dsh-skill-pack-security

dsh-skill-pack-security is a security-audit skill pack plus a plugin_vet supply-chain gate for DeepSeek Harness (dsh). It ships eight bilingual agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) and the plugin_vet automated pre-install scanner. Apache-2.0.

• Eight security-audit skills ship in two editions: skills/ (Chinese) and skills-en/ (English), with identical names and metadata.
• Skills: security-audit, secret-scan, dependency-audit, supply-chain-review, prompt-injection-review, threat-model, vuln-intel, incident-response.
• plugin_vet: a zero-dependency pre-install scanner registered by the optional provider/ plugin on ctx.tools.
• plugin_vet checks cover license, SBOM, commit locking, malicious patterns, data-responsibility review, and a five-dimension risk card.
• The risk report folds license/source/dependencies/build scripts/maintenance into PASS, WARN, or FAIL, feeding an install gate (gate.policy: warn or deny).
• Every finding cites the matching skill section so the agent can continue the manual audit.
• Installer scripts scripts/install.ps1 and scripts/install.sh target four skill roots (project-dsh, project-agents, user-dsh, user-agents).
• Apache-2.0 licensed; the README documents Node ^22.19.0 || >=24.0.0 and DeepSeek Harness dsh-v0.1.7-rc.2 compatibility.