
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
dsh-skill-recommender
Advanced tools
Skill recommender for DeepSeek Harness: browse local Codex/Claude/DSH session records, derive a user profile, and recommend suitable open-source skills with a tunable weighted match index (higher index = higher-relevance only). Tools + Web settings panel.
A skill recommender for DeepSeek Harness. It browses your local session records across Codex, Claude and DSH, builds a compact user profile, ingests an open-source skill catalog, and ranks skills with a weighted score gated by a tunable match index — the higher the index, the higher-relevance the recommendations only.
~/.dsh/sessions/**/session.jsonl.zstd), Codex (~/.codex/*.jsonl), Claude (~/.claude/projects/**/*.jsonl) — no API keys, purely local file reads.~/.agents/skills, ~/.dsh/skills, your Obsidian 2️⃣ AI/Skill) + remote awesome lists (awesome-dsh-skills, awesome-dsh-plugin, awesome-deepseek-harness, Claude skills ecosystem), plus a small bundled seed so it always returns something.score = Σ(w_i × sim_i) / Σ(w_i), where dimensions are topic / tool / task / proximity-to-installed. A global match index (0–100, default 60) is the gate: only skills with score ≥ index are returned, then top-N.dsh-skill-studiodsh-skill-studio extracts reusable skills from your own sessions. This plugin recommends third-party open-source skills by extrapolating your profile. They complement each other.
| Tool | Purpose |
|---|---|
recommender_scan | Scan sessions, build the profile, produce an initial recommendation run. |
recommender_recommend | Recommend open-source skills; optionally override index / topN / weights on the fly. |
recommender_profile | Show the current user profile (topics, tools, tasks, projects). |
recommender_config | Configure sources, catalogs, window, match index, per-dimension weights, optional LLM enrichment. |
recommender_status | Show plugin status without leaking secrets. |
A Skill 推荐器 card in the Web settings page: scan button, live 匹配指数 slider (0–100), four per-dimension weight sliders (topic / tool / task / proximity), catalog toggles, and recommendation cards with scores, per-dimension breakdowns and a GitHub link. The index + weights are saved to ~/.dsh/dsh-skill-recommender/config.json (mode 0600).
Requires DeepSeek Harness ≥ 0.1.5-rc.1 (declared as dsh.engines.dsh in the package manifest, so the DSH plugin marketplace can report it) and is verified against 0.1.5-rc.1. This build carries the DSH 0.1.5 adaptations: the strict tool-result contract (lossless-JSON snapshot, additionalProperties: false schema validation, and output.render returning ContentBlock[]) plus executable resolution that survives a launchd-started host whose PATH is only /usr/bin:/bin. Since this version the peerDependencies range explicitly declares compatibility with DSH 0.2.0-rc.2 (^0.2.0-rc.2 is now included), so no compatibility warning appears on 0.2.0-rc.2. No functional change.
Add the plugin to your profile:
# from npm
dsh plugin --profile web add dsh-skill-recommender
# or from GitHub (the repo carries the `dsh-plugin` topic)
dsh plugin --profile web add github:zhengjy01/dsh-skill-recommender
# local development
dsh plugin --profile web add link:/path/to/dsh-skill-recommender
Expected: the command prints the resolved package and records it in that
profile's dsh.profile.bundles.
Screenshot slot 1 — install output. Capture the terminal right after the command, last ~10 lines (package + profile). Redact your username / home path. Save as
docs/images/dsh-skill-recommender-1-install.png, then replace this block with.
Restart the host (tools + routes), then hard-refresh the browser page (client
panel). Config key: skill-recommender in the bundle patch layer.
Expected: 设置 (Settings) shows the Skill 推荐器 card.
Screenshot slot 2 — the settings card. Capture the card's first screen (scan button + index slider). Redact any catalog names you consider private. Save as
docs/images/dsh-skill-recommender-2-card.png.
Press 扫描 / Scan.
Expected: the progress bar advances, then recommendation cards appear with a score, the per-dimension breakdown, and a clickable source link.
Screenshot slot 3 — recommendations with scores. Capture the result list (2–3 cards are enough). Save as
docs/images/dsh-skill-recommender-3-results.png.
Optional: drag the 匹配指数 / index slider up and re-scan.
Expected: fewer, higher-relevance recommendations (index 90 typically
returns very few).
Screenshot slot 4 — the index gate works. Capture the list before/after raising the index. Save as
docs/images/dsh-skill-recommender-4-index.png.
pnpm install
pnpm bundle # builds lib/index.js (ESM) + lib/client.js (browser bundle)
node tests/smoke.mjs
{topic: 50, tool: 50, task: 35, near: 40}; the index gate defaults to 60.github-discovery source queries the GitHub search API across the entire platform (agent/claude/codex skills, SKILL.md, awesome skills — 星标排序), so recommendations are not limited to one designated list. Results are cached (6h TTL); the unauthenticated search limit (10 req/min) is respected.skill or plugin. By default only skills are recommended (types: ['skill']); tick 含插件 in the panel to also include DSH plugins. Both markdown lists and tables are parsed (DSH skill catalogs use tables).autoScanMinutes (default 60, 0 = off) in the panel — the host refreshes the cached result in the background, and the panel shows the last result instantly on open. The cache is persisted to ~/.dsh/dsh-skill-recommender/last-result.json (0600).MIT
| # | Where / 放在哪 | What it shows / 展示什么 | How to capture / 怎么截 | Suggested filename / 建议文件名 |
|---|---|---|---|---|
| 1 | Install | The install command's output (package + profile) | Terminal right after step 1, last ~10 lines; redact home path | docs/images/dsh-skill-recommender-1-install.png |
| 2 | Install | The Skill 推荐器 card in Settings | Settings page, card header + scan button | docs/images/dsh-skill-recommender-2-card.png |
| 3 | Usage | Recommendation cards with scores | Result list, 2–3 cards | docs/images/dsh-skill-recommender-3-results.png |
| 4 | Usage | Raising the index narrows the list | Same list before/after raising the index | docs/images/dsh-skill-recommender-4-index.png |
After adding the images, re-run npm pack --dry-run and the portability gate
(npm run verify) — the README is part of the published tarball.
补图后请重跑 npm pack --dry-run 与可移植性门禁(npm run verify)。
FAQs
Skill recommender for DeepSeek Harness: browse local Codex/Claude/DSH session records, derive a user profile, and recommend suitable open-source skills with a tunable weighted match index (higher index = higher-relevance only). Tools + Web settings panel.
We found that dsh-skill-recommender demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.