DeepSeek Harness Plugin Security Checklist
Treat every plugin as executable code with the process and profile's authority. Pin reviewed source, inspect lifecycle scripts and requested tools, and prevent a second copy of @deepseek-ai/dsh-tools from being bundled or installed inside the plugin because rc.7's module-private tool metadata can then fail identity checks.
Sharing includes the public link only, without local progress or private configuration.
Review before installation
Inspect the package identity, source repository, exact tag or commit, manifest, prepare/install scripts, transitive dependencies, requested environment variables and network behavior. A profile boundary is not a substitute for reviewing code that will execute in the same process.
Prefer a locked dependency graph and a disposable profile. Never approve allowBuilds simply to make an error disappear; inspect the blocked lifecycle script and preserve a rollback path first.
- Pin the plugin source and record the reviewed commit.
- Reject unexpected credential access, subprocesses, network destinations or broad workspace access.
- Install without production credentials, then inspect the resulting dependency tree.
Duplicate core package failure
In rc.7 tagged source, tool preparation metadata is stored under a module-private Symbol and the agent loop reads that metadata before prepare(). Open Discussion #1697 reports that a plugin carrying a second copy of @deepseek-ai/dsh-tools can produce undefined metadata and make tool calls fail.
This is an open community report, not a publisher-confirmed fix. The source path supports the identity-mismatch mechanism; it does not establish that every plugin failure has this cause.
- If the error reads Cannot read properties of undefined (reading 'prepare'), inspect duplicate package copies first.
- Plugin authors should make the shared core package a compatible peer dependency rather than bundle a private copy.
- Reinstall in a clean disposable profile and verify one minimal tool call before restoring other plugins.
Verification record
Record the exact dsh version, plugin version, package manager lockfile and sanitized dependency path. A successful repair requires the minimal tool call to complete, not merely the plugin to appear in a list.
- Do not paste package-registry tokens or private repository URLs into a report.
- Distinguish source-supported mechanism, community reproduction and upstream fix status.
- Repeat the check after every plugin or rc upgrade.
First-party sources
Open the pinned or retrieved source before acting on a changed release candidate.
Community reports
These are open user reports hosted in the official repository. They are not publisher confirmation and have not been independently reproduced by this guide unless a separate local reproduction is linked.