{
"schema": "omdsh-workshop-submission/v2",
"operation": "create-project",
"project": {
"id": "dsh-skill-pack-security",
"displayName": "dsh-skill-pack-security",
"summary": "Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning /",
"kind": "toolkit",
"category": "safety",
"tags": [
"skill-pack",
"skills",
"security",
"security-audit",
"supply-chain"
],
"repository": "https://github.com/PerryLink/dsh-skill-pack-security",
"path": "/provider",
"author": {
"name": "PerryLink",
"url": "https://github.com/PerryLink"
},
"license": "Apache-2.0",
"media": null
},
"release": {
"version": "2.2.7",
"ref": "95a83fafc6ac54254f113147d8a08d730377f496",
"updatedAt": "2026-09-05T07:08:40.435Z",
"channel": "stable",
"compatibility": "0.1.2-rc.1",
"changelog": "[2.2.7] - 2026-09-04: Added the English edition (`skills-en/`), the installer scripts for the four DSH skill roots, the optional provider plugin, and the 12-check verification suite with CI.",
"capabilities": {
"requiresFabric": false,
"deepHook": false,
"restartRequired": true
},
"profileBundle": {
"packageName": "@perrylink/dsh-skill-pack-security-provider",
"spec": "2.2.7"
},
"updateFrom": null
},
"management": {
"method": "profile-bundle",
"protocol": "harness-profile",
"label": "dsh-skill-pack-security",
"instructions": "dsh plugin --profile <name> add @perrylink/dsh-skill-pack-security-provider # npm channel; or pnpm pack and add the tarball",
"source": null
},
"declarations": {
"permissions": "Registered capabilities: files:read, network:fetch. No writes outside the session/profile; see packageManifest.permissions.",
"testing": "Wave2 release gate green (typecheck/test/build/verify/pack, 2026-09-04); 25 local checks green; profile runtime smoke PASS in the wave2 d2-smoke-v4 matrix (2026-09-04); install/remove evidence not separately collected (packageManifest.evidence null).",
"trustedPublisherRequested": false,
"installScriptsMustRemainDisabled": true
},
"packageManifest": {
"schema": "omdsh-workshop-package/v1",
"type": "plugin",
"integration": {
"protocol": "harness-profile",
"artifact": "provider/cordis.patch.yml"
},
"install": {
"mode": "transactional",
"adapter": "profile-bundle",
"failurePolicy": "generation-rollback",
"touchesCurrentBeforeActivation": false
},
"lifecycle": {
"activation": "restart-profile",
"dispose": "supported"
},
"permissions": [
"files:read",
"network:fetch"
],
"compatibility": {
"dshVersions": [
"0.1.2-rc.1"
]
},
"capability": {
"id": "skill-pack-security",
"kind": "tool-bundle+provider",
"invocation": "boot the RC.6 candidate Profile with the bundle mounted (config.language zh|en), call ctx.skills.get('security-audit') through the @deepseek-ai/dsh-skill-filesystem provider contract, and execute the plugin_vet tool against a GitHub owner/repo target",
"expected": "ctx.skills.get('security-audit') resolves the mounted edition AND ctx.tools has plugin_vet, whose report cites skill sections for manual follow-up"
},
"evidence": {
"install": null,
"failureIsolation": null,
"hotReload": null,
"remove": null
}
}
}
Author Studio manifest
{ "schema": "omdsh-workshop-submission/v2", "operation": "create-project", "project": { "id": "dsh-skill-pack-security", "displayName": "dsh-skill-pack-security", "summary": "Automated plugin supply-chain security gate for DeepSeek Harness (dsh): eight agent skills in Chinese and English editions teach the audit methodology, and the plugin_vet tool executes the pre-install gate (license / SBOM / commit pinning /", "kind": "toolkit", "category": "safety", "tags": [ "skill-pack", "skills", "security", "security-audit", "supply-chain" ], "repository": "https://github.com/PerryLink/dsh-skill-pack-security", "path": "/provider", "author": { "name": "PerryLink", "url": "https://github.com/PerryLink" }, "license": "Apache-2.0", "media": null }, "release": { "version": "2.2.7", "ref": "95a83fafc6ac54254f113147d8a08d730377f496", "updatedAt": "2026-09-05T07:08:40.435Z", "channel": "stable", "compatibility": "0.1.2-rc.1", "changelog": "[2.2.7] - 2026-09-04: Added the English edition (`skills-en/`), the installer scripts for the four DSH skill roots, the optional provider plugin, and the 12-check verification suite with CI.", "capabilities": { "requiresFabric": false, "deepHook": false, "restartRequired": true }, "profileBundle": { "packageName": "@perrylink/dsh-skill-pack-security-provider", "spec": "2.2.7" }, "updateFrom": null }, "management": { "method": "profile-bundle", "protocol": "harness-profile", "label": "dsh-skill-pack-security", "instructions": "dsh plugin --profile <name> add @perrylink/dsh-skill-pack-security-provider # npm channel; or pnpm pack and add the tarball", "source": null }, "declarations": { "permissions": "Registered capabilities: files:read, network:fetch. No writes outside the session/profile; see packageManifest.permissions.", "testing": "Wave2 release gate green (typecheck/test/build/verify/pack, 2026-09-04); 25 local checks green; profile runtime smoke PASS in the wave2 d2-smoke-v4 matrix (2026-09-04); install/remove evidence not separately collected (packageManifest.evidence null).", "trustedPublisherRequested": false, "installScriptsMustRemainDisabled": true }, "packageManifest": { "schema": "omdsh-workshop-package/v1", "type": "plugin", "integration": { "protocol": "harness-profile", "artifact": "provider/cordis.patch.yml" }, "install": { "mode": "transactional", "adapter": "profile-bundle", "failurePolicy": "generation-rollback", "touchesCurrentBeforeActivation": false }, "lifecycle": { "activation": "restart-profile", "dispose": "supported" }, "permissions": [ "files:read", "network:fetch" ], "compatibility": { "dshVersions": [ "0.1.2-rc.1" ] }, "capability": { "id": "skill-pack-security", "kind": "tool-bundle+provider", "invocation": "boot the RC.6 candidate Profile with the bundle mounted (config.language zh|en), call ctx.skills.get('security-audit') through the @deepseek-ai/dsh-skill-filesystem provider contract, and execute the plugin_vet tool against a GitHub owner/repo target", "expected": "ctx.skills.get('security-audit') resolves the mounted edition AND ctx.tools has plugin_vet, whose report cites skill sections for manual follow-up" }, "evidence": { "install": null, "failureIsolation": null, "hotReload": null, "remove": null } } }