DeepSeek Harness Plugin
Submit a Plugin 中文

DSH Plugin Safety Guide

Plugins extend your DeepSeek Harness agent, which means they run with the permissions of your dsh process. Most community plugins are safe and well-intentioned, but you should verify before installing anything.

The risks

  • Remote code execution at install time: plugins fetched from GitHub may run build scripts during installation.
  • Runtime permissions: a plugin runs inside your agent loop and can read files, call tools, or make network requests that your dsh process can.
  • Supply-chain risk: a popular plugin can be taken over or updated maliciously.

    • Best practices

    1. Install only from sources you trust — prefer well-known maintainers and repositories with history.

    2. Read the source before installing, especially for small or new plugins.

    3. Check the license — prefer permissive licenses (MIT, Apache-2.0) you understand.

    4. Pin the commit — use dsh plugin add github:owner/repo#commit for reproducible installs.

    5. Keep plugins updated — security fixes arrive with new releases.

    6. Scope your profile — use a dedicated dsh profile for untrusted plugins if your harness supports it.

    What this directory does

    Every listing links directly to the maintainer’s GitHub repository, license, and metadata so you can perform these checks yourself. We review plugins before listing them, but no directory can guarantee safety — the final decision is always yours.