DeepSeek Harness can run shell commands, modify files, and load plugins. The first security task is not finding a universal “safe mode”; it is understanding what each runtime composition actually restricts.
The boundary of workspace-write
New sessions use workspace-write by default. Bash and file modifications are constrained to the workspace and temporary directories, but this does not imply complete isolation for reads, networking, or process visibility.
Choosing a parent directory that contains secrets, private documents, or other projects substantially increases exposure. Prefer the smallest project directory and a Git checkout that can be rolled back.
danger-full-access
The Python SDK’s minimal composition uses danger-full-access. Persistent Bash and absolute editor paths may modify any location visible to the runtime. Official guidance recommends running this composition only in a disposable checkout or container.
Plugin installation happens outside the sandbox
When installing a plugin from GitHub source, explicitly allowing pnpm prepare permits dependency code to run during installation. That step is not constrained by the agent session sandbox.
At minimum:
- Read the repository and installation scripts.
- Pin a specific commit.
- Perform the first install in a disposable container or virtual machine.
- Do not treat the
dsh-pluginGitHub topic as review or security endorsement. - Keep “discovered,” “source reviewed,” “installed,” and “task tested” as separate states.
A sensible team default
Begin routine work with workspace-write and expand permissions one capability at a time. Verify third-party plugins in an isolated environment before bringing them into a real codebase. A tutorial that gives only an installation command without describing installation-time code and permission scope is incomplete.
Evidence and revision
Primary sources
This guide is intentionally concise; use the official source or documentation below as the authority for commands, behavior, and risk boundaries.