DeepSeek Harness plugin ecosystem lacks governance, security controls ineffective, probe finds

The researchers counted 11,000 GitHub repositories carrying the "dsh-plugin" tag. Official guidance for the ecosystem is limited to a single line in the README asking developers to use the tag for discoverability. There is no plugin directory, search, version compatibility matrix, code signing, security reporting channel, or official recommendation list. Since the tag requires no approval, a resume generator created in 2020 and unrelated to DeepSeek ranked fourth in the default GitHub search for the ecosystem.

Depending on how a plugin is defined, the total count ranges from 11,000 to fewer than 1,000. In a sample of 50 repositories that had been rejected by community maintainers, most contained real code but lacked the required bundle declaration or npm publication; only one was an empty shell. Five were unrelated Windows launchers, a macOS widget, or desktop clients. The researchers also found three teams building desktop clients with almost identical names.

The probe plugin ran nine operations under each of the three permission levels: read-only, workspace-write and danger-full-access. All succeeded in every mode. The framework's permission settings are intended to filter requests from the model, but plugins do not need to request access because they run as part of the Harness itself. A DeepSeek design note says "security and permissions are not design goals," and a bundled tool's README states that "the sandbox is not a security boundary."

Behavioral checks on the ten most-downloaded plugins found that dsh-tui, a terminal-skin plugin, rewrites the sandbox policy and forces the highest danger-full-access level on Windows because no official sandbox backend exists there. Another plugin, advertised as adding an intermediate "auto" permission level, actually only adds an approval preset; its source code shows an AI classifier is instructed to "Default to approve," and it does not modify the underlying three permission tiers.

The ecosystem is dominated by plugins that help users find other plugins or change the interface. The most-downloaded plugin is dsh-market, a marketplace with 159,327 weekly downloads, about 24 percent of the official entry package's weekly downloads. Among 2,143 registry entries, only two replace the agent's main loop, while 69 integrate external model subscriptions. The researchers said this pattern is nearly identical to Anthropic's Claude Code plugin market.

Installing plugins also undermines DeepSeek's cache-hit engineering, the investigation found. Plugins can invalidate the context cache, making the first round slower and increasing costs, with no notification in the ecosystem. DeepSeek's cache design remains economical for repeated tasks: in a test with a 923,858-token context, the first query cost about ¥9 while the next four combined cost about ¥0.28, and coding-task cache hit rates ranged from 93 to 98 percent.

In related findings, the investigation tested DeepSeek V4 Pro and concluded that its 1M-token context is produced by extrapolating a 64K context 16 times using YaRN, but placement tests did not reveal degradation at the deep end of the window. DeepSeek's own benchmarks show the Harness defaults to the smaller Flash model, and third-party ranking site Artificial Analysis uses Flash for DeepSeek's entry, suggesting Flash is intended as the main efficiency tier.

The researchers said the absence of curation and reporting channels leaves users personally responsible for verifying every plugin. They described the environment as an open door for malicious actors.