dsh-plugin-ctf: A CTF Competition Workbench for DeepSeek Harness

What Does It Do?

CTF Competition Mode is a community DSH plugin for DeepSeek Harness that turns the harness into a workbench for capture-the-flag challenges. It solves the usual CTF pain of scattered tooling, messy evidence chains, and conclusions mixed with guesses, letting you inspect attachments, route tools, review evidence, and keep reproducible records inside one session. Maintained by ClassicXTx under the MIT license, it is validated against DeepSeek Harness 0.2.0-rc.2 and can be installed from the Web or Desktop plugin manager.

Core Features

• Eleven attributed skills: a workbench plus Web, crypto, reverse, pwn, forensics, misc, writeup, evidence review, audio signals, and web state/timing references.
• Evidence review workflow: separates facts, inferences, platform verdicts, and open questions, and keeps a log timeline of evidence status; tool self-checks do not close historical evidence gaps.
• Portable tool configuration: point the config at host Python, a WSL distro, Sage, Pwndbg, TShark, radare2, and other external entry points, reusing your existing local environment.
• Isolated Playwright MCP browser: browser logins stay separate from your daily Chrome, and instructions found in challenge content, web pages, or downloaded source are treated as data to analyze.
• Reproducible output: produces runnable scripts and a reproducible writeup for post-event review and handoff.

How to Use This Plugin?

After enabling it in DSH, start a new session and pick the CTF competition mode to enter the workflow. A typical request puts the attachments in the current working directory, states the allowed challenge targets and flag format, and asks the agent to load ctf-workbench and ctf-evidence-review first, keep originals, do minimal verification, save runnable scripts, and finally report facts, inferences, platform verdicts, and remaining questions separately. External tools such as Python, WSL, Sage, Pwndbg, radare2, and TShark must be installed separately; fill in the example config with real paths and place it in the DSH config directory or point an environment variable at it, then restart. The browser needs a matching Chromium download on first use or an existing browser executable path. Config stores tool paths only, never keys, cookies, or passwords.

How to Troubleshoot This Plugin?

An explicitly specified but missing config file, a misspelled field, or an invalid value raises an error, so fix the path and field names as documented. A resolvable path does not mean the tool is installed, so run the official doctor check and verify the features you need. Desktop commands must come from the dsh bundled with Desktop, since source or npm CLI builds refuse to modify the reserved desktop profile; fully quit Desktop before CLI installs, and run Desktop once first to initialize the profile. If an older package registers the same ctf mode, disable or remove it before installing this one, keeping your existing sessions and shared skills.