dsh-plugin-gate
Installation safety gate & data-protection guard for DeepSeek Harness — 60 static signature rules (31 high / 24 medium / 5 low) scan plugin sources for malicious install scripts, credential theft, obfuscation and network callbacks before you run dsh plugin add, and 12 destructive-command patterns plus workspace-boundary checks stop rm -rf-class accidents before they happen.
The plugin marketplace is growing fast (thousands of entries), and malicious code mixed into a plugin is only a matter of time. dsh-plugin-gate gives the agent a gate_scan tool that inspects a plugin source — a local directory or an npm tarball — for the classic malware shapes:
| Domain | What it checks |
|---|
| Scripts | npm lifecycle scripts (pre/install/postinstall), exec/spawn/shell:true, curl |
| Obfuscation | eval / new Function / vm.runIn*, hex-escape floods, base64 blobs, char-array packing |
| Permissions | credential env reads (OPENAI_API_KEY etc.), ssh/aws/npmrc file reads, writes to system/home/dotfile paths, chmod 777, sandbox-escalation requests |
| Network | external URLs & hosts, fetch/axios/socket/WebSocket/DNS APIs, cloud-metadata endpoints (169.254.169.254), Discord/Telegram/Slack webhooks, .onion, read-then-send exfiltration shape |
| Secrets | hardcoded sk- keys, ghp_ tokens, AWS keys, private key blocks, bearer tokens |
| Supply chain | exact-version direct dependencies checked against Google OSV (ranges and official @deepseek-ai packages skipped; configurable, offline-degrades) |
The gate is read-only: it never executes scanned code and never writes files.
Compatibility
Tool schemas are validated against the @deepseek-ai/dsh-tools value-schema DSL at plugin load (checked against dsh-tools 0.1.0-rc.6 and 0.1.1-rc.2). Earlier releases used JSON-Schema required at the root of output.schema and closed nested objects without declared properties, which made the host abort the whole profile boot with unsupported JSON schema: schema.required is not supported by the value schema DSL and could reject the tool's own results. Current releases fix both; if an affected version left your DSH unable to start, remove the plugin from the profile (or upgrade) — no data is lost.
Install
In your DSH profile:
dsh plugin --profile <profile> add dsh-plugin-gate
# or add the bundle patch manually:
# dsh --profile <profile> --patch ./node_modules/dsh-plugin-gate/cordis.patch.yml
Usage
Ask the agent to scan a plugin before installing it (the plugin also injects prompt guidance that tells the agent to do this automatically):
gate_scan target: "npm:dsh-plugin-some-package"
gate_scan target: "npm:dsh-plugin-some-package@1.2.3" # pinned version
gate_scan target: "./downloaded-plugin" # local directory
v1.3 - Baselines & reports
After a fix, prove the risk is gone — and that nothing new appeared:
gate_diff target: "npm:dsh-plugin-some-package" # new / resolved / changed / unchanged vs the stored baseline
gate_diff target: "./downloaded-plugin" update: true # store this scan as the new baseline
Findings are fingerprinted by rule + severity + file (line shifts do not create false "new" entries). The baseline lives at .dsh/gate-baseline.json inside the session workspace.
Attach evidence to a ticket, PR or CI job:
gate_report target: "npm:dsh-plugin-some-package" # Markdown report
gate_report target: "./plugin" format: "json" write: true # JSON report written to .dsh/gate-report.json
v1.1 - Data-protection guard
Before any destructive operation, ask the agent to evaluate it with gate_guard (also injected into prompt guidance):
gate_guard command: "rm -rf ./node_modules"
gate_guard path: ".dsh-memory-setup/memory.json" action: "delete"
- BLOCK - device/root-level destruction (rm -rf /, rmdir /s /q, format, dd to a block device, mkfs, drive-root deletes): refuse.
- WARN - recursive/force deletes, targets outside the workspace, or critical files (memory.json, .git, ...): confirm the exact target first.
- PASS - no destructive signature detected.
Result shape:
{
"verdict": "BLOCK" | "WARN" | "PASS",
"score": 254,
"summary": { "high": 0, "medium": 1, "low": 3, "categories": { "network": 4 } },
"network": { "hosts": [...], "unallowlisted": [...], "readAndSendFiles": [...] },
"hits": [{ "rule": "fetch_call", "category": "network", "severity": "medium",
"file": "lib/index.js", "line": 12, "evidence": "...", "hint": "..." }],
"recommendations": [...]
}
Verdict semantics
- BLOCK — at least one high-severity signature. Do not install until the maintainer ships a clean rebuild you can scan again.
- WARN — medium-severity patterns that need manual review (network I/O, home-path writes, base64 blobs). Inspect every hit in context.
- PASS — no risky signatures. Heuristic only — keep normal caution with unknown maintainers.
Context-aware rules: exec()/execSync() hits are downgraded when the file does not import child_process (typical RegExp#exec false positive); code-context rules (exec, eval, curl|sh, PowerShell…) are downgraded to low when found in comments or documentation (examples, not behavior) — while secrets and webhooks stay flagged even in comments. Dependencies installed from git/http/file URLs are flagged as risky_dependency, and >4000-char minified lines as minified_line (low).
Configuration
| Key | Default | Meaning |
|---|
maxFiles | 1000 | hard cap on scanned files per directory walk |
maxFileBytes | 2 MiB | per-file text cap |
includeNodeModules | false | descend into node_modules |
maxTarballBytes | 32 MiB | npm tarball download cap |
allowlistHosts | [] | hosts never listed as unallowlisted |
osvCheck | true | query Google OSV for known vulnerabilities on exact-version deps |
osvMaxDeps | 8 | max exact-version direct deps checked |
osvTimeoutMs | 10000 | per-dep OSV query timeout |
promptSection | true | inject agent guidance |
sectionOrder | 5 | prompt section order |
Development
node --check lib/*.js
node test/rules.test.mjs # main-module mode (node --test is blocked in the DSH sandbox)
node test/scan.test.mjs
Pure logic lives in lib/rules.js (signatures), lib/targz.js (in-memory tar.gz), lib/scan.js (orchestration + verdict). The Cordis plugin is lib/index.js.
Security
The gate never executes scanned content. It is a heuristic signature scanner — it can miss novel malware and over-flag innocent code. Review BLOCK/WARN hits yourself; see SECURITY.md.
License
MIT
Roadmap
See ROADMAP.md — next five versions (v1.3.0 – v1.7.0): baselines & reports, configurable rules, pre-install interception, dependency SBOM, team policy & CI.
