Install
$ dsh plugin --profile web add github:PerryLink/dsh-skill-pack-securityPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Provides eight bilingual agent skills (security-audit, secret-scan, dependency-audit, supply-chain-review, prompt-injection-review, threat-model, vuln-intel, incident-response)
- Executes pre-install supply-chain checks with the plugin_vet tool (license, SBOM, commit pinning, malicious patterns, and data responsibility review)
- Computes a five-dimension risk report (license, source, dependencies, build scripts, maintenance) with PASS, WARN, or FAIL verdicts
- Configurable install gate policy supporting warn (non-blocking) or deny (blocking) modes
- Orchestrates optional external scanners such as osv-scanner or npm audit when available
- Emits audit findings that cite corresponding skill sections for agent-driven manual triage
Useful For
- Vetting external DSH plugins and tarballs before installing them into a profile
- Performing whole-repository security audits and triage using guided model workflows
- Reviewing pull requests adding dependencies or modifying agent context prompts for injection surfaces
- Threat modeling new architecture features and planning incident response workflows in agent environments
Who It Fits
- DeepSeek Harness administrators managing plugin trust and compliance
- Security engineers auditing AI agent environments and dependencies
- Plugin developers conducting pre-release supply-chain and credential safety checks
Documented Limitations
- Static heuristics only; malicious pattern detection does not perform dynamic runtime analysis
- plugin_vet acts as a narrow pre-install gate and does not replace full manual end-to-end security audits
- Only one language edition (zh or en) can be mounted per session root catalog due to rank-based resolution
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 1 runtime, 3 development, 1 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as Apache-2.0.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-skill-pack-security
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin Bundle
- Source checked
- d6a6d00 · 2026-10-15
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 22GitHub stars
- Forks
- 1
- Open issues
- 1
- Last commit
- 2026-10-12
- Last release
- 2026-10-10
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Agent skill for DeepSeek Harness that turns ideas, plans, and codebases into interactive architecture diagrams.
View plugin →Skill manager UI for DeepSeek Harness to discover, toggle, import, and update agent skills.
View plugin →Persistent multi-model agent teams with dynamic DAG orchestration, run monitoring, and token insights for DeepSeek Harness.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →