26 results
DeepSeek Harness plugin for remote access: a token-gated reverse proxy keeps settings, credentials, and file access working over public tunnels and on other devices instead of returning 403. Per-device sessions.
DSH local security audit tool: read-only scans of config, credential metadata, plugin provenance, session structure and network exposure; redacted, reproducible, locatable risk reports
Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.
WebUI-managed encrypted credentials for DeepSeek Harness: one file, plaintext until a password is set, then AES-256-GCM ciphertext under an Argon2id-derived key with SHA3-256 fingerprints; per-request decryption, unlock lockout, leak-guard output redaction, and shipped-code integrity self-checks.
装插件前，先体检：第三方插件 = 进程内全权限代码，这个工具让'盲装'变成'知情安装'——恶意模式、越权路径、未检查依赖，一目了然。Static heuristic vetting for third-party DeepSeek Harness plugins: exfiltration, credential access, over-privileged paths, unvetted dependencies.
Mingleng mcpguard for DeepSeek Harness 鈥?the first security plugin for DSH. Scans skills and MCP configs for prompt injection, homoglyphs, hidden Unicode, dangerous shell and credential leaks.
Named user credentials for DeepSeek Harness: model-facing credential tools, secrets behind the ctx.credentials seam, DSH_CM_* shell variables, and a Settings → Credentials page
DeepSeek Harness plugin: auto-detect secrets pasted into the composer, store them in the official credentials seam, and send [secret:REF] placeholders to the model instead of the value.
DSH agent-fleet hygiene audit: credential-file permissions, embedded credentials in git remotes (masked), provider token-prefix literals. Read-only, zero-dependency, deterministic.
Conversation-local credential handoff that writes through the DSH credential service without returning the secret to model context.
Pre-install supply-chain poison scanner for DeepSeek Harness plugins: AST analysis (NodeSecure JS-X-Ray) + deobfuscation decoder + regex heuristics to catch credential exfiltration, dynamic code execution, obfuscated imports, and install-time scripts.
Installation safety gate & data-protection guard for DeepSeek Harness: 60 static signature rules (31 high/24 medium/5 low) scan plugin sources for malicious install scripts, credential theft, obfuscation, persistence and network callbacks before 'dsh plugin add', plus 12 destructive-command patterns and workspace-boundary checks against accidental deletion. | 安装安全闸门与数据保护闸：60 条静态签名规则（31 高危/24 中危/5 低危）扫描插件恶意行为、持久化与外传，12 种危险命令模式与边界检查拦截误删。
A DeepSeek Harness (dsh) security plugin: blocks agents from reading or writing sensitive files (.env, credentials, key material), masks leaked secret-shaped values in tool results, keeps an audit journal, and exposes safe inspection tools that never print raw values.
V0 capability-disclosure scanner for DeepSeek Harness (DSH) cordis plugins: reports which sensitive services (credentials/shell/approval/sandbox/fs/tools...) a plugin declares or references before you trust it.
Governed platform access for DeepSeek Harness — no credential on the machine
Runtime security guard for DeepSeek Harness (DSH) — blocks command injection, SSRF, credential exfiltration, and destructive operations at runtime.
Secret & dangerous-pattern scanner for DeepSeek Harness — a security_scan tool that finds leaked API keys, tokens, private keys and credential files, with full redaction.
DeepSeek Harness config sync: export/import DSH settings, API credentials, profile plugin patches and user agent presets as portable local bundles or a single password-encrypted file (AES-256-GCM + PBKDF2-SHA256).
Password gate for dsh-web: opening the web port requires a username/password login; account credentials are stored salted+scrypt-hashed and AES-256-GCM encrypted in a local config file under $DSH_HOME. Host-only cordis plugin, no dsh source changes.
HashiCorp Vault backend for the DeepSeek Harness credential seam: central secrets, AppRole machine auth, rotation without restart, and no long-lived provider key on the agent host
Safe Git credential hints: GCM path, HTTPS vs SSH origin (never returns secrets).
AI Agent runtime authorization & evidence verification — tool-call GuardrailProvider, CCS 7-dimension verification standard, MCP/DSH security scanner, SSRF/command-injection/credential-exfil blocking with Ed25519 signed receipts.
Offline content-addressed proof for supplied credential-retirement closure
Guard DeepSeek Harness PowerShell, file, image, and search tools on Windows with workspace, credential, approval, and audit policy.