dsh-skill-pack-security
- 1024 store channel:
npm i -g dsh1024 once, then dsh1024 plugin --profile web add dsh-skill-pack-security (counts toward the deepseek1024.com install ranking).
Eight security-audit skills plus an automated plugin supply-chain gate for DeepSeek Harness.
The skills teach the audit methodology; the plugin_vet tool executes the pre-install scan — license / SBOM / commit pinning / malicious patterns / five-dimension risk card.
English · 简体中文 · Español · Português · हिन्दी
Compatibility
| Surface | Status |
|---|
| Harness | DeepSeek Harness dsh-v0.1.5-rc.2 (GitHub tag, verified 2026-09-11: full gate chain + profile install smoke). npm dependency line: @deepseek-ai/dsh 0.1.5-rc.2 (peers `>=0.1.2-rc.1 <0.2.0 |
| Node | ^22.19.0 || >=24.0.0 (the DeepSeek Harness runtime) |
| Platforms | All (the skills are content; the provider is a host plugin) |
| Model | Any (skills load on demand via the skill tool; plugin_vet is deterministic) |
What you get
dsh-skill-pack-security is a skill pack + supply-chain gate for DeepSeek Harness. It ships eight security methodologies as SKILL.md bundles that the model discovers in its session catalog and loads on demand with the skill tool, plus the automated plugin_vet pre-install scanner. The skills teach the methodology; the plugin executes the static checks.
- Eight skills, two editions — every skill ships with identical names and metadata in
skills/ (Chinese) and skills-en/ (English); install one language per root.
plugin_vet gate — a zero-dependency scanner (license / SBOM / commit pinning / malicious patterns / data-responsibility review / five-dimension risk card) registered by the optional provider/ plugin on ctx.tools.- Findings cite the skills — every finding points to the matching skill section (for example
supply-chain-review §1) so the agent can continue the manual audit.
- Executable by a model — each skill step is a real command (
gitleaks, trivy, pnpm audit, npm view, git …) with an expected-output sample and an exit-code criterion.
Why skills, not tools?
| Shape | What it does | What it cannot do |
|---|
| Tool plugin (e.g. security scanners) | Executes scans, returns findings | Interpret alerts, tier false positives, write redacted reports |
| Protocol layer | Constrains a protocol | Generalize across repos and agents |
| Skill pack (this repo) | Teaches methodology: triage, reporting, remediation order — and automates the static pre-install checks via plugin_vet | Replace a manual audit end to end |
Installed together with a tool-type security plugin, the two compose: the tool runs the scan, the skill drives interpretation, triage, and the report. This pack combines both shapes: the skills teach the methodology, and plugin_vet runs the mechanical static subset automatically, with every finding pointing back into the skills.
The Claude Code ecosystem's 3000+ skills prove the distribution value of this shape. DSH's SKILL.md frontmatter (name, description, whenToUse) is format-compatible with CC skills; this pack uses only the common subset and its content is entirely original.
The eight skills
| Skill | Purpose | When to use |
|---|
security-audit | Five-phase audit flow: scope → inventory → risk tiering → verification → report template | Whole-repo audits, audit reports, planning |
secret-scan | Credential audit: gitleaks/trivy usage, false-positive tiers, redacted reports, remediation order | Secret scanning, alert triage, leak reports |
dependency-audit | Supply-chain audit: pnpm/npm audit reading, licenses, typosquat risk, lockfile drift | Dependency review, audit-report interpretation |
supply-chain-review | Quick PR/new-dependency review: dangerous install scripts, typosquat, reproducible builds | Reviewing PRs that add dependencies |
prompt-injection-review | Injection-surface review for agent projects: AGENTS.md, skills, tool descriptions, MCP, web | Reviewing model-context injection surfaces |
threat-model | Design-stage threat modeling: trust boundaries, STRIDE table, attack trees, mitigations | Modeling new features, design-stage security review |
vuln-intel | Vulnerability intelligence: NVD/CISA-KEV/GHSA/OSV lookups with verdict criteria | Given a CVE/GHSA id, checking impact and exploitation |
incident-response | Agent-environment incident response: contain → evidence → recover → postmortem | Suspected security incidents in DSH/agent setups |
Each bundle keeps its main file ≤ 300 lines (progressive disclosure; details live in references/).
plugin_vet — the automated pre-install gate
plugin_vet is the pack's automated complement: a zero-dependency scanner registered by the provider/ plugin on ctx.tools. Point it at a GitHub owner/repo or a local package path — it downloads the tarball once (timeout + AbortSignal respected), scans within budget limits, and returns a render card.
- License scan — finds the LICENSE file and the
license field; NOASSERTION/UNKNOWN/SEE LICENSE IN <file>, a missing file, or a missing field is flagged; common SPDX ids are recognized.
