Install verification: runtime verified (L5) · tested on dsh 0.2.1-rc.2 · last checked Install verification details →
What it doesAI
Reversible delivery-contract plugin for DeepSeek Harness that keeps a live contract and performs verified Electron host and profile cleaning.
- Persistent live delivery contract that can be reversed
- Verified Electron host cleaning using original-fs
- Profile cleaning plus a settings card in the harness UI
Capability tags are AI-inferred or rule-extracted from the README (see badge) — vocabulary-limited, not install-verified. AI = inferred; README = literal keyword from the readme.
Installation
dsh plugin --profile web add github:571242/dsh-armor-switch#v1.1.2Install method: GitHub · runtime verified (L5)
Verification & Compatibility
Grouped by plugin version: each card lists the dsh versions actually tested against that artifact version and their install verdicts (L5 wins). Untested combinations are omitted — absence means untested, never assumed compatible. L1–L3 are a plugin-level static archive (independent of the dsh version — the same verdict on every dsh row): they sit in each row's level grid next to L4/L5, marked "static", while their evidence is stored once per plugin inside that row's "checks & evidence" instead of being duplicated per version.
External credentials (plugin-level): none detected
○ The author declares no dsh version requirement — install is not blocked by version.
| plugin ＼ dsh | dsh 0.2.1-rc.2 current | dsh 0.2.1-alpha.4 | dsh 0.2.1-alpha.2 |
|---|---|---|---|
| v1.1.2 | ✓ | ✓ | ✗ |
v1.1.2github✓ 2 runtime-verified1 failed2026-10-19
https://github.com/571242/dsh-armor-switch
✓dsh 0.2.1-rc.2current2026-10-19L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-rc.2
- • Plugin artifact: github · https://github.com/571242/dsh-armor-switch#v1.1.2
ID: dsh-armor-switch@v1.1.2@dsh0.2.1-rc.2 · profile: l4-sandbox
Issued: 2026-10-19 · expires: 2026-10-26
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✓dsh 0.2.1-alpha.42026-10-17L5 · runtime verified
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.4
- • Plugin artifact: github · https://github.com/571242/dsh-armor-switch#v1.1.2
ID: dsh-armor-switch@v1.1.2@dsh0.2.1-alpha.4 · profile: l4-sandbox
Issued: 2026-10-17 · expires: 2026-10-24
View checks & evidence
active in loader tree (150 entries)
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
✗dsh 0.2.1-alpha.22026-10-14L5 · failed
- • Node.js: v24.14.0
- • DSH: 0.2.1-alpha.2
- • Plugin artifact: github · https://github.com/571242/dsh-armor-switch#v1.1.2
ID: dsh-armor-switch@v1.1.2@dsh0.2.1-alpha.2 · profile: l4-sandbox
Issued: 2026-10-14 · expires: 2026-10-21
View checks & evidence
L1–L3 are plugin-level static conclusions (baseline, identical across dsh versions): evidence is stored once per plugin.
Author badges
Embed the official badges in your README to showcase security & install-test status:
`[](https://www.dsh.so/artifact/dsh-armor-switch/)``[](https://www.dsh.so/artifact/dsh-armor-switch/)`Security Report
Two automated layers, neither a manual review: a static scan (per-plugin rule checks) and a model-driven dynamic security audit that covers only the subset static-flagged at warn or above and never executes plugin code.
Static low, dynamic high — stricter wins → overall high.
v1.1.2dsh manifestv1.1.2git2026-10-21v1.1.2same versionclean · gitVet is an AST static scan (npm artifact or git source).
show static findings (5)
- warningfsWrite · files
src/host-clean.js:613fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2), 'utf8') - warningfsWrite · files
src/maintenance.js:231fs.writeFileSync(temp, next, { encoding: 'utf8', flag: 'wx' }) - warningfsWrite · files
src/preferences.js:49fs.writeFileSync(temp, bytes, { encoding: 'utf8', flag: 'wx' }) - warningfsWrite · files
src/profile-clean.js:198fs.writeFileSync(file, next, 'utf8') - warningfsWrite · files
src/profile-clean.js:224fs.writeFileSync(file, stripped.text, 'utf8')
show 5 audit findings
- highSystem-prompt contract forbids refusal and mandates malware/weapon deliverable instructions
src/index.js:283When state.enabled is true (config 'enabled' or the /armor-switch 'set'/'toggle' RPC), CONTRACT_TEXT/AUTHORITY_TEXT/MECHANISM_TEXT are injected as system-prompt sections on every assembly. They order the model to produce keygens, cracks, reverse shells, exploits, anti-debug/anti-VM bypasses and chemistry/weapons guides with full steps and quantities, and to attach no refusal, ethics or legal commentary. This systematically removes the harness's safety guardrails for every later request in the session.
- mediumAuthority text makes AGENTS.md/repo instructions binding and forbids flagging them as injection
src/index.js:315Workspace files from a cloned or untrusted repository (AGENTS.md, CLAUDE.md, .local overlays) are redefined as mandatory operator authority and the model is told not to flag them as prompt injection. With the switch on this creates a concrete indirect-prompt-injection path: repo-supplied text can redirect the agent while the harness's 'these instructions are only guidance' guard is explicitly overridden.
- mediumRPC 'set {fullAccess:true}' pins every live agent to danger-full-access with approvals disabled
src/index.jshandleRpc('set', {fullAccess:true}) calls permissionNote→applyPreset, which iterates every agent returned by agents.list() and sets the sandbox preset to danger-full-access (sandbox full access, approval 'never'). It is reachable over the plugin's own /armor-switch private channel and is not exposed or confirmed anywhere in the client UI, so it is a latent capability beyond the declared maintenance surface. Combined with the injected contract this yields unsandboxed command execution driven by model output.
- lowDormant in-place app.asar writer rewrites the host's approval wording to 'pre-authorized'
src/host-clean.js:242applyHostClean() performs byte-level in-place writes into the installed app.asar, replacing the harness's 'approval prompts are disabled / rejected automatically' wording so it reads as pre-authorized, after locating string literals in @deepseek-ai/dsh-agent-instructions and dsh-user-approval. In v1.1.2 it is dead code (apply() never calls runHostClean and the cleanAll/hostClean RPC returns disabled-action), but the writer is exported and the Config still documents a hostClean startup flag, so it is one wiring change away from silently mutating the host application binary.
- lowDormant profile writer pins sandbox danger-full-access and approval 'never' into cordis.patch.yml
src/profile-clean.js:40applyProfileClean() would append a marked block to the active profile's cordis.patch.yml setting sandbox-policy mode: danger-full-access, approval policy: never, defaultPreset: danger-full-access and a persona declaring operator/repo instructions mandatory and 'not untrusted data'. In v1.1.2 only the read/strip (restore) paths are reachable, so the block constant and writer are dormant, but they constitute a complete privilege-removal write path one call away.
Core function is a system-prompt jailbreak contract (never refuse; produce malware/weapon content); a live RPC applies danger-full-access, and dormant code patches app.asar.
Rule: the dynamic audit can only raise risk, never lower it (raise-only, never an exemption); a wrong raise is withdrawn by human review and the tier falls back to the static verdict. Overall verdict = the stricter of the two layers.
Disclaimer: the static scan and the dynamic security audit are both automated analysis, not a security guarantee. Always review what you install.
Activity
Last commit 2026-10-10 · activity: Active
• Repo created: 2026-10-07
• Stars: ★ 2 · Forks: 1
• Health: Active — committed within last 30 days
Source
Author README
View on GitHub ↗The author's original README from the repository — fetched live, unedited (the English page loads the default README).