dsh-guardian DSH plugin

dsh-guardian is a DeepSeek Harness plugin built on Cordis that adds a security layer before every Agent tool invocation. It uses five detection engines (dangerous commands, credential protection, secret leakage, SSRF, and prompt injection/tool poisoning) with a risk scoring system and three-tier disposal (deny/block/log).

security-policy

How to install the dsh-guardian DSH plugin

dsh plugin --profile web add github:cdxiaodong/dsh-guardian

Copying does not run this command. Review the repository and version before installing the dsh-guardian DSH plugin.

dsh-guardian DSH plugin data source

dsh-guardian DSH plugin snapshot date: Aug 16, 2026

discovered

What the dsh-guardian DSH plugin can do

Intercepts shell commands like rm -rf, dd, mkfs, fork bombs, reverse shells, and privilege escalation.
Protects credentials by blocking access to files like .ssh, .aws, .env, /etc/shadow.
Detects 25+ types of secret keys (AWS, GitHub, OpenAI, etc.) with regex and Shannon entropy filtering.
Blocks SSRF attacks targeting cloud metadata, internal networks, and dangerous URL schemes.
Identifies prompt injection and tool poisoning patterns including ignore previous instructions, DAN jailbreak, zero-width characters, and hidden HTML comments.
Provides a path sandbox with realpath resolution, whitelist roots, encoding variant decoding, and null byte truncation detection.
Assigns a risk score from 0 to 1 based on multi-signal probabilistic weighting, with configurable thresholds for deny/block/warn/allow.

Where the dsh-guardian DSH plugin fits

Prevent accidental or malicious file deletion by LLM agents executing shell commands.
Block unauthorized reading of sensitive credential files (e.g., .ssh/id_rsa, .aws/credentials).
Stop sensitive keys (API tokens, secrets) from being leaked to remote servers via network requests.
Guard against internal network reconnaissance or metadata service exploitation via SSRF.
Detect and block prompt injection attacks that attempt to hijack the agent's behavior.

Who the dsh-guardian DSH plugin is for

Developers using DeepSeek Harness who want to add runtime security to their agents.
Teams deploying LLM agents that execute shell commands, read/write files, or make network requests in production.
Security-conscious users who want to reduce the risk of damage from prompt injection or tool poisoning.

dsh-guardian DSH plugin limitations

All regex/heuristic guards can be bypassed by adversarial examples; the plugin is a risk reducer, not a complete solution.
Requires the Cordis event system and a human-in-the-loop listener for the 'block' disposal level; without it, blocked actions are denied by default.
Only tested with the DSH plugin environment; compatibility with other setups is not guaranteed.
The path sandbox is based on a whitelist of allowed roots; full filesystem isolation is not provided.

dsh-guardian DSH plugin: from the repository README

Quoted from the cdxiaodong/dsh-guardian README, the upstream source of the dsh-guardian DSH plugin. Copyright remains with the original authors.

> **Agent 安全护栏** · 基于 [Cordis](https://github.com/cordiverse/cordis) 时空可组合元内核的 DeepSeek Harness 插件。 > 在 Agent 每次工具调用前做安全审查，命中危险即拦截或要求人工确认。 [![CI](https://github.com/cdxiaodong/dsh-guardian/actions/workflows/ci.yml/badge.svg)](https://github.com/cdxiaodong/dsh-guardian/actions/workflows/ci.yml) --- ## 🎯 解决什么问题 LLM Agent（Claude Code / DeepSeek Harness）能自主执行 shell、读写文件、发网络请求。一旦被**提示注入**、**工具投毒**或**模型误判**带偏，可能在你不知情时 `rm -rf`、读取 `.ssh/id_rsa`、把密钥外泄到远程。本插件是一道**运行时安全网**： ``` Agent 想执行工具 → guardian/check 前置审查 → 命中规则 → 拦截 / 人工批准 → 才放行 ``` ## 🛡️ 五大检测引擎 | 引擎 | 检测内容 | 借鉴来源 | |---|---|---| | **CMD/INJ** 危险命令 | rm -rf、dd、mkfs、fork炸弹、反弹shell、管道执行、提权 | Sigma 规则、PayloadsAllTheThings | | **CRED** 凭据保护 | 读 .ssh/.aws/.env/kubeconfig、/etc/shadow | mcp-safeguard CRED 系列 | | **SECRET** 密钥泄露 | AWS/GitHub/OpenAI/Anthropic/Slack/Stripe 等 25+ 种密钥正则 + Shannon 熵过滤降误报 | gitleaks、trufflehog | | **SSRF** 网络目标 | 云 metadata（169.254.169.254）、内网网段、file://、gopher:// | mcp-safeguard SS 系列 | | **PI/TP** 提示注入+工具投毒 | ignore previous instructions、DAN越狱、零宽字符、HTML注释藏指令、瞒用户指令 | Rebuff、LLM Guard、Vigil | 外加： - **路径沙箱**（`guardian/path`）：realpath 解析 + 白名单根目录 + 编码变体解码 + 空字节截断检测——比纯正则可靠 - **风险评分引擎**（`risk.ts`）：多信号并集概率式加权

Read the full READMEThe repository declares no license. Check with the authors before using it.

dsh-guardian DSH plugin questions

How do I install dsh-guardian?

You can install it using the DSH plugin command: `dsh plugin --profile web add github:cdxiaodong/dsh-guardian`. This will add the plugin to your DSH profile. Make sure you have DeepSeek Harness set up properly before installing.

What happens when a tool call is blocked with 'block' level?

The 'block' level requires human confirmation. You need to set up a listener for the `guardian/approve` event. If no listener is registered, the plugin will deny the action by default. The listener receives the tool name, rule, and snippet, and you can return `{ approved: ok }` to allow it.

Can dsh-guardian prevent all security risks?

No. The plugin is a risk reducer, not a complete security solution. All regex and heuristic guards can potentially be bypassed by adversarial examples. It is designed to be used together with human-in-the-loop confirmation and minimal privilege sandboxing. Always follow the principle of least privilege for your agent.

How do I configure the allowed file paths?

You can set the `allowedRoots` option when initializing the plugin. For example: `ctx.plugin(guardian, { allowedRoots: ['/home/user/workspace'] })`. The path sandbox will resolve real paths and only allow access to files under these whitelisted directories.

Does dsh-guardian support detecting secret keys in tool outputs?

Yes, the SECRET engine detects 25+ types of secret keys (AWS, GitHub, OpenAI, Anthropic, Slack, Stripe, etc.) using regex and Shannon entropy filtering. This helps prevent sensitive keys from being leaked through network requests or file writes. The engine is enabled by default when `scanSecrets: true` is set.