- SBOM — extracts the dependency tree with versions from the lockfile (pnpm/npm/yarn); when
osv-scanner or npm audit is detected on a local target, their vulnerability output replaces the self-computed dependency scan and the report annotates the source (builtin / osv-scanner / npm-audit).
- Commit locking — install-manifest refs and workflow actions must be immutable 40-hex commit SHAs;
@tag/branch refs are flagged as mutable.
- Malicious patterns — lifecycle scripts (
preinstall/install/postinstall), network-exfiltration domains, and obfuscated/encoded payloads in shipped code.
- Data-responsibility review — the policy-scan dimensions as deterministic rules: ungated listeners on sensitive seams (
agent/pre-step, tools/pre-execute, session/event, …), outbound endpoints without README telemetry/privacy disclosure, description-behavior keyword coverage, and embedded instruction-override payloads in shipped text (skills, docs, prompts, tests). Every finding cites prompt-injection-review for the manual deep-dive; disable per deployment with vet.dataResponsibility: false. A model-assisted review stage is the documented future upgrade.
- Five-dimension risk report — license / source / dependencies / build scripts / maintenance, each 0–100, folded into an overall verdict: PASS, WARN, or FAIL.
Install gate. The verdict feeds an installation gate — gate.policy: warn (default, non-blocking) prints a warning on FAIL; gate.policy: deny blocks the installation:
- id: skill-pack-security
name: '@perrylink/dsh-skill-pack-security-provider'
config:
language: en
vet:
gate:
policy: deny # block installs that fail plugin_vet
Complementary to dsh-plugin-check. The official plugin validator's 36 checks verify a plugin's contract and quality (config schema, effect registration, tool JSON shape); plugin_vet verifies the supply chain of where a plugin comes from. Run both:
| dsh-plugin-check (36 checks) | plugin_vet (this repo) |
|---|
| Question answered | Is this plugin well-formed and contract-compliant? | Is this package safe to install? |
| Looks at | Plugin code, schema, registrations, tool contracts | LICENSE, lockfile, install refs/actions, lifecycle scripts, exfil/obfuscation, maintenance, data-responsibility (hooks scope, telemetry disclosure, description-behavior, embedded injection payloads) |
| Verdict | Pass/fail per check | PASS / WARN / FAIL + gate |
| When | Plugin development or review | Before dsh plugin add, PR review, CI supply-chain gate |
| Blocking | CI gate (non-zero on violations) | Configurable: warn (default) or deny |
Quick start
# 1. install the bundle into your profile
dsh plugin --profile web add "github:PerryLink/dsh-skill-pack-security#main"
# or from npm (published releases)
dsh plugin --profile web add @perrylink/dsh-skill-pack-security-provider
# 2. restart and verify the row
dsh --profile web --dump-config | grep -A3 'id: skill-pack-security'
Install & uninstall
- git channel (latest
main): dsh plugin --profile web add "github:PerryLink/dsh-skill-pack-security#main" — mounts the provider bundle; prepack embeds both editions into the tarball.
- npm channel (published releases):
dsh plugin --profile web add @perrylink/dsh-skill-pack-security-provider.
- tarball channel:
pnpm pack in provider/, then dsh plugin --profile web add ./@perrylink-dsh-skill-pack-security-provider-<version>.tgz.
- uninstall:
dsh plugin --profile web remove @perrylink/dsh-skill-pack-security-provider (or remove the row; pure-skill copies are removed with the installer's -Uninstall / --uninstall).
Installing the skills by hand
DSH's local skill provider scans four roots by rank (lower rank wins same-name conflicts within a layer):
| Rank | Root | Scope |
|---|
| 100 | <projectRoot>/.dsh/skills | Project-scoped, travels with the repo |
| 200 | <projectRoot>/.agents/skills | Project-scoped, shared agent directory |
| 400 | <dshHome>/skills ($DSH_HOME or ~/.dsh) | User-scoped, DSH-only |
| 500 | <agentsHome>/skills ($DSH_AGENTS_HOME or ~/.agents) | User-scoped, cross-agent |
Ranks (lower wins same-name conflicts within a layer): project-dsh 100 < project-agents 200 < custom 300 < user-dsh 400 < user-agents 500. Custom rank 300 is plugin-registered (such as this pack's optional provider/), not a disk root.
./scripts/install.ps1 -Target user-agents -Language zh # Target: project-dsh | project-agents | user-dsh | user-agents; Language: zh (default) | en
bash ./scripts/install.sh --target user-agents --language en
What's inside
| Path | What it is |
|---|
skills/<name>/SKILL.md | The eight skills (Chinese edition); frontmatter follows the official dsh-skill-filesystem contract |
skills-en/<name>/SKILL.md | The eight skills (English edition); same names and metadata as the Chinese edition |
skills/<name>/references/ | Progressive-disclosure detail: command matrices, triage tables, templates |
scripts/install.ps1 | One-command Windows installer for all four roots (both language editions); records a manifest, supports -Uninstall/-DryRun/-Force |
scripts/install.sh | The POSIX equivalent (--uninstall/--dry-run/--force) |
provider/ | npm-installable provider bundle (declares dsh.bundle; embeds both editions in pack/ via prepack; language: zh|en); registers the skills provider AND the plugin_vet gate tool via ctx.effect(), fails loud on a bad skillsDir |
provider/src/vet/ | The zero-dependency plugin_vet scan engine (license / SBOM / commit lock / malicious patterns / risk report) |
package.json | Root bundle manifest: declares dsh.bundle.patch (→ provider/cordis.patch.yml) and dshWorkshop intake facts |
verify/verify-skill-pack.mts | Headless verification against the official parser, the real skill tool, and the real tools runtime — 25 checks across both editions |
VERSION | Single version source; every SKILL.md metadata.version and provider/package.json must match it (CI-enforced) |
docs/ | Ecosystem conflict check, release checklist, improvement plans, and plugin_vet demos |
CHANGELOG.md / SECURITY.md / CONTRIBUTING.md | Release history, vulnerability reporting policy, and contribution/verification rules |
|
Configuration
All tunables are Schemastery Config fields (changeable from cordis.yml). provider/cordis.patch.yml documents each key inline.
| Key | Default | Meaning |
|---|
language | zh | Edition to publish: the Chinese skills/ or the English skills-en/; ignored when skillsDir is set |
watch | false | Watch the packaged skills directory (static content, so disabled) |
skillsDir | (unset) | Explicit skills root; overrides the language-derived default and must hold <skill>/SKILL.md bundles |
vet.enable | true | Register the plugin_vet gate tool |
vet.timeoutMs | 15000 | Tarball-fetch timeout in ms |
vet.maxFiles | 800 | Scan file cap |
vet.maxFileBytes | 262144 | Per-file byte cap |
vet.maxExtractBytes | 67108864 | Extraction byte cap |
vet.maxDepNodes | 600 | Dependency-tree node cap |
vet.maxFindingsPerCheck | 12 | Findings cap per check |
vet.dataResponsibility | true | Run the data-responsibility review (disable per deployment) |
vet.externalScanners | true | Orchestrate osv-scanner/npm audit when their CLIs are present; false forces the built-in self-computed dependency scan |
vet.userAgent | dsh-skill-pack-security/2.2.16 (+https://github.com/PerryLink/dsh-skill-pack-security) | Fetch user-agent |
vet.gate.policy | warn | Install gate: warn (non-blocking) or deny (block on FAIL) |
Tools & surfaces
| Surface | Kind | Notes |
|---|
plugin_vet | tool | Pre-install supply-chain scan (license / SBOM / commit lock / malicious / risk card); findings cite skill sections |
skill-pack-security | skill provider | Registers the pack's skills/ or skills-en/ edition on ctx.skills |
Eight SKILL.md bundles | skills | The audit methodology, in two language editions |
| install gate | gate | vet.gate.policy: warn | deny feeds installation decisions |
Permissions & data
- Permissions: the
dshWorkshop manifest declares files:read and network:fetch.
- Data:
plugin_vet downloads a tarball once (timeout + AbortSignal respected) and reports redact secret-shaped text; the plugin injects no prompt sections.
Security boundaries
- Zero-dependency engine.
plugin_vet uses only node: builtins and relative imports.
- Narrow pre-install gate. Not a general-purpose security-audit tool — deliberately complementary to scanner plugins and the official
dsh-plugin-check contract validator.
- Non-blocking by default. The install gate is
warn unless you opt into deny.
- Original content. Format-compatible with Claude Code skills, but no copied CC skill content and no skill marketplace.
- Original engine, no third-party ports. The license scan and malicious-pattern checks are original zero-dependency implementations; the GPL-Radar / LLM-detective / Sus-PY assets were evaluated for porting but no licensed public source was found — see
THIRD_PARTY_NOTICES.md.
