security.md
September 1, 2026 · View on GitHub
安全与鉴权
对应网站分类：安全与鉴权 · Security & Auth
| 插件 | 能力 | 安装或挂载方式 | 许可 / 风险 |
|---|---|---|---|
| KongFangXun/sofagent | Adds audit, rollback, governance, constraint injection, ontology, and workflow controls to DSH. | skillhub install cordis-plugin-sofagent-audit (repeat with cordis-plugin-sofagent-rollback, cordis-plugin-sofagent-inject, cordis-plugin-sofagent-evolve, cordis-plugin-sofagent-ontology, cordis-plugin-sofagent-commons, cordis-plugin-sofagent-gate, cordis-plugin-sofagent-daemon, or cordis-plugin-sofagent-fde) | MIT；The root repository is a monorepo and the DSH units are the individual engine/dsh-plugins packages; install only the specific family members needed. |
| Hyna-hla/dsh-remote | Pair a mobile client with DSH for remote sessions, approvals, MCP/file browsing, and token-gated host access. | git clone --depth 1 https://github.com/Hyna-hla/dsh-remote.git && cd dsh-remote/dsh-remote-access && npm pack && dsh plugin --profile web add ./dsh-remote-access-2.5.1.tgz; restart DSH web. | MIT；The repository root mixes the Android app and plugin, and its nested README still names v2.4.1 while package.json is v2.5.1; install from dsh-remote-access and review exposure/tunnel settings carefully. |
| HakureiMonika/dsh-sandbox-escalation-fix | Project per-session sandbox escalation schemas and suppress redundant escalation retries in DSH. | dsh plugin --profile web add github:HakureiMonika/dsh-sandbox-escalation-fix#c209f3358853e8c486cf0bfe6cfbb79c88a0bc0a | MIT；This is an independent community plugin, and its package repository/homepage metadata still references JUSTMONIKA2022; use the canonical HakureiMonika URL and the pinned commit above. Compatibility is limited to the DSH versions listed in README.md. |
| SCSpotato/dsh-remote | Control DSH sessions from Android over HTTPS/WebSocket and browse or mutate host files through the companion plugin. | From a clone, run: npx dsh plugin --profile web add "file:C:/path/to/dsh-remote/remote-control"; then npx dsh web. | GPL-3.0；Use only on a tightly controlled private network and audit the file routes before exposure: /remote/list, /remote/file, /remote/upload, /remote/delete, /remote/rename, /remote/copy, and /remote/mkdir accept filesystem paths without the token check used by task routes. |
| IceApriler/dsh-remote-mobile | Adds authenticated LAN and Tailscale access to the DSH web console with QR pairing, persistent device sessions, and mobile UI adaptations. | Run dsh plugin --profile web add dsh-remote-mobile; for external access add the README's webserver patch with host: '0.0.0.0' and port: 3080, then run dsh web --no-open. | MIT；The README requires host: '0.0.0.0' for external access and explicitly warns that LAN passwordless mode lets any device on the local network control the workspace; use only on a trusted network and review firewall and authentication settings. |
| TiantianFlow/dsh-one-gateway | 面向 DSH Web 的私有零信任网关：仅回环监听的 HTTP/WebSocket 反向代理，经 Tailscale Serve/Cloudflare Access/Headscale TCP Serve 提供身份优先入口，支持 trusted-header、signed-jwt、gateway-credential 三种认证模式与精确 principal 允许列表 | dsh plugin --profile web add -w /path/to/dsh-one-gateway（随后执行 dsh plugin --profile web exec dsh-gateway -- setup --provider <tailscale-serve|cloudflare-access|headscale-tcp-serve>） | MIT；仓库仅创建约 6 天（2026-08-16），0 forks 无外部审计，作为安全边界组件建议上架前谨慎评估；EasyTier provider 标注 Not shipped；安装后默认惰性（enabled:false），需手动 setup 才启用监听 |
| PensiveFei/dsh-secure-audit | DSH 只读安全与合规插件：提示注入/越狱检测（规则引擎+可选模型分类器）、中文 PII（手机号/身份证/银行卡等）脱敏、本地配置安全审计（密钥/文件权限/会话文件/环境变量），输出脱敏报告并注册 security-review 技能 | dsh plugin add dsh-secure-audit（或从 GitHub release tarball 安装：dsh plugin add github:PensiveFei/dsh-secure-audit#<commit>） | MIT；仅针对 dsh-tools 0.1.0-rc.7 测试，DSH 尚未 1.0，升级后需重新验证；检测为启发式规则，可能漏报误报；仓库创建于 2026-08-19，较新且星标少 |
