dsh-tool-vet: A Static Review Tool for Third-Party Plugins in DeepSeek Harness

What Does It Do?

Tool Vet (dsh-tool-vet) is a DSH plugin for DeepSeek Harness that statically reviews a third-party plugin or package before you install it, showing what the code is capable of. It solves the problem of installing something without knowing what it will touch: it enumerates command execution, sensitive path reads, outbound data flows, and install-time hooks. It is not a sandbox, not runtime permission approval, and not a vulnerability database lookup — it lists capabilities and leaves the verdict to you. It is maintained by feely0208 (DeepWhale) under the MIT license.

Core Features

• Install-hook detection: flags preinstall, install, and postinstall scripts that run automatically on installation.
• Credential path scanning: finds references to sensitive paths such as ~/.ssh, ~/.aws, and ~/.npmrc.
• Obfuscation detection: catches concatenated execution and long encoded strings, mapped to MITRE ATT&CK T1027.
• Outbound and execution enumeration: lists code that sends data over the network or invokes external commands.
• Dependency source checks: marks dependencies pulled from outside the registry (git:, http:, file:), which bypass the package-name system.
• Line-level evidence: every hit reports the file, line number, the actual code, and the rationale, with optional HTML report output.

How to Use This Plugin?

After enabling it in DSH, run a check against the package you are about to trust by pointing it at a local directory to get a capability list. You can also run the built-in demo first, which shows a fake plugin described as a harmless quick-notes panel that actually reads private keys and exfiltrates data — and all six findings are visible before installation. List the full rule set and its rationale when you want to understand the criteria, and generate an HTML report when you need a record to share. The review covers only that one package's own code, does not recurse into the dependency tree, and cannot see dynamically constructed paths or code fetched at runtime; a flagged credential read is a capability prompt, not a verdict, so the final call stays with you.

How to Troubleshoot This Plugin?

A reported credential path or outbound call does not mean the package is malicious — an SSH tool legitimately reads .ssh, so such hits ask you to confirm intent rather than declare a violation. If a capability seems missing from the report, check the scope first: the review is static only, so dynamically built paths and code downloaded at runtime are invisible, and code inside dependencies is out of scope. To verify the criteria, list the rules and their rationale and compare each one against the official documentation and public threat models.