Verification
verify/verify-skill-pack.mts imports the official dsh-skill-filesystem parser, the real skill tool, and the real tools runtime from a local deepseek-harness checkout and asserts 25 checks over both language editions:
- Layout: both editions present, 8 directory bundles each, no stray flat skills, frontmatter
name matches directory, ≤ 300 lines, references/ wired, metadata.version synced to the VERSION file
- No name conflicts with the official
.agents/skills/ skills (derived from the checkout at run time) or known community skill packs
3–6. Per edition (Chinese skills/, English skills-en/): registry discovery through the official provider, full ctx.skills.get() loads, the real skill tool returning <skill_content> (unknown/invalid names rejected), and the session catalog containing name + description only — whenToUse stays out of the model catalog (official design)
- 13 bad-frontmatter fixtures exercise the official fail-closed rules (missing fields, legacy camel-case keys, non-boolean values, non-kebab names, nested dirs, name mismatch); flat-file skills load and nested
**/SKILL.md is not discovered
- The optional provider plugin mounts the Chinese and the English edition via
ctx.effect(), disposes cleanly, and rejects misconfiguration (empty or nonexistent skillsDir)
9–15. Self-hardening checks: zh↔en structural parity, references wiring (no dangling/orphan files), provider version sync, documented skill-root ranks vs the official constants, POSIX-portable grep -E patterns, secret self-check, UTF-8-safe release checklist
16–19. plugin_vet through the real tools runtime: it registers on ctx.tools; the compliant fixture passes; the no-license fixture fails and cites dependency-audit §3; the malicious postinstall fixture fails (scripts/exfil/obfuscation, citing supply-chain-review §1); the gate blocks installation under policy: deny
- The scan engine is zero-dependency (
node: builtins and relative imports only)
- Report redaction keeps secret-shaped text out of rendered output
# local: auto-resolves the harness checkout beside the pack, or point it explicitly
$env:DSH_HARNESS_CHECKOUT = 'D:\deepseek-harness'
& D:\deepseek-harness\node_modules\.bin\tsx.CMD verify\verify-skill-pack.mts
# All 25 checks passed for dsh-skill-pack-security.
The same 25 checks run on GitHub on every push via .github/workflows/verify.yml — on Ubuntu and Windows — plus an install.sh/install.ps1 exercise and a standalone provider build/pack smoke that asserts the tarball carries both embedded editions and the bundle patch.
Known limitations
- Not a full audit tool.
plugin_vet is a narrow pre-install trust gate; it cannot replace a manual, end-to-end audit.
- Static scan only. The malicious-pattern and maintenance signals are heuristics over the shipped package, not dynamic analysis.
- One edition per root. Same-name skills in one root resolve by rank, so only one language edition enters a session catalog.
Roadmap
dsh-skill-pack-data-engineering — data pipelines, data quality, ETL checklists (same template)dsh-skill-pack-oss-collab — PR etiquette, issue triage, maintainer workflowsdsh-skill-pack-performance — profiling methodology, benchmark criteria, regression checklists- More skills inside this pack (same pure-skill boundary):
sbom-lifecycle (SBOM generation/aging/import workflows), pen-test-review (authorized-engagement scoping and report review), compliance-audit (ASVS/NIST-CSF walkthroughs)
- Keep the
plugin_vet demo artifacts fresh (docs/demos/run-demos.mjs) and the dsh-plugin-check complement table accurate as the official checker adds checks
Development
pnpm --dir provider run typecheck # tsc --noEmit
pnpm --dir provider run build # tsc --noEmitOnError
pnpm --dir provider run prepack # embeds both skill editions into the tarball
tsx verify/verify-skill-pack.mts # 25-check headless verification
Benchmark
The poison-sample regression set (per-class detection rate / FPR / F1 over 38 samples, plus the OSV/Socket gap) is published in benchmark/RESULTS.md; regenerate it with pnpm --dir provider run build && node benchmark/run.mjs (zero new dependencies).
Topics
dsh, dsh-plugin, deepseek-harness, skill-pack, skills, security, security-audit, supply-chain, supply-chain-security, prompt-injection
Contributors
- @PerryLink — author and maintainer: the eight skills in both language editions, the installers, the verification suite, the provider bundle, CI, and the documentation.
PerryLink DSH Plugin Family
This project is one of the 37 DeepSeek Harness plugins maintained by PerryLink. If this one helps you, the others likely will too:
| Plugin | One-liner |
|---|
| dsh-auto-review | Second-model auto-review on the approval chain, fail-closed by default |
| dsh-background-agents | Durable background child agents with a Web UI sidebar, messaging and interrupt |
| dsh-budget | Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel. |
| dsh-checkpoint-rewind | Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore |
| dsh-claude-move | Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH |
| dsh-click | Cross-platform native desktop control for DeepSeek Harness — Windows first. |
| dsh-composer-history | Terminal-style input history for the web composer: arrows, Ctrl+R search |
| dsh-data-quality | Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here) |
| dsh-defend | Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness. |
| dsh-doublecheck | Engineering-discipline guard: requirements grill, test gates, adversary review |
| dsh-draw | Unified static-image generation routing for DeepSeek Harness. |
Install from the DSH Desktop Market
All PerryLink plugins are browsable in the built-in DSH Desktop Market: Market → Sources → add source → paste https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json → select it. Installation still goes through the Market's npm-identity verification and your confirmation.
License
Apache License 2.0 © 2026 dsh-skill-pack-security contributors
