bigclawd/dsh-security-guard

README excerpt

🛡️ dsh-security-guard English 中文 A security guard for the DeepSeek Harness ( dsh ). Static scanning and runtime interception that never executes the code it protects you from. ✨ Highlights 🔍 Static scan Rule-based analysis of source files — ts.createSourceFile only, scanned code is never imported or executed 👁️ Runtime watch Intercepts dangerous tool calls, prompt steps and file operations before they happen 📊 Verdicts Every finding classified block \ warn \ clean , written to JSON or human-readable reports 🧩 Extensible rules Plain auditable JSON rules, overridable per id, no opaque signatures 🪝 Install hook Auto-scans every freshly installed plugin (profile-manifest watcher) 🖥️ Surfaces /scan command, plugin scan tool, live web panel, user-managed allowlist 🎯 Threat model Class Examples Default severity 🧨 Malicious code eval / new Function , child process , require("node:...") , postinstall hooks, process.env exfiltration, hidden base64/hex payloads, computed access on globals block 💉 Context injection "ignore previous instructions" / 忽略之前的指令 prompt-override phrases, unvetted URL hosts block / warn ⏳ Token waste oversized files, base64-dominant blobs, repeated words/char…

Category