dsh-cn-compliance: An Outbound Content Compliance Skill for DeepSeek Harness

What Does It Do?

It is a DSH plugin for DeepSeek Harness that audits outbound content for mainland China compliance before publication, delivered as a skill. It solves the problem of discovering violations only after a page goes live, helping teams avoid blocked filings, taken-down pages and administrative penalties. Maintained by feely0208 under the MIT license and written in Shell, it ships with a scanning script that runs against local directories and live sites.

Core Features

• Tiered risk checklist: covers categories A through I, including network-tool wording, advertising superlatives, absolute promises, map and territory integrity, data and privacy commitments, AI-generated content labeling, qualifications and filings, competitor disparagement, and internal files exposed publicly.
• Context-aware matching: terms like tunneling and penetration are flagged only when network context co-occurs, and 100% is reported only before marketing adjectives, so CSS keyframes and UI terminology do not drown the report.
• Noise exclusion: skips dependency folders, bundled runtime directories, build artifacts, binaries and third-party scraped content.
• Multiple scan modes: scan the current directory, a given directory, documentation only, live pages, or a combined local plus docs plus online plus internal-path probe.
• Exit-code gate: returns 0 when clean and 1 on hits, so it can block a CI or pre-release step directly.
• Configurable scope: environment variables add the site root, extra documentation directories and extra internal paths.

How to Use This Plugin?

After enabling it in DSH and restarting, the skill becomes available whenever the agent needs it, and the skill body provides the absolute path of the scanning script. In practice you run the scan inside the project you are about to publish; for public repositories, use the documentation-only mode to avoid technical-term false positives in source code. Before release, run it once more against the live site, since a clean local tree does not guarantee a clean deployment. Widen coverage by supplying the site root, extra documentation directories and extra internal paths, then use the combined mode. To make compliance a hard gate, rely on the exit code inside CI. The plugin only checks local files and the specified site, never fetching word lists online, and it deliberately ships no political sensitive-word list, so category C still needs human review or a third-party tool.

How to Troubleshoot This Plugin?

If the scan reports many suspected false positives, first check whether the context rules apply: tunneling and penetration terms are risky only when network context such as intranet, network, port, proxy, routing or NAT co-occurs, and 100% is reported only before marketing adjectives; if a hit remains, verify the term and its surrounding context against the official instructions. When an online scan returns nothing or errors out, confirm the site root variable is set, since it is required in online and combined modes. If hits cluster in third-party content, check that dependency folders, runtime directories, build artifacts and binaries are excluded, and switch to documentation-only mode when needed.