dsh-least-privilege: A Least-Privilege Audit Plugin for DeepSeek Harness
feely0208/dsh-least-privilege
A DSH plugin for DeepSeek Harness that audits least-privilege violations—container root/privileged, wildcard IAM, wide-open CORS, and admin-scope tokens—surfacing over-broad permissions before they amplify a breach.
dsh-least-privilege is a permission audit plugin for DeepSeek Harness that targets obviously over-broad authorization patterns in deployment configurations. It addresses a problem with no symptoms: systems keep running normally until an intrusion reveals that one key opens every door. The plugin checks containers running as root or started in privileged mode, IAM policies using wildcard grants, CORS allowing all origins, and tokens requesting admin or full scopes, and it can list every built-in rule, emit a shareable HTML report, and run a demo pass without a real repository. It only reads what is written literally in the repository, so generous permissions without wildcards still need manual review.
How to Install
dsh plugin --profile web add @deepwhale-cn/dsh-least-privilege- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- feely0208
- Distribution
- Plugin
dsh-least-privilege Key Features
dsh-least-privilege Repo Summary
What Does It Do?
Least Privilege Check is a DSH plugin for DeepSeek Harness that audits deployment configurations for obviously over-broad permissions. It solves the problem that excessive privilege has no symptoms — systems keep running normally until an intrusion turns a small foothold into host-level access. The plugin is maintained by feely0208, written in Shell, released under the MIT license, and last updated on 2026-10-13.
Core Features
- High-severity checks: flags containers running as root or started with
--privileged, plus IAM policies usingAction: *wildcards. - Medium-severity checks: flags CORS configurations that allow all origins and tokens requesting admin or full scopes.
- Rule listing: exposes the full set of built-in rules so you can review what is covered before scanning.
- Report output: generates an HTML report that turns scan results into a document you can share directly.
- Demo mode: runs a demonstration pass so you can see the check flow without pointing it at a real repository.
How to Use This Plugin?
After enabling it in DSH, run the demo mode first to see how the checks and output look, then list the rules to confirm which permission items are covered, and finally scan your target repository and emit an HTML report. It only catches obviously over-broad patterns written literally in configs; permissions that are merely generous without wildcards still need manual review. It also does not resolve what a cloud provider actually enforces, since IAM involves inheritance, conditions, and boundaries. In multi-stage Dockerfiles, USER root in the builder stage is usually harmless and requires your own judgment. It complements data-scanning plugins: those inspect data, this one inspects who can access that data.
How to Troubleshoot This Plugin?
If a scan flags USER root in a multi-stage Dockerfile, first check whether the instruction sits in the builder stage or the final runtime stage — builder-stage usage is usually harmless and can be treated as a false positive. If IAM findings disagree with what is actually enforced in production, that falls within the plugin's stated boundary of reading only literal repository content, so review it against your provider's inheritance, condition, and boundary policies. Configurations that are generous but avoid wildcards will not be flagged and need a separate manual review.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: feely0208/dsh-least-privilege. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.