dsh-plugin-development
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
dsh-agent-teamsrepository on GitHub (https://github.com/NanmiCoder/dsh-agent-teams) as a source for architectural reference and documentation. This repository is owned by the skill's author and is used in a legitimate context for evidence-based plugin development. - [COMMAND_EXECUTION]: The instruction set directs the agent to execute standard development lifecycle commands such as
pnpm build,pnpm typecheck, andgit diff. These commands are appropriately scoped to the local project environment for validation and verification. - [COMMAND_EXECUTION]: The skill employs the
@deepseek-ai/dshCLI tool vianpxfor managing plugin profiles and installations. These operations use well-known package scopes and are standard for the DeepSeek Harness ecosystem. - [PROMPT_INJECTION]: Section 2 contains a specialized instruction block for subagents that explicitly mandates read-only research, forbids file modification, and prohibits the disclosure of private repository content. This acts as a safety-enhancing guardrail rather than a malicious injection.
Audit Metadata