PensiveFei/dsh-secure-audit
A read-only security and compliance plugin for DeepSeek Harness with four tools and one skill: prompt-injection detection (English + Chinese rule engine with obfuscation resistance), PII redaction for text and structured JSON, and an 11-check local audit mapped to the OWASP LLM + Agentic Top 10. It never writes, deletes or executes anything on the audited system — the only write path is an opt-in, off-by-default append-only audit log.
dsh-secure-audit is an unofficial, read-only security and compliance plugin for DeepSeek Harness with four tools and one skill. security_scan_text detects prompt injection with an English+Chinese rule engine (LRU cache, obfuscation resistance against zero-width/full-width/homoglyph tricks and bounded base64, optional fail-closed timeout, pluggable model classifier) and returns allow/review/block plus a risk level and an input hash for replayable decisions. security_redact_text masks CN mobile numbers, CN ID cards, CN bank cards, emails, IPv4, API keys and URL credentials; security_redact_json recursively redacts sensitive values inside JSON by key name plus a PII fallback, preserving structure so output is safe to hand to a third-party model. security_audit runs 11 read-only checks across config, sessions, plugins, paths, network, env and host, mapped to the OWASP LLM + Agentic Top 10, with quick|full tiers and a deterministic, redacted report carrying a self-checksum. A security-review skill is registered at runtime. The plugin never writes, deletes or executes anything on the audited system — the only write path is an opt-in, off-by-default append-only audit log.
Install
dsh plugin add dsh-secure-auditThe README's Install section leads with a tarball form and a git form (dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>, which requires pinning a commit), then states the npm form — dsh plugin add dsh-secure-audit installs the latest release from the registry — which is what is copied here.
Compatibility
Peer dependency @deepseek-ai/dsh-tools >= 0.1.2-alpha.2, provided by the DSH runtime and tested against 0.1.2-alpha.2. DSH is pre-1.0, so the README advises pinning the DSH version and re-running security_audit after upgrading either side.
Details
- Repo: PensiveFei/dsh-secure-audit
- Category: Tools & Capabilities
- Stars: 85
- Version: GitHub repo PensiveFei/dsh-secure-audit (85★, MIT); npm package dsh-secure-audit at 0.2.11 (registry check 2026-10-11; registry repository field resolves back to this repo). No install-time scripts and no build step; the shipped source is the artifact.
Alternatives
1624318455/dsh-plugin-tavily · 6Mikao9/dsh-wsl-workspace · 863683348/dsh-plugin-academic-writing