dsh-content-trust: An External Content Trust Boundary Checker for DeepSeek Harness

What Does It Do?

External Content Trust Boundary (dsh-content-trust) is a DSH plugin for DeepSeek Harness that checks whether an agent has treated content from web pages, files, or email as instructions to follow. It targets indirect prompt injection, the Indirect branch of OWASP LLM01: an attacker hides a line on their page, the agent fetches it, it gets concatenated into the prompt, and the model complies while the user has no idea. The plugin reports findings in severe, high, and medium tiers and shows the correct isolation pattern. It is maintained by feely0208 under the MIT license and was last updated on 2026-10-13.

Core Features

• Tiered findings: extracting and executing instructions found in external content is severe; external content entering the prompt without isolation, or user credentials injected into the agent browser, is high; concatenation without delimiters or source labels is medium.
• Rule listing: a built-in rule set can be listed in full so you can check it against your own concatenation code.
• Page and file scanning: run checks directly against fetched HTML files to locate where external content enters the prompt.
• Demo mode: a demo run shows how it judges before you wire it into your own flow.
• Correct-practice guidance: it demonstrates declaring external content as reference-only in the system prompt and restricting actions to a whitelist.
• Split from output-side checks: this plugin inspects trusted input (external content), while dsh-ai-output-trust inspects trusted output (AI-generated).

How to Use This Plugin?

After enabling it in DSH, run the demo once to see how it judges, then list the rules to check coverage against your own setup, and finally scan the page files you actually fetch. Results come back in three severity tiers: severe means instructions inside external content were executed as commands, high means external content reached the prompt without isolation or credentials were injected into the agent browser, and medium means concatenation lacked delimiters and source labels. The fix is to add delimiters and source labels around external content, state in the system prompt that it is reference-only and its instructions must not be executed, and allow only whitelisted actions. Know the boundaries: file-level exclusion can miss cases where one file mixes compliant and violating usage, detection relies on variable naming, and there is no data-flow analysis. The real defense is architectural, splitting reading external content and executing actions into components with different trust levels.

How to Troubleshoot This Plugin?

Missed detections are the most common report: if one file contains both compliant and violating usage, it may be skipped entirely by file-level exclusion, a trade-off made to reduce false positives, so split the file and check the parts separately. When nothing is flagged, first confirm variable naming is consistent, since inconsistent names cause misses. If you suspect a cross-step data-flow issue, this plugin does not perform data-flow analysis, so move the fix to the architecture level and separate trust levels.