Plugin directory / Developer / dsh-plugin-tools
dsh-plugin-tools
Verified · install-tested on dsh wwumit
What it does
Plugin/skill publishing toolbox for DSH: six ctx.skills tools (expert2skill, skill-compliance, dependency-scan, malware-scan, bundle-lint, runtime-probe) plus a CI plugin-gate template.
Works — verified, early-stage project
Plugin/skill publishing toolbox for DSH: six ctx.skills tools (expert2skill, skill-compliance, dependency-scan, malware-scan, bundle-lint, runtime-probe) plus a CI plugin-gate template. It installs cleanly and boots without issues in our testing. It's early-stage but functional.
“Verified” means our automated CI actually ran dsh plugin add in a clean profile and it booted — nothing more. Feature descriptions and version compatibility are the author’s claims. This is not a security audit and not an endorsement of third-party code.
README
dsh-plugin-tools
**插件工具专家组**：插件/技能开发与发布工具 provider。通过ctx.skills 从线级 catalog 安装三个核心工具：
| 工具 | 用途 |
|---|---|
| **expert2skill** | 专家方法沉淀器：引导访谈 → 规则库 JSON + 可运行 skill 包 |
| **skill-compliance** | 发布合规检查器：披露完整性 + 免责/红线 + 金融敏感词 + 依赖安全（进 STANDARD §7/§9） |
| **dependency-scan** | 供应链依赖扫描：宿主遮蔽 / 版本锁定 / 高危基线 / peer 完整性（与 skill-compliance DEP 对齐） |
| **malware-scan** | 恶意代码静态检测：远程执行 / 混淆执行 / 数据外传 / 持久化 / 凭据读取 / 危险调用链 |
| **bundle-lint** | bundle 结构一致性校验：cordis.patch.yml / dsh 配置 / 入口 / 包名对齐（BND-001~006） |
| **runtime-probe** | 实机 list/get 验证：注册插件 → 实测 → 证据契约报告（verifiedBy/verifiedAt/reportUrl） |
Install
``sh
npm install @wwumit/dsh-plugin-tools
peer deps: @deepseek-ai/cordis, @deepseek-ai/dsh-skill
`
Usage (composition)
`ts
import { Context } from '@deepseek-ai/cordis'
import * as pluginTools from '@wwumit/dsh-plugin-tools'
export function apply(ctx: Context) {
ctx.plugin(pluginTools, {
catalogUrl: 'https://wwumit.github.io/skills-catalog/catalog-plugin-tools.json',
})
}
`
Verified (DSH 实机验证)
verify-dsh.ts 在真实 DSH 运行时验证：ctx.skills.list() 返回 4 个工具 + ctx.skills.get('expert2skill') 拉取 SKILL.md。
Disclosure (DISCLOSURE v0.3)
线级 catalog 双颗粒度披露：3 个工具全部 cloud: false（纯本地）、disclosureSchemaVersion: 0.3、仓级 repos[].cloudSkills/paySkills 同源。披露检查由 skill-compliance v1.5.x 自动执行。
CI 门禁模板（plugin-gate）
仓库内 templates/ci/plugin-gate.yml 提供发布门禁模板：push/PR 时自动执行
build + bundle-lint + skill-compliance + dependency-scan + malware-scan，任一失败即红。
用法：复制到目标插件仓库 .github/workflows/plugin-gate.yml。
Development
`sh
pnpm install
pnpm test # vitest (mocked fetch)
pnpm build # tsc → lib/
``
Install
Install the catalog once, then DeepSeek Harness can find and install any plugin from this site automatically:
dsh plugin add dshbase-catalogThen say "install dsh-plugin-tools for me" — your agent finds it in the directory and installs it. Docs: dshbase-catalog · verified packs.
Web profile:
dsh plugin --profile web add @wwumit/dsh-plugin-toolsHeadless (CLI) profile:
dsh plugin --profile headless add @wwumit/dsh-plugin-toolsPackage
npm: @wwumit/dsh-plugin-tools · version 1.1.2 · tested on dsh 0.1.0-rc.6
Test report
Verified end-to-end: L1 install + L2 load + L3 runtime Q&A on dsh 0.1.0-rc.6.
When to use it
Extend the agent's coding surface — give it a new tool, workflow, or integration so it handles a dev task it couldn't before.
Who it's for
Developers who want dsh to behave like a teammate on real codebases — editing, running, and verifying changes rather than just answering.
For developers — extending it
The tool/command surface is the seam: expose more of the SDK, add smarter context wiring, or tighten the loop between code changes and verification.
Share this badge
Drop this badge into your README — it links back here and updates automatically when our test status changes:
[](https://dshbase.com/plugins/dsh-plugin-tools/)<a href="https://dshbase.com/plugins/dsh-plugin-tools/"><img src="https://dshbase.com/badges/dsh-plugin-tools.svg" alt="dshbase install-tested"></a>