Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsDSH Plugin Scanner
Scan a DeepSeek Harness plugin for security red flags before installing it: install scripts, risky imports, missing metadata, suspicious dependencies. Local-first, stdlib-only.
Free
DSH Plugin Scanner
Example session with this skill installed
Scan the DSH plugin located at ./plugins/weather-fetcher and show the security report.
- Read your context and instructions
- Compiled the dsh plugin scanner
The scan for the weather-fetcher plugin is complete. I have identified two yellow warnings related to filesystem access and missing metadata.
Security Scan Report: weather-fetcher
| Category | Status | Finding | Location |
|---|---|---|---|
| Install Scripts | PASS | No pre/post install hooks found | package.json |
| Risky Imports | WARN | Restricted fs module usage detected | src/index.js:14 |
| Metadata | WARN | Missing dsh.plugin field | package.json |
| Dependencies | PASS | No suspicious packages identified | package.json |
| Source Safety | PASS | No usage of eval() or child_process | src/ |
Scan Verdict: YELLOW (Warnings Found)
The plugin is generally safe but lacks required DSH metadata and accesses the filesystem. Ensure the filesystem access is restricted to the plugin's data directory.
Next steps
- Add the
dsh.pluginobject topackage.jsonto ensure harness compatibility. - Review line 14 in
src/index.jsto verify thefscall is necessary for weather caching. - Run with
--jsonif you need to pipe these results into a pre-commit hook.
Connects securely to your tools. The creator never sees your data.
About this skill
Auditing third-party plugins for DeepSeek Harness (DSH) shouldn't involve running them first. This skill provides a local-first security scanner that identifies red flags in plugin code and metadata before you commit to an installation.
What it does
- Script Analysis identifies
preinstall,postinstall, andpreparehooks inpackage.jsonthat could execute arbitrary code. - Risky Import Detection flags usage of
child_process,eval,Function(), and unrestricted filesystem calls in the source. - Metadata Validation checks for the existence of
dsh.plugindefinitions, repository links, and valid licenses. - Dependency Auditing cross-references packages against known high-risk dependencies that utilize aggressive install scripts.
- Topic Signaling optionally verifies if a public repository is correctly tagged with the
dsh-plugintopic for authenticity.
How it works
- Point the scanner at a local directory containing the DSH plugin you want to audit.
- Run the scan command to initiate the static analysis process across all source and configuration files.
- Review the color-coded report (Green, Yellow, Red) which maps findings to specific file paths and line numbers.
- Output results in CLI format for human review or JSON format for CI/CD integration.
Frameworks & tools
This tool is built for the DeepSeek Harness ecosystem. It is a local-first utility written in Python using only the standard library.
Why this beats prompting it yourself
Manual code review often misses buried install scripts or obfuscated imports in complex dependency trees. This skill automates the detection of specific DSH-related security anti-patterns with consistent exit codes for automated workflows.
Use cases
- Audit a DSH plugin downloaded from a public repository before local installation.
- Integrate security linting into the development lifecycle of a new DSH plugin.
- Sanity check suspicious dependencies in a plugin's
package.jsonfile. - Verify that a plugin meets the metadata requirements for the DeepSeek Harness.
Known limitations
The scanner performs static analysis only. It does not execute code, handle obfuscated dynamic imports, or make network calls by default.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Code Quality & Review.
Static analysis only. Cannot detect runtime behavior or obfuscated code. Topic check requires network which is disabled by default.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free to use
No account required to browse
Trust & safety
Security scan
Security scan passed today
- Free with an Agensi account
Static analysis only — it reads package.json and source files, it does not execute the plugin. A clean scan means no known red flags, not a guarantee of safety. Review the plugin's repository before installing.