863683348/dsh-plugin-gate

README 摘要

dsh-plugin-gate Installation safety gate for DeepSeek Harness plugins — an antivirus-style review step before you run dsh plugin add . The plugin marketplace is growing fast (thousands of entries), and malicious code mixed into a plugin is only a matter of time. dsh-plugin-gate gives the agent a gate scan tool that inspects a plugin source — a local directory or an npm tarball — for the classic malware shapes: Domain What it checks Scripts npm lifecycle scripts (pre/install/postinstall), exec/spawn/shell:true, curl sh, encoded PowerShell, cmd/WSH launch, dynamic require Obfuscation eval / new Function / vm.runIn , hex-escape floods, base64 blobs, char-array packing Permissions credential env reads ( OPENAI API KEY etc.), ssh/aws/npmrc file reads, writes to system/home/dotfile paths, chmod 777, sandbox-escalation requests Network external URLs & hosts, fetch/axios/socket/WebSocket/DNS APIs, cloud-metadata endpoints (169.254.169.254), Discord/Telegram/Slack webhooks, .onion, read-then-send exfiltration shape Secrets hardcoded sk- keys, ghp tokens, AWS keys, private key blocks, bearer tokens Supply chain exact-version direct dependencies checked against Google OSV (ranges and official…

分类