{
  "name": "dsh-skill-pack-security",
  "version": "2.2.8",
  "private": true,
  "description": "Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning / malicious patterns / five-dimension risk card) with findings that cite the matching skill sections.",
  "license": "Apache-2.0",
  "type": "module",
  "scripts": {
    "check:readmes": "node scripts/check-readme-sync.mjs"
  },
  "engines": {
    "node": "^22.19.0 || >=24.0.0"
  },
  "packageManager": "pnpm@11.7.0",
  "keywords": [
    "dsh",
    "dsh-plugin",
    "deepseek-harness",
    "skill-pack",
    "skills",
    "security",
    "security-audit",
    "supply-chain",
    "plugin-vet",
    "gate"
  ],
  "repository": {
    "type": "git",
    "url": "git+https://github.com/PerryLink/dsh-skill-pack-security.git"
  },
  "dependencies": {
    "@perrylink/dsh-skill-pack-security-provider": "2.2.8"
  },
  "peerDependencies": {
    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.2-rc.1 <0.2.0"
  },
  "dsh": {
    "bundle": {
      "patch": "./provider/cordis.patch.yml"
    }
  },
  "dshWorkshop": {
    "schema": "omdsh-workshop-package/v1",
    "type": "plugin",
    "integration": {
      "protocol": "harness-profile",
      "artifact": "provider/cordis.patch.yml"
    },
    "install": {
      "mode": "transactional",
      "adapter": "profile-bundle",
      "failurePolicy": "generation-rollback",
      "touchesCurrentBeforeActivation": false
    },
    "lifecycle": {
      "activation": "restart-profile",
      "dispose": "supported"
    },
    "permissions": [
      "files:read",
      "network:fetch"
    ],
    "compatibility": {
      "dshVersions": [
        "0.1.2-rc.1"
      ]
    },
    "capability": {
      "id": "skill-pack-security",
      "kind": "tool-bundle+provider",
      "invocation": "boot the RC.6 candidate Profile with the bundle mounted (config.language zh|en), call ctx.skills.get('security-audit') through the @deepseek-ai/dsh-skill-filesystem provider contract, and execute the plugin_vet tool against a GitHub owner/repo target",
      "expected": "ctx.skills.get('security-audit') resolves the mounted edition AND ctx.tools has plugin_vet, whose report cites skill sections for manual follow-up"
    },
    "evidence": {
      "install": null,
      "failureIsolation": null,
      "hotReload": null,
      "remove": null
    }
  },
  "funding": {
    "type": "individual",
    "url": "https://github.com/sponsors/PerryLink"
  }
}