internal-skill-workshop
在 DeepSeek Harness 中浏览、登录团队 Skill Base 并安装 Skills。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:Olina1Ye/internal-skill-workshop-plugin#6bb6aaf00c980f81e889b5a9e48778dba2d68e38Internal Skill Workshop 以 internal-skill-workshop 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
internal-skill-workshop is a DeepSeek Harness Web plugin for finding and
installing team Skills from a configured
Skill Base server.
It provides:
Publishing and Skill administration remain in Skill Base Web, skb, or
Companion.
You need a running Skill Base server that DSH Web can reach. The plugin is a team catalog client; it does not include or deploy the server.
dsh plugin --profile web add internal-skill-workshop
Restart DSH Web, then open Settings -> Internal Skill Workshop.
An administrator can preset one shared server address in the profile's
cordis.patch.yml:
- id: internal-skill-workshop
config:
baseUrl: https://skills.company.example
Every team member using that profile starts with the same address. A member may save a personal address from the plugin; the personal value takes precedence. Remote servers must use HTTPS. Loopback HTTP is accepted for local development.
/api suffix.The plugin installs to:
$DSH_HOME/skills/<skill-id>
$DSH_HOME defaults to ~/.dsh. The plugin does not accept a path from the
browser and refuses to overwrite an existing Skill directory. Updating and
replacing locally modified Skills are intentionally out of scope for this
release.
The plugin never asks for a Skill Base password. It exchanges a five-minute, single-use verification code for a Skill Base personal access token (PAT). The DSH host stores the PAT in:
$DSH_HOME/internal-skill-workshop/credentials.json
The file is written with owner-only permissions where the platform supports
them. The PAT is attached to Skill Base requests only by the DSH host and is
never returned to the browser, placed in a URL, or stored in browser
localStorage. Sign out removes the local PAT.
Skill Base currently issues long-lived PATs through this flow. Signing out of the plugin removes the local copy but does not revoke the server-side token; server administrators should remove an exposed or retired PAT from Skill Base.
The DSH plugin does not require an API key. Do not paste a Cloudflare or Skill Base credential into its server-address setting.
If a Skill Base deployment provides a Translate to Chinese action on its publishing page, that is a separate server-side feature. The Skill Base server operator enables it by supplying these environment variables to the server process or container:
CLOUDFLARE_ACCOUNT_ID=<Cloudflare account ID>
CLOUDFLARE_API_TOKEN=<token with Workers AI access>
SKILL_BASE_TRANSLATION_TIMEOUT_MS=20000
SKILL_BASE_TRANSLATION_TIMEOUT_MS is optional and defaults to 20 seconds.
The account ID and token must remain on the server. For Docker deployments,
ensure the deployment explicitly passes them into the application container;
adding them to a host .env file alone may not do that.
SKILL.md frontmatter are rejected.$DSH_HOME/skills/<skill-id>.npm test
npm audit
npm pack --dry-run