| inmny/dsh-sandbox-escalation-fix | Prevent repeated same-or-lower sandbox requests from failing while preserving genuine escalation approval checks. | dsh plugin --profile web add dsh-plugin-sandbox-escalation-fix@0.1.2 | MIT；The implementation is tightly coupled to DSH 0.1.0-rc.6 ToolDefinition internals; retest after every DSH upgrade and remove it once upstream accepts redundant no-op escalation requests. |
| niaccky/dsh-install-guard | 拦截 DSH bash 工具中的 npm install：解析命令后并行审计漏洞（OSV.dev）/许可证（SPDX）/体积（Bundlephobia）/健康度（typosquat），按策略返回 allow / ask / deny；另注册只读 dep_check 工具 | dsh plugin --profile web add dsh-install-guard | MIT；审计时向 npm registry、OSV.dev、Bundlephobia、npm downloads API 发送包名与版本；无 API key、不读源码；默认 fail-open，可配 failClosed: true |
| ang-XWBWZ/dsh-approval-ai | AI 审批应答器:用统一 LLM 路由自动应答 DSH 审批提示,带 fail-closed 策略检查;注册原生 /approval-ai 斜杠命令,设置经 approval-ai settings 命名空间实时生效,无需手改 cordis.patch.yml。 | pnpm dsh plugin --profile approval-ai add @llangtop/dsh-approval-ai@next (dev: pnpm dsh plugin --profile approval-ai-local add /mnt/data/demo/dsh插件/approval-ai or add the packed .tgz) | MIT；Prerelease version; pin the exact tag and review the fail-closed policy rules before use on production profiles. |
| arrow949/dsh-turn-approval | 任务级授权:在 DSH Web 审批卡片上增加「允许本次任务」按钮——请求 danger-full-access 时只授权当前任务余下时间内的同类升级,任务结束授权自动消失;授权仅存内存,进程重启/卸载/session 释放即失效(fail-closed),不修改官方 bundle 文件。 | dsh plugin --profile web add github:arrow949/dsh-turn-approval#<commit-sha> (or: dsh plugin --profile web add ./dsh-turn-approval; remove: dsh plugin --profile web remove dsh-turn-approval) | MIT；Reuses official ApprovalPanel CSS class names — may need compatibility updates if DSH changes that component. |
| BlockRunAI/dsh-clawrouter | Second brain for the DSH agent: runs a strong review model over material you choose before risky tool calls run, mounted as an extra model route without changing the default model (dsh-base stays deepseek-official); 70 models from one wallet (x402) where configured; per-profile enable in cordis.patch.yml. | dsh plugin --profile web add dsh-clawrouter ; enable the route in the profile's cordis.patch.yml | MIT；Review exactly which calls are routed externally; wallet/x402 only when explicitly configured. |
| cyzlmh/dsh-cyber-sec | Authorized security-assessment profile for DeepSeek Harness: scoped network tools, bash in an ephemeral cyberstrike-kali container (auto-removed), authorization/scope guard, durable evidence, 21 security skills and 7 specialist subagents; a mutually exclusive red-team profile enables all 21 skills and removes the scope guard. | pnpm install && pnpm run pack:bundle, then: dsh plugin --profile cyber-sec add ./dist/<plugins.tgz> ./dist/<bundle.tgz> (absolute or ./-prefixed paths; red-team profile install documented separately) | Apache-2.0；Use only on authorized ranges; never enable the red-team profile on machines that can reach production networks. |
| dongsheng123132/dsh-capability-receipt | 技能能力凭证 (skill capability receipts): 对 DSH 实际加载的技能生成 SHA-256 内容寻址凭证并 verify（contentHash + fileCount），不返回技能指令/元数据/绝对路径，目录闭包限 256 文件/1MiB/8MiB 且拒绝符号链接。 | dsh plugin --profile capability-proof add github:dongsheng123132/dsh-capability-receipt#<commit> | MIT |
| dongsheng123132/dsh-policy-drift-proof | 策略漂移审计 (policy drift evidence): 只读、内容寻址、值脱敏的策略/配置漂移证据（inspect/verify）。 | dsh plugin --profile policy-proof add github:dongsheng123132/dsh-policy-drift-proof#<commit> | MIT |
| henlii/dsh-plugins | 插件集合：dsh-web-auth 为内网/LAN/Tailscale 访问提供密码认证+信任校验（非回环 /api 与 WebSocket 需登录，认证后特权页可用）；可独立或整包安装 | dsh plugin --profile web add /path/to/dsh-plugins/plugins/<name> 或 dsh web --patch /path/to/dsh-plugins/cordis.patch.yml | MIT；@deepseek-ai/* / cordis deps are injected by the official runtime - do not declare them in plugin package.json. |
| Hyperionjust/dsh-tool-underseal | 密封委托(underseal)：对 assignment/文件加密封装后委托 agent 执行并校验完整性，防篡改；附带 underseal-delegation 技能 | dsh plugin --profile <name> add dsh-tool-underseal (或 git 形式 dsh plugin --profile <name> add github:Hyperionjust/dsh-tool-underseal#<sha>) | Apache-2.0；基于 DSH 0.1.0-rc.5 验证，需按版本重验；Windows 含空格路径需手动加引号 |
