dsh-taintguard

Indirect prompt-injection guard for DeepSeek Harness: taints tool output by origin, gates privileged calls that follow untrusted content, and refuses credentials heading off the machine.

PluginAI Models

Verification

L2 · Structured

Security

Pending

Health

Active

Trust

Bronze

What it does

Indirect prompt-injection guard for DeepSeek Harness: taints tool output by origin, gates privileged calls that follow untrusted content, and refuses credentials heading off the machine.

Installation

dsh plugin --profile web add github:sashankh/dsh-taintguard

Install method: GitHub · not yet tested in container (L3+)

Compatibility

DSH Version	Status
not stated	Declared — not tested

Requirements

• Node.js: not stated
• DSH: declared "not stated"
• External credentials: none detected

Security Report

Automated static scan, not manual review.

DSH.SONOT SCANNEDSCAN— FILES

------

Security reviewAutomated review · daily

NOT SCANNED

No security scan record for this plugin yet. Newly indexed plugins are scanned by the daily pipeline.

0 critical·0 warning·0 info·— files scanned

Version binding

plugin version—

scanned commit—

latest commit421e6726d9d0

The scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.

Disclaimer: automated static analysis, not a security guarantee. Always review what you install.

• Static heuristic scan: pending

• Dependency vulnerabilities: —

• Hardcoded secrets: —

• Supply chain risks: —

⚠ Static scan not run yet — results will appear here.

Activity

Last commit 2026-08-16 · activity: Active

• Repo created: 2026-08-18

• Stars: ★ 0 · Forks: 0

• Health: Active — committed within last 30 days

Source

GitHub: github.com/sashankh/dsh-taintguard