dsh-pentest: A Penetration Testing Mode Plugin for DeepSeek Harness

dsh-pentest is a penetration testing mode plugin (DSH plugin) for DeepSeek Harness, maintained by howmp, designed for authorized security testing scenarios. It addresses the problem of systematically recording penetration testing processes within DSH sessions: organizing targets, exploration leads, verification results, assets, and vulnerabilities into traceable exploration chains, and presenting them visually in the web UI through flow, vulnerability, asset, and report views. Core capabilities include a domain model (six tables: goals, intents, facts, findings, assets, edges), eight pentest_* tools, session projection (replaying the graph from logs), and a web interface with four sub-tabs. The plugin is distributed as a self-contained bundle package (@howmp/dsh-pentest) with zero dependencies and a built-in sqlite backend, last updated in 2026-08.

What core features does the dsh-pentest DSH plugin support?

The plugin provides eight tools: pentest_submit (sub-agent writes directly to a parent intent), pentest_add_goal (resets the entire graph), pentest_add_intent, pentest_add_fact, pentest_add_finding (requires reproducible steps, can link affected assets), pentest_add_asset (supports parentId for asset hierarchy), pentest_state, pentest_graph, and pentest_report. The web interface includes four sub-tabs: exploration flow (a graph based on @xyflow/react with relationship capsules on edges), vulnerabilities (severity/description/reproducible steps/affected assets), assets (list and graph modes), and reports (Markdown rendering, copy and save). The system prompt segment pentest:protocol (order 50) specifies advancing along the chain, sub-agents writing directly to parent intents, assets parent-before-child, and all user interactions in Chinese.

How to install dsh-pentest?

Install using the following command, either from a Release URL or a local file:

dsh plugin --profile web add github:howmp/dsh-pentest

Or use the Release asset:

dsh plugin --profile web add https://github.com/howmp/dsh-pentest/releases/latest/download/dsh-pentest.tar.gz

After installation, restart dsh and select the auto-registered "Pentest Mode" in a new session.

How is the architecture and storage of dsh-pentest designed?

The domain model is defined in src/dsh-pentest/src/spec.ts, with storage domain pentest (version 2), containing six tables. Edges represent chain vocabulary: spawns (goal→intent), yields (intent→fact), derived_from (fact→intent), proves (intent→finding), and asset relationships use parent. Node and edge IDs are deterministic in the format <kind>-<n>, counted per session, reset to zero after a goal reset; tools return IDs for model cross-call references. Session projection replays the same graph purely from logs, folding pentest_* calls into { goal, nodes, assets, edges, counts } with a cap of 200 each. Penetration records are written to $DSH_HOME/storages/pentest-sessions.db (sqlite), while other host domains remain unaffected.

What are the known limitations and considerations for dsh-pentest?

The plugin only tests authorized targets; the authorization parameter of pentest_add_goal can be filled with authorization details (authorized entity / written permission reference), which is written into the state and final report as an audit trail, but it is not a gate. Records are scoped to a single session; there is no cross-session or project continuation. Restarting an engagement requires a new pentest_add_goal. The graph layout is static and layered (pan/zoom enabled, nodes not draggable). The project references the ARTEX project.

View more DSH plugins at dsh-plugin.org