DeepSeek Harness 的插件体验短板：安全权限未生效，好插件用户找不到
Ranking
No observed public metrics; popularity remains neutral/archived.
Merged summary
TL;DR — 对 DeepSeek Harness 插件生态的调查发现，其插件发现、治理和隔离机制存在明显短板。最严重的问题是：三档文件权限并不能约束插件代码，插件仍可凭用户账户权限访问文件、凭据、网络和系统资源。
- GitHub 上约有 11,000 个标记为
dsh-plugin的仓库，但可用插件可能不足 1,000 个；抽查的 1,883 个仓库中约 93% 不符合安装规范，常见问题包括缺少清单、依赖或正确目录结构，也有项目滥用标签。 - 即使启用
read-only，测试插件仍能读取 SSH 文件名和环境变量中的 API 密钥、写入文件并访问互联网，因为权限模式只控制模型发出的工具请求，不限制运行在 Harness 内部的插件代码。 - 生态缺乏官方插件目录、兼容性检查、签名验证、安全报告渠道、可信推荐和包名协调机制；GitHub 标签本身也没有准入控制。
- 插件可能争用共享 UI 或配置路径；安装更多工具还会使提示词前缀缓存失效，增加延迟和上下文消耗，并降低模型选择工具的准确性。
- Profiles、presets 和 Code Mode 可在一定程度上缓解性能及工具选择问题，但面向用户的配置指导不足。
注： 两则来源结论基本一致，一则更强调约 11,000 个仓库中实际可用插件不足 1,000 个，另一则突出抽查样本中约 93% 无法按 Harness 规范安装。
Sources (2)
DeepSeek Harness 的插件体验短板：安全权限未生效，好插件用户找不到
TL;DR - An investigation of DeepSeek Harness’s rapidly growing plugin ecosystem finds that weak discovery, governance, and isolation make plugins difficult to trust and manage. Most critically, plugins can bypass Harness’s three advertised permission levels and access files, credentials, the network, and system resources with the user’s full account privileges.
- Of roughly 11,000 GitHub repositories tagged
dsh-plugin, fewer than 1,000 may be usable; many lack required packaging or are unrelated projects exploiting the tag. - A probe plugin could read SSH-file listings and API keys, write files, and access the internet even under
read-only, because permission controls govern model tool requests—not plugin code running inside Harness. - Installing plugins can invalidate prompt-prefix caches, increase latency and context usage, and worsen tool-selection accuracy; profiles, presets, and Code Mode can mitigate this, but users receive little guidance.
- Popular plugins can conflict over shared UI or configuration paths, while the ecosystem lacks an official registry, compatibility checks, signing, security reporting, trusted recommendations, and package-name coordination.
我们拆了 1.1 万个 DeepSeek Harness 插件，发现官方几乎没有建立插件治理机制
TL;DR - An audit of roughly 11,000 repositories tagged as DeepSeek Harness plugins finds a largely ungoverned ecosystem with weak discovery, compatibility, and trust mechanisms. The most serious issue is that plugins run with the user’s full account privileges, unaffected by Harness’s advertised file-permission modes.
- Plugin counts are misleading: 93% of 1,883 reviewed repositories reportedly could not be installed under Harness conventions, often because they lacked required manifests, dependencies, or layouts.
- DeepSeek provides no official plugin directory, compatibility matrix, signing, verification, security-reporting channel, or recommendation list; GitHub tagging has no admission controls.
- A probe plugin could read SSH filenames and environment secrets, write files, and access the network even in
read-onlymode because permission controls govern model tool requests, not plugin code. - Popular plugins can conflict over shared UI or configuration paths, while adding tools can invalidate prompt-prefix caches, increase context usage, and make tool selection less reliable.