Eligahyu/dsh-sentinel-scanner

README excerpt

🛡️ dsh-sentinel Read-only security, supply-chain, and health scanner for DeepSeek Harness plugins Heuristic rules, AST/taint analysis, package quarantine, dependency intelligence, SBOM export, SARIF, and CI policy enforcement—without executing scanned code. Node.js ^22.18.0 or =24.11.0 · Static analysis only · MIT English · 中文 · Rules · Architecture · Roadmap English What is dsh-sentinel? dsh-sentinel gives DeepSeek Harness (DSH) plugins an X-ray before you trust or install them. It is a read-only static security scanner for plugin source trees, published npm packages, DSH profiles, and CI pipelines. The scanner looks for command execution, dynamic code evaluation, credential access, data exfiltration, obfuscation, unsafe lifecycle scripts, persistence, native binaries, manifest escape paths, and package drift. It combines 51 heuristic rules with AST-based taint analysis, bounded module and cross-file analysis, supply-chain metadata, and explicit scan-coverage reporting. Every scan produces a structured report with a 0–100 risk score , a safe / review / risky / dangerous verdict, evidence for each finding, and actionable remediation guidance. The same engine is available as: - a D…

Category