dsh-plugin-dev
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill guides developers to download the DeepSeek Harness repository and install framework-related packages from the official npm registry and GitHub, primarily targeting the trusted @deepseek-ai organization.
- [COMMAND_EXECUTION]: Development and packaging workflows involve executing framework binaries and lifecycle management scripts via 'node', 'pnpm', and the 'dsh' CLI tool.
- [SAFE]: The documentation includes proactive security advice, specifically instructing users to manage credentials via environment variables rather than hardcoding them and warning about the security implications of third-party package build scripts.
- [SAFE]: The framework's 'defineTool' API is highlighted for its use of JSON Schema validation to sanitize and verify arguments provided by models at runtime.
Audit Metadata