![DSH Skill Security Inspector](assets/banner.png)

# DSH Skill Security Inspector

English | [简体中文](README.md)

A standalone security inspection plugin that can be installed directly into a DeepSeek Harness (DSH) Web profile. Before installing or using an untrusted Skill, it runs deterministic checks locally in the browser and lets the user decide whether to request a structured second review from a model already configured in DSH. Its inspection approach and coverage were informed by Cisco's [skill-scanner](https://github.com/cisco-ai-defense/skill-scanner).

> ⚠️ `no-known-risk` only means that the current rules found no known issue. It is not a safety guarantee. Rule matching cannot cover every semantic variation, so important Skills still require human review.

## Features

- A dedicated entry in the main sidebar.
- Folder and ZIP inspection without installing, importing, or executing uploaded code.
- Local deterministic rules for prompt injection, secret exfiltration, dangerous commands, credentials, data exfiltration, obfuscation, supply-chain risks, and permissions.
- The latest three inspection reports are kept in the current browser; raw files and model-review excerpts are not stored.
- Model review is off by default and must be started explicitly.
- Configurable model, reasoning effort, Chinese or English prompt, review scope, and character budget.
- The model must classify every deterministic finding as confirmed, false positive, or uncertain and report novel risks separately.

## Quick start

The repository includes runnable `lib/` bundles, so no dependency installation or local build is required. Clone it and pass its absolute path to DSH with `file:`:

```bash
git clone https://github.com/kakapengta/DSH-Skill-Security-Inspector.git

cd /ABSOLUTE/PATH/TO/deepseek-harness
pnpm dsh plugin --profile web add file:/ABSOLUTE/PATH/TO/DSH-Skill-Security-Inspector
pnpm dsh --profile web --port 3080
```

Normal launches require only the final command. After updating this plugin repository, run `plugin add file:...` again and restart DSH so the profile refreshes the prebuilt package.

## Usage

1. Open **Skill security** from the DSH main sidebar.
2. Drop a Skill folder or ZIP into the workspace.
3. Select **Start local inspection** and review the deterministic findings.
4. If semantic review is needed, enable model review, confirm the model, language, scope, and estimated tokens, then start the review explicitly.
5. Export a JSON report or revisit one of the latest three reports under **Recent inspections**.

Use [`tests/fixtures/all-rules-skill`](tests/fixtures/all-rules-skill) to exercise every current content rule and [`tests/fixtures/missing-root-skill`](tests/fixtures/missing-root-skill) to verify the missing root `SKILL.md` check. Fixture content is read only as inert text and is never executed.

### All-rules fixture result

![all-rules-skill inspection result](assets/all-rules-scan-result.jpg)

## Inspection coverage

| Category | Examples |
|---|---|
| Skill structure | Missing root `SKILL.md`, sensitive package files |
| Prompt injection | Overriding higher-level instructions, fake system/developer roles, jailbreak modes |
| Credential risk | Hardcoded tokens, private-key headers, `.env`/SSH/cloud credential access |
| Dangerous commands | Download and execute, dynamic code, recursive deletion, unsafe permission changes |
| Data exfiltration | Webhooks, tunnels, reverse shells, sending local data remotely |
| Obfuscation | Base64 decode-and-execute, PowerShell encoded commands |
| Supply chain | `latest`, main-branch URLs, unpinned installs |
| Permissions | Unrestricted filesystem, shell, network, or tool access |

Rules live in [`src/scanner.ts`](src/scanner.ts), with exact regression assertions in [`tests/scanner.client.spec.ts`](tests/scanner.client.spec.ts).

## Two-phase architecture

```text
Untrusted Skill
      │
      ▼
Local browser rules ──► Unified, redacted findings
      │
      └── Explicit user approval and scope ──► Structured DSH model review
                                                     │
                                                     ▼
                                      Verdicts + novel risks + JSON report
```

The default smart scope includes root `SKILL.md`, windows around deterministic findings, and short script prefixes, capped at 8,000 characters. Credential-like filenames are excluded, and recognized tokens and private-key content are redacted.

## Privacy and local history

- Deterministic inspection runs entirely in the browser.
- No Skill content is sent while model review is off.
- Local history stores at most three entries containing report metadata, redacted findings, and model conclusions.
- Raw file bytes, full Skill text, and model-review excerpts are never written to history.
- History uses browser `localStorage` and can be cleared from the interface.
- `no-known-risk` is advisory and does not guarantee safety.

## Project structure

```text
.
├── .github/workflows/     # Repository safety checks
├── assets/                # README image assets
├── lib/                   # Prebuilt Host and browser bundles
├── licenses/              # Required licenses for bundled dependencies
├── src/                   # TypeScript/React source and rules
├── tests/                 # Unit tests and inert attack fixtures
├── CHANGELOG.md           # Release history
├── cordis.patch.yml       # DSH Host plugin overlay
├── package.json           # DSH plugin manifest
├── README.en.md           # English documentation
└── README.md              # Chinese documentation
```

## Limitations

- The current version does not include YARA, bytecode disassembly, PDF/Office extraction, full AST dataflow, OSV, VirusTotal, or sandboxed behavioral analysis.
- ZIP64 and encrypted ZIP files are rejected; other archive formats must be extracted before inspection.
- Unsupported binary or over-limit content makes the result inconclusive.
- **Rule matching cannot cover every semantic variation; important Skills still require human review.**