dsh-riskproof: A Risk-Aware Approval Layer for DeepSeek Harness Tool Calls

What Does It Do?

RiskProof is a DSH plugin for DeepSeek Harness that provides a risk-aware approval layer for high-risk AI Agent tool calls. It addresses the problem of unknown data provenance and cross-tool data flows that may leak sensitive information, intercepting or asking before side effects execute. Core capabilities include tracking data origin, labeling sensitive data, detecting attack chains, and blocking dangerous operations via the native pre-execute gate.

Core Features

• Track data origin: maps tool arguments back to the tool results that produced them.
• Follow sensitive data: carries security labels (UNTRUSTED_WEB, CUSTOMER_DATA, PII, SECRET) across tool calls additively.
• Detect attack chains: identifies the EXTERNAL_INGESTION → PRIVATE_ACCESS → EXTERNAL_ACTION pattern that single-tool checks miss.
• Stop before execution: blocks or asks before the side effect runs through the native tools/pre-execute gate.
• Guard sensitive surfaces: protects credential-file paths, high-confidence destructive commands, download-and-execute pipelines, blocked destinations, and credentials embedded in network-capable commands.

How to Use This Plugin?

After enabling it in DSH, RiskProof acts as an observation and decision layer over the DSH Tool Runtime, silently tracking context and only asking or blocking when a risky cross-tool flow appears. The default configuration is safe; you can tune it by overriding the bundled row from the profile's later cordis.patch.yml layer, adjusting mode (enforce/observe), policy preset (permissive/balanced/strict), and domain whitelist/blacklist. Run npm run demo to experience the real ToolRuntime pipeline locally without a model or profile.