dsh-plugin-ccs

dsh-plugin-ccs

CCS Runtime Security Guard for DeepSeek Harness — not a static scanner. Every tool call, subprocess, and fetch is inspected at runtime before execution.

Why this exists

DeepSeek Harness exploded to 70k+ stars in days. Community plugins run in-process with full privileges. The official security note says: "entering the plugin marketplace does not mean passing a security audit." Black-market plugins are already appearing — stealing API keys, injecting backdoor prompts, and downloading trojans.

The existing dsh-plugin-vetting does static regex scanning — and its own README admits:

"this scanner is a HEURISTIC TRIPWIRE, not a security boundary"

Static scanning can't see runtime behavior. A plugin that loads a payload from a URL and eval()s it will pass every static check.

dsh-plugin-ccs enforces security at runtime, not just in source files.

What it blocks

Threat	Dimension	How
SSRF (fetch to 169.254.169.254, localhost, internal IPs)	Security	Validates every URL in tool args and fetch calls — covers IPv4/IPv6, decimal/octal/hex encoding, DNS resolution
Command injection (reverse shells, curl | sh, rm -rf /)	Security	Inspects subprocess argv against 25+ attack patterns
Credential exfiltration (API keys in network calls, reading ~/.ssh/)	Security	Scans arguments for secret patterns; blocks credential file reads by read-type tools
Destructive tool auto-approval (pay, delete, deploy, transfer)	Security	Destructive tool names require explicit human approval; auto-approve is denied
Path traversal (../../etc/shadow)	Security	Detects traversal patterns targeting sensitive system paths
Prompt injection ("ignore previous instructions", fake system tags)	Integrity	Scans both inputs and outputs (fetched web content) for injection patterns
Secret leakage in outputs (tokens returned to model)	Integrity	Scans tool results for credential patterns

Install

dsh plugin --profile web add dsh-plugin-ccs

Or add to your profile patch:

- insert:
    - id: ccs-guard
      name: dsh-plugin-ccs
      config:
        ssrf:
          enabled: true
        commandInjection:
          threshold: 8
        promptInjection:
          threshold: 6
        destructiveTools:
          enabled: true

Tools

ccs_status

Reports current policy configuration, cumulative block/scan statistics, and recent security events.

ccs_audit

Scans installed third-party plugins for security risks using runtime-intent analysis — network exfil + credential references, dynamic code execution, persistence mechanisms, obfuscation.

Configuration

{
  ssrf: { enabled: true, allowPrivate: false },
  commandInjection: { enabled: true, threshold: 8 },
  credentialExfil: { enabled: true },
  pathTraversal: { enabled: true },
  destructiveTools: {
    enabled: true,
    requireApproval: ['execute_payment', 'pay', 'delete', 'deploy', /* ... */]
  },
  promptInjection: { enabled: true, threshold: 6 },
  scanOutput: { enabled: true, maxScanLength: 100000 },
  safeToolAllowlist: []  // tools to skip deep scanning
}

Architecture

This plugin implements the Security (D7) and Integrity (D6) dimensions of the CCS (Correctover Conformance Shape) 7-dimension runtime verification standard. The full standard covers Structure, Schema, Latency, Cost, Identity, Integrity, and Security — see the IETF draft for details.

Security logs are written to $DSH_HOME/.dsh-plugin-ccs/security.log.

Difference from dsh-plugin-vetting

	dsh-plugin-vetting	dsh-plugin-ccs
Approach	Static regex on source files	Runtime policy enforcement
Sees eval/Function payloads	❌ Only sees the eval( call	❌ Same (cannot inspect runtime eval)
Blocks SSRF at runtime	❌	✅ URL validation + DNS resolution
Blocks command injection	❌ Log-only tripwire	✅ Subprocess argv inspection, blocks before exec
Blocks credential exfil	❌	✅ Pattern scanning on network-facing tool args
Blocks destructive auto-approve	❌	✅ Name-based destructive tool policy
Scans tool outputs	❌	✅ Secret leakage + injection in results
Scans fetched web content	❌	✅ Prompt injection in tool outputs
Honest self-assessment	"heuristic tripwire, not a boundary"	Runtime security boundary (best-effort, see limitations)

Limitations

• Plugins calling child_process directly (not through ctx.subprocess.spawn) bypass the subprocess hook — this is a DSH architecture limitation, not a plugin bug. The same limitation affects dsh-plugin-vetting.
• eval() / new Function() payloads cannot be inspected at runtime (the code is only visible after evaluation). The audit tool flags these for manual review.
• This plugin is fail-open on internal errors to avoid breaking the harness. Security logs record all evaluation errors.

License

MIT

About

Built by Correctover — AI Reliability. CCS is a 7-dimension runtime verification standard submitted to the IETF (draft-correctover-ccs).