Third-party security audit of the DeepSeek Harness plugin model — summary & full report (defensive research) #454

Hi maintainers & community 👋

We conducted a third-party, defensive security audit of DeepSeek Harness (dsh) focused on the "plugins as capability providers" model, and are publishing the complete deliverable: report, evidence appendices, 13 reproducible demos, and live-verification artifacts.

Full report repo: https://github.com/Fz0x00/deepseek-harness-plugin-security-audit

What was audited

• Source: deepseek-ai/deepseek-harness @ 47f9438 (pinned submodule; every claim carries a file:line citation)
• Live targets: the official npm release @deepseek-ai/dsh@0.1.0-rc.6, run only in isolated DSH_HOME directories

Headline finding

dsh has two trust axes, and they are sharply asymmetric:

• Axis A (model/agent behavior) is production-grade — tool execution pipeline, fail-closed approval, process sandbox, file-observation policy, credential-reference model, append-only audit, and the browser confusion-deputy fence (403/415 verified against real running instances).
• Axis B (plugin code) currently has no security design — plugins run in the host process with host privileges; the install/update/tamper/persistence/hot-reload paths have no signature, integrity, provenance, or confirmation gates.

Verified end to end against the official rc.6 release

• !!js configuration-as-code = host-level RCE at load time (PWNED-BY-LIVE-JS)
• Malicious bundle executes in the host process on install (payload pid == host pid)
• Post-install tampering loads with zero checks; dsh plugin remove does not remove a persisted !!js backdoor; user-patch hot reload takes effect in ~15 s without restart
• Unauthenticated loopback RPC reads full session content; session.prompt accepts forged input (agent action still requires a model in the loop)
• G-1: AGENTS.md / project-skill instruction injection fires with no install, no approval, no warning (L0 prerequisite) — baseline and skill-catalog injection both live-verified
• G-3: telemetry hot-reload poisoning silently flips the exporter to FULL-mode, zero-redaction streaming to an attacker endpoint — live-verified end to end (no restart)

What the report contains

• 40 attack paths (30 original + 10 added, incl. G-1/G-3), each with an evidence grade (live / simulated / static)
• 96 source-evidence citations (file:line), 13 reproducible demos (demos/), 8+2 live verifications with artifacts (evidence/live-test/)
• Fairness notes are included: pnpm registry integrity, 0600/0700 permission enforcement, the .env bootstrap guard list, loopback pinning of privileged RPC methods — all real mitigations and acknowledged as such
• A proposed incremental hardening roadmap in REPORT.md §9: supply-chain pinning, install/update confirmation gates, treating telemetry exporter URL as sensitive, instruction/skill injection labeling, and a long-term declarative permission layer

Method & ethics

• Defensive disclosure; all PoCs are inert (.poc suffix or local-collector-only, no credential contents read, redacted evidence)
• All live tests used throwaway DSH_HOME dirs and loopback endpoints; nothing touched real deployments

Feedback is very welcome — especially on which findings already exist on your roadmap, and where our reading of the design intent could be more precise.