sashankh/dsh-taintguard
Indirect prompt-injection guard for DeepSeek Harness: taints tool output by origin, gates privileged calls that follow untrusted content, and refuses credentials heading off the machine.
About this plugin
An agent that browses the web or reads a repository puts third-party text into the same channel that carries its operator's instructions. A model has no reliable way to tell them apart, so a page, a README, or an MCP tool result can ask the agent to run a command or post a file somewhere. This plugin does not try to make the model immune to that. It narrows what the retrieved text can reach: it marks the agent once a tool result arrives from an untrusted source, gates the privileged calls that f
$ dsh plugin --profile web add dsh-taintguard$ dsh plugin --profile web add github:sashankh/dsh-taintguardHealth breakdown
55 / 100Score reflects license, community signals, documentation and distribution. It is not a code audit — review the source before installing.
Security
Key metrics
Related
Related plugins
[!WARNING] 📌 Announcement (v1.2.3) v1.2.3 fixes DSH Desktop's re-appearing first-run dialog: the onboarding "seen" flag and the model-guide step now persist in the profile settings file instead of origin-scoped localStorage, which a random per-launch port (--port 0) wiped on every boot (issue #78). v1.2.2 closed the last attachment-id gap — ids announced for images the host persisted itself (e.g. readimage re-uploads, sha256:…) now resolve in visiondescribe and every pixel tool (issue #72) — st
Hash-anchored read / edit / batch_edit / undo_last_edit tools: every line gets a unique 3-character content hash, edits target hashes instead of line numbers, and served-state verification rejects stale ranges with fresh anchors.
HeartFlow (心虫) AGI layer-1 discriminator gate as a DSH plugin: 47-dimension rule-based text checking (heartflow_check tool) plus automatic output supervision at tools/post-execute, fail-closed when engine missing.
Tell your agent what you want ("notify me on WeChat when a task finishes"), and it searches the DSH plugin ecosystem on GitHub for you — top results by stars, each with a one-line description and an install command.
Deep-read a book or an article: extract core claims, argument structure, and key evidence into a structured "claim–evidence–data–relation" report. Official bundle plugin: the Node half registers the deepread tool, the client half provides the result card and the reading bar in the input area.
New in v0.2.8 — one-command install: the package now ships a bundle layer, so dsh plugin --profile web add dsh-extension-hub wires the plugin row into your profile automatically (no more manual cordis.patch.yml edits in the quick start). New in v0.2.7 — the Add-ons block now also carries dsh-recall: conversation history recall for DSH — literal/fuzzy/semantic retrieval over every past session, fully local & offline. New in v0.2.6 — A curated plugin store inside DSH: browse 400+ community-curated