安装
npx -y @deepseek-ai/dsh plugin --profile web add github:MkaliezZ/dsh-secret-guard此安装命令根据 GitHub 仓库地址生成，是未经验证的安装起点。
README
维护者编写的文档快照。
dsh-secret-guard
A fail-closed secret-like payload guard for DeepSeek Harness (DSH) tool calls.
The plugin inspects model-supplied tool arguments at tools/pre-execute and returns allow, ask, or deny before the tool body runs. v0.1 deliberately does not rewrite/redact arguments: DSH freezes execution identity and arguments before policy, so mutating them inside a guard would violate the runtime contract.
v0.1
- detects common private-key/token/key patterns;
- detects obvious sensitive field names;
- bounds serialized payload size and fails closed above the configured limit;
- optional tool-name scope (
protectedTools); empty means inspect every tool; actionOnFinding: block|ask;- no raw secret values in the denial reason.
Non-claims
- heuristic secret detection, not complete DLP;
- no guarantee every credential format is detected;
- no argument redaction in v0.1;
- not a sandbox or malware detector;
- should be composed with a policy boundary such as AgentFuse when broader action authorization is required.
Development
npm test
License
MIT
项目文件与信号
以下项目是目录快照中检测到的公开仓库信号。
测试已检测
仓库信息
- 开发语言
- TypeScript
- 许可证
- MIT
- 最后更新
- 2026年8月15日 06:35
谨慎安装
请检查源代码、权限、生命周期脚本、依赖与网络访问；不受信任的插件应先在隔离环境中测试。