跳到主要内容
dsh marketplace

dsh-correctover

已验证

dsh-correctover · v1.0.2 · LicenseRef-Proprietary

Correctover runtime security for DeepSeek Harness (DSH): CCS 7-dimension verification, command-injection/SSRF/credential-exfil blocking, Ed25519 receipts, audit-first. Install with `dsh plugin add dsh-correctover`.

安装

dsh plugin add dsh-correctover

用 dsh --profile default --dump-config 确认 layer 已生效 —— 参见安装指南。

源码

发布到 npm 但没有公开仓库。安装前请检查包内容。

标签

说明文档

dsh-correctover

Runtime security for DeepSeek Harness (DSH) — CCS 7-dimension verification, command-injection / SSRF / credential-exfiltration blocking, Ed25519 receipts, audit-first.

Install

dsh plugin add dsh-correctover

Or with npm directly:

npm install dsh-correctover

What it does

Once installed in a DSH profile, the plugin auto-mounts and registers:

  • ccs_status model tool — report current policy and live stats
  • ccs_audit model tool — run a security audit on installed plugins
  • tools/pre-execute hook — block dangerous tool calls
  • tools/post-execute hook — scan outputs for leaked secrets / prompt injection
  • subprocess spawn wrapper — block command injection and credential exposure
  • web fetch wrapper — block SSRF to private / link-local networks

It is audit-first: by default it observes and logs, never blocks. Switch to enforce mode when you have tuned rules against real traffic.

CCS standard

CCS (Correctover Conformance Shape) is a 7-dimension runtime verification standard for AI agents: Structure, Schema, Latency, Cost, Identity, Integrity, Security. Published as IETF Internet-Draft draft-correctover-ccs.

Links