dsh-cn-pipl-check: A DSH plugin for DeepSeek Harness that Compares Privacy Claims with Code

What Does It Do?

It is a DSH plugin for DeepSeek Harness that puts the promises in a privacy policy side by side with what the code actually does. It targets the most common reason apps get rejected from app stores: the policy says location is not collected while the code holds a location permission, or the policy promises easy account deletion while the app offers no entry point. Delivered as a skill, it first runs a forensic script that scans permissions, third-party SDKs, user-rights entry points and outbound domains, then produces a comparison table across six mandatory checks, leaving the qualitative judgement to humans and reviewers. It is maintained by feely0208 under the MIT license and written in Shell.

Core Features

• Permission minimality check: questions each permission for an indispensable feature, a reasonable request timing and a stated purpose.
• Third-party SDK inventory matching: aligns the statistics, push, map, payment and ad SDKs actually present in the build with the list written in the policy.
• User-rights entry point review: verifies operable entries for access, copy, correction, deletion, account cancellation and consent withdrawal.
• Sensitive-data separate consent detection: checks whether face, fingerprint, location trail, medical, financial and under-14 data get a dedicated dialog instead of being buried in the general agreement.
• Data export and promise traceability: shows whether outbound domains and vendors sit inside or outside the country, and whether each concrete policy promise maps to an implementation.
• Forensic output: scan results carry file names and line numbers, giving facts rather than conclusions, plus a list of items requiring human judgement.

How to Use This Plugin?

After enabling it in DSH and restarting, the skill becomes available whenever needed; simply ask the agent to run a personal information protection comparison. It first runs the forensic script to scan permissions, SDKs, rights entry points, outbound domains and the privacy policy location, then walks through the six mandatory checks one by one, and finally produces a comparison table plus a list of items needing human judgement. You can also run the script yourself by pointing it at the app directory and the privacy policy file; the script path is injected into the skill text at registration time or can be found in the skill directory of the install location. The skill text repeatedly stresses that "not found does not mean absent" and that a cross mark only means no match, so every conclusion must be confirmed by hand. It is deliberately kept separate from neighbouring skills covering copy red lines, AI labelling and release self-checks, because its job is whether what is said matches what is done.

How to Troubleshoot This Plugin?

A cross mark in the scan output does not mean the item is truly missing; it only means the script found no match, and the feature may use another name or live on the server side, so confirm each case by hand. The same applies when a permission or SDK is not found: do not conclude it is absent, but re-check against the business scenario and the implementation. Do not rely on script output for qualitative conclusions, since compliance judgement depends on the business context, whether consent was genuinely obtained and the regulator's stance; a report that looks authoritative while guessing at conclusions is more dangerous than no report at all.