| jkrandom-sudo/dsh-plugin-audit | 插件安全审计：plugin_audit 静态扫描（文件/行号权限画像）+ 运行时哨兵在触及凭证或向未知主机外发时请求批准；可选 invariant 组件 | dsh plugin --profile web add dsh-plugin-audit （或 github:jkrandom-sudo/dsh-plugin-audit） | MIT；invariant 行不能装配进没有 invariants 服务的 profile（boot 报 pending） |
| karuboniru/dsh-approval-guardian | 自动审批机制（仿 codex auto-review）：按部署策略自动批准/拒绝 agent 审批请求，减少人工等待；默认 shipped patch 为保守默认 | dsh plugin --profile web add dsh-approval-guardian@0.1.1 （或本地 checkout：pnpm install && pnpm run build && dsh plugin --profile web add .） | MIT；上线前务必审阅部署策略行；enable/disable 走 profile 层 cordis.patch.yml 覆盖 |
| khiqwq/dsh-credentials-system | 系统绑定加密凭据提供者：Windows x64/ARM64 经 DPAPI CurrentUser 加密存储凭据，替代明文 @deepseek-ai/dsh-credentials-local（$DSH_HOME/.credentials.yaml） | 安装为 profile bundle 并在 corsis/cordis.patch.yml 组合中声明 name: dsh-credentials-system（示例组合见 README，含 name: '@deepseek-ai/dsh-credentials-local' 行） | MIT；必须确保不回退到明文 credentials-local 存储；v0.1 仅支持 Windows |
| Letter2025/dsh-approval-llm | 模型化权限审批（approve-for-me）：独立 reviewer 模型应答 permission/approval 请求并可自动批准（39 项离线单测） | dsh plugin --profile web add dsh-approval-llm | MIT；自动批准有误批准风险，建议限制可批准的动作类型与额度。 |
| LKRCharon/dsh-egress-guard | llm/stream 边界扫描完整模型请求：发现疑似密钥时不下发下游模型适配器并返回固定脱敏错误；不联网、不改写请求、扫描不了即阻断（fail-closed）。 | npx --yes @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add dsh-egress-guard （或 git+https://github.com/LKRCharon/dsh-egress-guard.git / file:…），随后 --dump-config 验证；覆盖行在 profile cordis.patch.yml 重述 name: dsh-egress-guard | MIT |
| lonelymoon87/dsh-guardian | 运行时危险操作策略、规范输出脱敏与 /security-review 只读安全审查 skill（MVP 非进程沙箱/授权系统/数据防泄漏，提供策略层）。 | dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.2/dsh-guardian-0.1.2.tgz （或 github:lonelymoon87/dsh-guardian#v0.1.2） | MIT |
| PerryLink/dsh-auto-review | Read-only second-model reviewer subagent returns structured allow/deny verdicts with reasons for approval requests; per-tool policies (ai/human/never) + regex risk rules; fail-closed by default, fully auditable in the session log. | pnpm pack && dsh plugin --profile web add ./dsh-auto-review-0.1.0.tgz (or github:PerryLink/dsh-auto-review#<commit>, or link:/path/to/dsh-auto-review) | Apache-2.0 |
| PerryLink/dsh-permission-rules | Ordered declarative YAML permission rules (allow/deny/ask) with tool-name, argument (glob/regex) and workspace-path matching on the pre-execute waterfall; session-log audit, HMR reload; ask rides the official approval seam. | dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#main" (or pnpm pack && dsh plugin --profile web add ./dsh-permission-rules-0.1.0.tgz) | Apache-2.0 |
| wefio/dsh-plugin-audit | 插件安全审查 skill：装任何第三方 DSH 插件/preset 前审查其源码（host 插件=宿主任意代码执行权的前提教育、攻击方式→拦截对照表、审计报告模板）；附带可独立运行的确定性初筛脚本 scripts/scan.mjs。 | 把整个 dsh-plugin-audit/ 目录放入技能根目录 ~/.dsh/skills/（或 ~/.agents/skills/）；初筛可单独运行：node dsh-plugin-audit/scripts/scan.mjs <插件目录> | MIT；非原生 bundle：按 DSH skill 目录约定安装使用。 |
| agentic-control-plane/dsh-acp-plugin | Agentic Control Plane for dsh: policy-checks every tool call before it runs and records every allow/block/ask decision; agentTier configurable (interactive/background, headless resolves ask→deny). | dsh plugin --profile <your-profile> add dsh-plugin-acp (or dsh plugin add github:agentic-control-plane/dsh-acp-plugin; override the row in profile cordis.patch.yml) | MIT |
| dongsheng123132/dsh-release-proof | 发布供应链证据 (release evidence): 可复现的多来源发布物 inspect/verify（软件供应链/工件校验）。 | dsh plugins install github:dongsheng123132/dsh-release-proof | MIT |
| securstack/securstack-dsh-plugin | SecurStack 安全扫描适配：仓库安全扫描、策略门禁、doctor 诊断、JSON CLI 结果，供 AI agent 安全调用 | dsh plugin --profile securstack add @securstack/dsh-plugin | MIT；DeepSeek Harness developer preview，兼容性待验证 |
| JUSTMONIKA2022/dsh-sandbox-escalation-fix | Session-aware sandbox 权限升级兼容插件：修复同模式 escalation、空白 justification、重试循环失败。 | Release 一键安装/卸载或 GitHub 安装（见 README） | MIT |