@deepseek-ai/dsh-security-audit
DSH local security audit tool: read-only scans of config, credential metadata, plugin provenance, session structure and network exposure; redacted, reproducible, locatable risk reports
42 results
DSH local security audit tool: read-only scans of config, credential metadata, plugin provenance, session structure and network exposure; redacted, reproducible, locatable risk reports
Bidirectional bridge between Hermes Agent and DeepSeek Harness. Hermes dispatches focused tasks via JSON-RPC over POST /mcp/collab (one-shot or continuable, nonce-bound amend, secret-bound consult reply); DSH lets you continue Hermes sessions as native DS
🐳 The Everything-Plugin Quant OS — AI-native & DSH-native: 46 tools, 6 pluggable domains (data/alpha/ML/risk/execution), one end-to-end PDAT→PET pipeline. Methods open, secrets internal.
DeepSeek Harness plugin: auto-detect secrets pasted into the composer, store them in the official credentials seam, and send [secret:REF] placeholders to the model instead of the value.
DeepSeek Harness plugin for SecurStack security scans, policy checks, doctor diagnostics, and JSON CLI results.
Security for DeepSeek Harness in two layers: source-backed pre-install vetting plus fail-closed runtime guardrails and HMAC-chained audit logs. Zero runtime dependencies.
Local prompt-injection and secret-exfiltration firewall for DeepSeek Harness
Register models, assist with portraits, and select the Agent model from a secret-free catalog for DeepSeek Harness.
A DeepSeek Harness (dsh) security plugin: blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe inspection tools that never print raw values.
DSH plugin: block dangerous shell commands and secret leakage before execution (tools/pre-execute veto)
Non-intrusive safety belt for DeepSeek Harness: blocks API keys pasted to the agent, blocks secret writes, tracks leak events, and offers a workspace health scan. 非侵入式安全护栏:拦截粘贴给 Agent 的 API 密钥、写入拦截、泄露追踪与工作区安全体检。
Model-visible redaction plugin for DeepSeek Harness: redacts secrets from model input and output streams
Maestro Guard — pre-execute safety gate: native DSH approval prompts, parsed command-surface rules, decision journal
Conversation-local credential handoff that writes through the DSH credential service without returning the secret to model context.
DeepSeek Harness plugin: a masked password input panel in the Web GUI. The agent calls the password_prompt tool, the browser pops an HTML password panel, and the typed value is returned to the agent — no interactive terminal needed.
Named user credentials for DeepSeek Harness: model-facing credential tools, secrets behind the ctx.credentials seam, DSH_CM_* shell variables, and a Settings → Credentials page
DSH 代码安全审查插件:40+ 确定性规则与密钥熵检测,支持 git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite。
GitHub App tools for WSL dsh: hint (env file existence) + repo PR/Actions status; never dumps secrets.
Safe Git credential hints: GCM path, HTTPS vs SSH origin (never returns secrets).
DeepSeek Harness WSL plugin: pass/age secrets with allowlist; list/exists; secret_to_env without dumping values into chat.
Say the secret handshake: DSH subagents start on the Minimal two-tool condition to unlock DeepSeek's full RL-trained strength, then get the whole toolbox.
HashiCorp Vault backend for the DeepSeek Harness credential seam: central secrets, AppRole machine auth, rotation without restart, and no long-lived provider key on the agent host
Local, zero-network, fail-closed secret preflight for DeepSeek Harness model requests.
Record and compare project development environments without storing secret values.