Install
$ dsh plugin --profile web add "github:PerryLink/dsh-skill-pack-security#main"Plugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Eight bilingual security audit skills covering secret scanning, supply chain reviews, dependency audits, threat modeling, and incident response
- Automated plugin_vet pre-install gate tool assessing licenses, lockfiles, SBOMs, commit locking, and malicious patterns
- Five-dimension risk scorecard (PASS, WARN, FAIL) with configurable non-blocking or blocking installation gates
- Data-responsibility review checking sensitive hook usage, outbound endpoints, and embedded injection payloads
- Progressive disclosure architecture with under 300 lines per bundle and full reference wiring
Useful For
- Pre-install verification of third-party DSH plugins to catch unpinned commits, malicious lifecycle scripts, and license issues
- Assisted security triage and repository audits using standardized agent audit methodology skills
- Automated CI/CD supply-chain enforcement for DeepSeek Harness profile bundles
Who It Fits
- Security engineers and developers auditing DeepSeek Harness plugins and agent environments
- System administrators enforcing pre-install supply-chain security policies across DSH profiles
Documented Limitations
- Static heuristics only: plugin_vet does not perform dynamic code execution or behavioral sandboxing
- Does not replace comprehensive manual audits and penetration testing
- Only one language edition (Chinese or English) can be mounted per session catalog root
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 1 runtime, 3 development, 1 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as Apache-2.0.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- PerryLink/dsh-skill-pack-security
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin Bundle
- Source checked
- 12112f3 · 2026-10-03
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 19GitHub stars
- Forks
- 1
- Open issues
- 2
- Last commit
- 2026-09-24
- Last release
- 2026-09-12
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
Agent skill for DeepSeek Harness that turns ideas, plans, and codebases into interactive architecture diagrams.
View plugin →Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed fallback and session audit logging.
View plugin →Native SQLite-backed task management and project board bundle with Web UI and Agent workflow tools for DeepSeek Harness.
View plugin →An ontology-first agent preset and epistemic loop platform for DeepSeek Harness.
View plugin →