dsh-ai-output-trust: A Security Check for the AI Output Trust Boundary in DeepSeek Harness
feely0208/dsh-ai-output-trust
A DSH plugin that scans code for unsafe execution of AI output — eval, shell, SQL and path injection — catching prompt-injection-driven code execution before runtime.
dsh-ai-output-trust is a security check plugin for DeepSeek Harness that finds places where model output is executed as if it were trusted input. It targets the pattern of letting a model generate a snippet and running it as-is, since AI output can be steered by prompt injection or simply go off script, which amounts to handing arbitrary code execution to a probabilistic model, listed by OWASP as LLM05 Improper Output Handling. The plugin reports findings at critical and high levels across eval and dynamic function construction, command concatenation, SQL concatenation, and path traversal, and it can list rule rationales and produce an HTML report.
How to Install
dsh plugin --profile web add @deepwhale-cn/dsh-ai-output-trust- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- feely0208
- Distribution
- Plugin
dsh-ai-output-trust Key Features
dsh-ai-output-trust Repo Summary
What Does It Do?
AI Output Trust Boundary is a DSH plugin for DeepSeek Harness that checks whether your code executes AI output directly as trusted input. It targets the risky pattern of letting a model generate a snippet and running it as-is: AI output is untrusted input that can be steered by prompt injection or simply go off script, which amounts to handing arbitrary code execution to a probabilistic model. OWASP lists this as LLM05 Improper Output Handling. The plugin is maintained by feely0208, released under the MIT license, written in Shell, and last updated on 2026-10-13.
Core Features
- Critical detection: flags
eval(aiResponse)andnew Function(...)style execution of AI output. - Command injection detection: flags AI output concatenated into
exec/spawncalls. - High-severity detection: flags AI output concatenated into SQL, and file paths taken from AI output that enable path traversal.
- Precise naming instead of keyword matching: it identifies AI output by variable naming (
ai*/llm*/model*) rather than reporting every.content, so code that parses model output and validates it against a schema is not flagged. - Inspectable rules: it can list every rule together with its rationale, making it easy to map findings back to OWASP LLM risks.
How to Use This Plugin?
After enabling it in DSH, run the check against your target code and you get findings grouped by severity, with critical and high items covering the eval, shell, SQL, and path categories. A demo mode shows what detection looks like, a rule listing explains the basis for each check, and an HTML report can be produced when you need to hand results to someone else. Keep variable naming consistent, or naming-based rules will miss cases; the plugin only covers these four explicit high-risk usages, performs no data-flow analysis, and does not handle other indirect-trust scenarios. It complements dsh-ci-guard, which scans GitHub Actions script injection, while this one looks at runtime.
How to Troubleshoot This Plugin?
If a risk you expected is not reported, inconsistent variable naming is the usual cause, since the plugin identifies AI output by name; standardize on ai* / llm* / model*. If something you consider safe is flagged, first confirm whether that spot really passes AI output straight into execution, a query, or path concatenation, as the plugin only inspects the call site and does no data-flow analysis.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: feely0208/dsh-ai-output-trust. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.