Read-only DSH plugin auditor with static scanning, current-session model review, and confirmation gates.
Install
# from GitHub (first run asks for allowBuilds approval — follow the hint, retry)
dsh plugin --profile web add github:Mengshang-spec/dsh-plugin-trustlens
Any plugin you install runs third-party code with your own permissions — it can read your files, use your credentials, and reach the network, and tool approvals don’t sandbox it. GitHub-sourced plugins also run build scripts at install time — pnpm blocks those until you allow them, so an install can stop with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED or ERR_PNPM_IGNORED_BUILDS; dsh prints the exact key to add under allowBuilds in your profile’s pnpm-workspace.yaml, and the install works on the next run. Allowing a build is a trust decision: only install sources you trust, and pin a commit (github:owner/repo#sha).
README
dsh-plugin-trustlens is a DeepSeek Harness plugin that reviews installed plugins before a user enables or updates them.
It combines:
- Read-only static scanning for common remote execution, download-and-execute, encoded evaluation, persistence, and environment exfiltration patterns.
- Semantic review through the model selected by the current DSH session. It does not hard-code DeepSeek or silently choose another model.
- Comment and README contradiction reporting through
commentConflicts. - User confirmation gates for enabling, updating, and disabling/quarantining a plugin.
The auditor never requires, imports, launches, installs, downloads, or executes the plugin being inspected. Plugin code, comments, README files, strings, and model output are treated as untrusted data.
DSH installation
Install from the repository with the DSH CLI:
dsh plugin --profile web add github:Mengshang-spec/dsh-plugin-trustlens
The package declares its bundle manifest and patch entry automatically. For a manual local checkout, copy this package into the DSH profile's node_modules directory and add it to the profile patch:
- insert:
- id: plugin-trustlens
name: dsh-plugin-trustlens
The DSH Desktop companion synchronizer performs those two steps automatically for the bundled plugin.
Use
Open DSH settings, choose AI 审查, enter the installed package name and its path under the current profile's node_modules, then start the review. The result shows the active provider/model, static findings, semantic findings, and comment/document conflicts.
Static high-risk findings disable the enable/update actions. A user can still explicitly choose isolation/disable after reviewing the report.
Development tests
Run from a DSH Desktop checkout with the bundled Node runtime:
vendor/node/node.exe --test scripts/test/unit-plugin-trustlens-protocol.test.mjs scripts/test/unit-plugin-trustlens.test.cjs
The same checks are available with npm test after installing dependencies.
Limitations
Static scanning is intentionally conservative and can produce findings for security-related example strings or regular expressions. It is a review signal, not proof of malware. Semantic review also requires an active DSH model and credentials; if the current model cannot be determined, the plugin fails closed.
License
MIT. See LICENSE.
Links
More in this category
toby-bridges/api-relay-audit★ 876
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
SeaOf0/dsh-redteam-model★ 685
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
howmp/dsh-pentest★ 607
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
PerryLink/dsh-auto-review★ 234
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
NanmiCoder/dsh-auto-mode★ 164
Adds an Auto permission preset between Workspace Write and Full access: routine work stays in the official workspace-write sandbox while the current session model reviews escalation and destructive calls, granting one exact wider access once, asking when the intent is ambiguous, and denying critical paths.
ADWMC/helm-d#helmd★ 151
Single-bundle reverse-engineering and pentest security plugin: first-turn tool narrowing, domain routing, and 33 tools covering APK, web, native binary, protocol, malware and LLM samples — with unpacking, license-bypass and anti-analysis case playbooks, an H-CoT evaluation engine (semantic routing, /hcot command), a web workbench with a ledger-driven tool shelf, an on-disk case workflow (auto-persisted evidence chain, E-numbered validated findings, post-compaction resume), GitHub-based external tool discovery, and 361 on-demand reference docs.
Community comments
Comments are public GitHub Discussions. Loading them connects to GitHub and Giscus; a GitHub account is required to post.