet.

Security Signals

Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.

No automated security signals have been published yet.

Source & Registry Notes

Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.

Source repository: ChenChen913/dsh-security-doctor
Registry source: GitHub · dsh-plugin topic
Registry classification: Plugin
Source checked: 24afe66 · 2026-09-13

This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.