dsh-guardian
Inspect dangerous shell, SQL, and file-write actions before execution, redact common credentials from results, and provide a read-only security review workflow.
Project overview
Inspect dangerous shell, SQL, and file-write actions before execution, redact common credentials from results, and provide a read-only security review workflow.
Core capabilities
Detect dangerous command patterns before execution
Detect dangerous command patterns before execution. This capability is documented in the repository README and still requires verification against the target DSH version and profile.
Redact common credentials in tool output
Redact common credentials in tool output. This capability is documented in the repository README and still requires verification against the target DSH version and profile.
Adjust warning strength through policy levels
Adjust warning strength through policy levels. This capability is documented in the repository README and still requires verification against the target DSH version and profile.
Provide a read-only security review workflow
Provide a read-only security review workflow. This capability is documented in the repository README and still requires verification against the target DSH version and profile.
Installation and usage
Install in DeepSeek Harness, reload the target environment as documented, and verify it with a low-risk scenario.
Let an AI Agent install it
Send this prompt to Codex, Claude Code, or another AI agent that can work with your local environment.
Help me install dsh-guardian from https://github.com/lonelymoon87/dsh-guardian. Read the README, license, and installation files first. Confirm the current DeepSeek Harness version, target profile, and required dependencies. Use the repository's current command `dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.3/dsh-guardian-0.1.3.tgz`. Explain the profile, paths, and permissions that will change before running it. Follow the repository verification steps and report commands, changed locations, and visible results. Ask before requesting credentials, enabling extra network access or build scripts, overwriting files, or expanding permissions.- A DeepSeek Harness version in the supported range
- An initialized web or headless profile
- Prefer the prebuilt v0.1.3 release package
dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.3/dsh-guardian-0.1.3.tgz- 1Check the environment and target profile
A DeepSeek Harness version in the supported range; An initialized web or headless profile; Prefer the prebuilt v0.1.3 release package. Record the current configuration and installed plugins before changing anything.
- 2Run the current repository command
Run the following command. `dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.3/dsh-guardian-0.1.3.tgz` Stop and ask before enabling build scripts, providing credentials, or overwriting files.
- 3Reload and verify
Run `dsh --profile web --dump-config`, then use harmless test inputs to inspect warnings and redaction without using real credentials or dangerous commands.
Run `dsh --profile web --dump-config`, then use harmless test inputs to inspect warnings and redaction without using real credentials or dangerous commands.
- It is a policy layer rather than an operating-system sandbox
- It does not replace permissions, DLP, or container isolation
- Pattern matching can produce false positives or false negatives
Use cases
Add guardrails to DSH on a shared development machine
Start with a minimal dsh-guardian scope in this scenario, then expand only after checking output, permissions, and compatibility.
Reduce common credential leakage in logs and tool results
Start with a minimal dsh-guardian scope in this scenario, then expand only after checking output, permissions, and compatibility.
Run a read-only security review before allowing writes
Start with a minimal dsh-guardian scope in this scenario, then expand only after checking output, permissions, and compatibility.
Assessment
This assessment is based on the repository README, installation instructions, license, and maintenance metadata. Pins setup to a public release package; Covers both pre-execution warnings and post-execution redaction; Documents compatibility testing. It is a policy layer rather than an operating-system sandbox; It does not replace permissions, DLP, or container isolation; Pattern matching can produce false positives or false negatives. No local installation or long-term use is claimed.
Why it may be useful
- Pins setup to a public release package
- Covers both pre-execution warnings and post-execution redaction
- Documents compatibility testing
What to know first
- It is a policy layer rather than an operating-system sandbox
- It does not replace permissions, DLP, or container isolation
- Pattern matching can produce false positives or false negatives
README
dsh-guardian
Overview
Inspect dangerous shell, SQL, and file-write actions before execution, redact common credentials from results, and provide a read-only security review workflow. Inspect dangerous shell, SQL, and file-write actions before execution, redact common credentials from results, and provide a read-only security review workflow.
Getting started
- Install in DeepSeek Harness, reload the target environment as documented, and verify it with a low-risk scenario.
- Inspect dangerous shell, SQL, and file-write actions before execution, redact common credentials from results, and provide a read-only security review workflow.
- The repository documents these main capabilities: Detect dangerous command patterns before execution, Redact common credentials in tool output, Adjust warning strength through policy levels, Provide a read-only security review workflow.
- Run `dsh --profile web --dump-config`, then use harmless test inputs to inspect warnings and redaction without using real credentials or dangerous commands.
Configuration
dsh plugin --profile web add https://github.com/lonelymoon87/dsh-guardian/releases/download/v0.1.3/dsh-guardian-0.1.3.tgz