dsh-consent-guard: A User Consent Compliance Checker for DeepSeek Harness

What Does It Do?

Consent Guard is a DSH plugin for DeepSeek Harness that audits how user consent and authorization are implemented in code. It targets the common violations found on signup pages and pop-ups — pre-ticked boxes, bundled consent, and no way to withdraw — all of which carry explicit requirements under China's Personal Information Protection Law, where regulators typically treat pre-ticked consent as a direct violation. Maintained by feely0208 under the MIT license, it is written in Shell and was last updated on 2026-10-13.

Core Features

• Pre-ticked box detection: flags checkboxes where doing nothing counts as consent, mapped to PIPL Article 14 and GDPR Recital 32 as a high-severity finding.
• Missing consent mechanism detection: catches code that collects personal information without any consent step, per PIPL Articles 13 and 17.
• Bundled consent detection: identifies privacy policy (necessary) and marketing (non-necessary) merged into a single checkbox, per PIPL Articles 16 and 17.
• Withdrawal entry detection: checks whether users have any way to withdraw consent, per PIPL Article 15.
• Rule listing and report output: lets you list every check rule, or run the audit against a specific HTML file.

How to Use This Plugin?

After enabling it in DSH, run the check against your target page code — use demo mode to see the rules in action, or list-rules mode to review exactly what it inspects. For a specific page, hand it the HTML file and it will analyze it. It only reads code, not the live interface, so whether a pop-up actually appears and whether users can understand it still needs human verification; a withdrawal entry may live on the server side or in another repository, so those findings are prompts to confirm; and whether a given collection is "necessary to provide the service" is a legal judgment the plugin does not make. It differs from dsh-cn-pipl-check: that one walks through PIPL article by article, while this one focuses solely on consent mechanics and goes deeper.

How to Troubleshoot This Plugin?

When the plugin reports a missing withdrawal entry or collection without a consent mechanism, treat these as weak signals — the withdrawal entry may sit on the server side or in another repository, so the finding is a prompt to confirm rather than a confirmed violation. The plugin only reads code and not the live interface, so whether a pop-up truly appears and whether users can understand it requires manual verification. Whether a given collection counts as "necessary to provide the service" is a legal judgment the plugin does not make, so handle it per the official instructions alongside your actual situation.