What it doesAI
Security inspector plugin for DSH that checks untrusted skills before installation, with browser-local pre-check and optional LLM review.
- Browser-local rough check before installing skills
- Optional structured review by DSH-configured LLM
- Focuses on agent security and prompt injection
AI-generated from the repo README — for reference only.
Installation
dsh plugin --profile web add github:kakapengta/DSH-Skill-Security-InspectorInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
No critical or warning findings in the automated scan. The result is valid only for the commit hash shown.
0.1.0-rc.8dsh manifest8e72e446c5062026-08-208e72e446c506The scan result is valid for the scanned commit. New commits within 7 days are tolerated (the rating still counts); after 7 days without a rescan the badge shows outdated.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
vet verdict: vet: clean · score 100
- R10 · info [heuristic] — 依赖清单：10 项（@deepseek-ai/cordis, @deepseek-ai/dsh-agent-default-model, @deepseek-ai/dsh-client-locale, @deepseek-ai/dsh-client-runtime, @deepseek-ai/dsh-client-ui-sidebar, @deepseek-ai/dsh-client-ui-slots, @deepseek-ai/dsh-host-webserver, @deepseek-ai/dsh-llm, @deepseek-ai/schemastery, react，供 LLM 审计供应链；已知漏洞核对见后续 OSV 精确版本查询（网络失败静默降级））
- R12 · info [certain] (downgraded) — 入口文件缺失：./lib/index.js
vet is advisory and does not change dsh’s four-tier level.
• Static heuristic scan: done (15 files)
• Dependency vulnerabilities: requires deep audit (L3+)
• Permission sandboxing: requires runtime testing (L4+)
Activity
Last commit 2026-08-20 · activity: Active
• Repo created: 2026-08-20
• Stars: ★ 1 · Forks: 0
• Health: Active — committed within last 30 days