DeepSeek Harness Plugin Distribution

DeepSeek Harness is the primary integration distribution target for API Relay Audit. This document is operational release documentation, not a user-facing safety claim.

Current Distribution Files

Target	File	Role
DeepSeek Harness	package.json, dsh/	Active GitHub-installable bundle that registers /relay-audit on DSH command-compatible clients and carries the generated standalone audit.py.
OpenClaw	SKILL.md	Retained direct integration file for existing users; no ClawHub registry publication is planned.
Hermes Agent	skills/api-relay-audit/SKILL.md	Retained direct integration file; not part of the current distribution or release gate.

All retained integration files must stay aligned with the current audit surface:

• version 2.4.0
• audit script ref v2.4.0
• 14 audit steps
• local-first execution
• API key not repeated in chat, logs, filenames, or public comments
• no claim that a relay is certified safe
• Hermes platform support includes Linux, macOS, and Windows. The Windows contract is Python 3 + curl with Git Bash or an equivalent POSIX shell for the one-shot recipe; direct local python audit.py ... commands can also run from PowerShell.

The skill files and DSH package are versioned distribution artifacts, so their audit.py download commands must use an immutable tag or commit SHA. Do not publish a versioned skill that downloads mutable master/audit.py.

DeepSeek Harness

The DSH bundle is deliberately prebuilt JavaScript with no prepare or build hook. A Git install therefore does not require pnpm's install-time build allowlist. Install an immutable repository revision into each intended profile:

DSH_PLUGIN_REF=v2.4.0
dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"
dsh plugin --profile cc-tui add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"

Compatibility contract:

• tested with DSH 0.1.0-rc.6 and dsh-cc-tui 0.4.1;
• requires the DSH profile/bundle loader and @deepseek-ai/dsh-commands;
• resolves baseURL, model, and apiKeyEnv from the current configurable provider, with explicit command overrides for missing facts;
• resolves the credential per invocation and never puts the value in argv or the recorded command input;
• accepts Claude routes over either Anthropic-compatible or OpenAI-compatible APIs, but refuses non-Claude model families because the current identity and stream-integrity baselines are Claude-specific;
• writes reports under the current session workspace by default.

Post-install verification:

dsh --profile web --dump-config
dsh --profile cc-tui --dump-config

Both dumps must contain the api-relay-audit row. In a configured session, /relay-audit --connectivity should create a local Markdown report without placing the API key in the command input, result, process argv, or logs.

The release-specific evidence is in distribution-verification-v2.4.0.md.

Non-Primary Integrations

The root OpenClaw SKILL.md and Hermes skills/api-relay-audit/SKILL.md remain available to existing direct users. They are maintained for compatibility, but neither is an active registry publication target or a release blocker. In particular, API Relay Audit does not publish to ClawHub.

Search Positioning

Primary concepts stay unchanged:

• API Relay Audit
• AI API relay security audit
• LLM proxy security

Do not merge these project-level query families into one marketplace slogan:

• API relay audit
• prompt injection audit
• model substitution signals
• Web3 relay audit

DSH-specific long-tail phrases:

• DSH plugin for AI API relay audit
• DeepSeek Harness Claude relay security audit

Use these phrases naturally in README and Pages. Do not rename the project or make DeepSeek Harness the primary project concept.