Limitations

Honest scope. Read this before you rely on dsh-shield.

What dsh-shield can NOT guarantee

• It cannot prove a plugin is safe.
• It cannot prevent all prompt injection.
• It cannot sandbox a plugin that is already installed and running inside the Harness Node process.
• It cannot detect every obfuscated payload.
• It cannot replace OS sandboxing, EDR, or endpoint security.
• It cannot guarantee that an MCP server is trustworthy.
• It cannot stop a user who explicitly allowlists a malicious prepare script in pnpm (allowBuilds).
• It cannot see secrets that do not match its detectors (novel encodings, encrypted blobs, screenshots).
• It cannot rewrite tool arguments (Harness tools/pre-execute forbids input rewrite).
• It cannot gate MCP Resources or Prompts (Harness does not bridge them).
• Static analysis of JavaScript is incomplete by nature: eval of computed strings, native addons, and runtime-generated code will outrun the AST walker.

What the scan result is

A risk report plus a trust manifest.

NO HIGH-RISK FINDINGS DETECTED means the deterministic rules did not fire at high confidence. It does not mean SAFE.

HIGH-RISK BEHAVIOR DETECTED means observed APIs, scripts, or dependency specs matched rules. It does not by itself mean malware.

Scanner resource limits

When the scanner hits max files, max bytes, max AST files, or timeout, completeness is partial and the recommendation is REVIEW REQUIRED — SCAN INCOMPLETE.

Runtime crash policy

If the engine throws:

• high-risk tools (MCP, shell, delete, write, upload) → DENY
• other tools → ASK (which official Harness degrades to DENY without an approval channel)

The agent is not crashed. Security is not silently disabled.

UI

v0.1 does not ship a Web Security Center. Third-party settings namespaces are not exposed on stock Harness Web (see docs/harness-integration.md). CLI + JSONL audit are the supported surfaces.