Dsh Poison Guard
zoahdev/dsh-poison-guard · skills
Pre-install supply-chain poison scanner for DeepSeek Harness plugins: AST (JS-X-Ray) + deobfuscation + regex.
★ 2GitHub stars
0Forks
2026-08-25Last updated
JavaScriptLanguage
MITLicense
Key features
- Pre-install supply-chain poison scanner for DeepSeek Harness plugins.
- No static tool can catch all poisoning.
- Rules are prefixed by layerast/ (JS-X-Ray), deobfuscated- (decoder), install-script (manifest), and unprefixed (regex fallback).
- A regex scanner misses everything below because there is no literal string to match
- It is not a toy regex grepit runs three layers on every plugin before you dsh plugin add it
Requirements
- Static only — does not execute the plugin or observe runtime behavior.
- Obfuscation can be made undecidable
Install command
dsh plugin --profile web add github:zoahdev/dsh-poison-guard