dsh-plugin-development

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the dsh-agent-teams repository on GitHub (https://github.com/NanmiCoder/dsh-agent-teams) as a source for architectural reference and documentation. This repository is owned by the skill's author and is used in a legitimate context for evidence-based plugin development.
  • [COMMAND_EXECUTION]: The instruction set directs the agent to execute standard development lifecycle commands such as pnpm build, pnpm typecheck, and git diff. These commands are appropriately scoped to the local project environment for validation and verification.
  • [COMMAND_EXECUTION]: The skill employs the @deepseek-ai/dsh CLI tool via npx for managing plugin profiles and installations. These operations use well-known package scopes and are standard for the DeepSeek Harness ecosystem.
  • [PROMPT_INJECTION]: Section 2 contains a specialized instruction block for subagents that explicitly mandates read-only research, forbids file modification, and prohibits the disclosure of private repository content. This acts as a safety-enhancing guardrail rather than a malicious injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 02:10 PM
Security Audit — agent-trust-hub — dsh-plugin-development