sashankh/dsh-taintguard

README 摘要

dsh-taintguard Indirect prompt-injection guard for DeepSeek Harness. An agent that browses the web or reads a repository puts third-party text into the same channel that carries its operator's instructions. A model has no reliable way to tell them apart, so a page, a README, or an MCP tool result can ask the agent to run a command or post a file somewhere. This plugin does not try to make the model immune to that. It narrows what the retrieved text can reach: it marks the agent once a tool result arrives from an untrusted source, gates the privileged calls that follow, and refuses outright when credential material appears in an argument heading off the machine. Measured, not asserted Run against AgentDojo v1.2.1 — the benchmark CaMeL and Fides both report on. Full method, caveats, and reproduction in eval/ ; no API key required. Measurement Result Attack payloads caught by the content detector 35 / 355 — 9.9% Benign environment strings falsely flagged 0 / 345 — 0.00% Attack payloads arriving through an observed reader tool 355 / 355 — 100% Consequential calls gated once origin tainting is on 80 / 82 — 97.6% Two conclusions, both uncomfortable, both worth stating plainly: The patter…

分类