Permissions, sandboxes, and plugin security

DeepSeek Harness can run shell commands, modify files, and load plugins. The first security task is not finding a universal “safe mode”; it is understanding what each runtime composition actually restricts.

The boundary of workspace-write

New sessions use workspace-write by default. Bash and file modifications are constrained to the workspace and temporary directories, but this does not imply complete isolation for reads, networking, or process visibility.

Choosing a parent directory that contains secrets, private documents, or other projects substantially increases exposure. Prefer the smallest project directory and a Git checkout that can be rolled back.

danger-full-access

The Python SDK’s minimal composition uses danger-full-access. Persistent Bash and absolute editor paths may modify any location visible to the runtime. Official guidance recommends running this composition only in a disposable checkout or container.

Plugin installation happens outside the sandbox

When installing a plugin from GitHub source, explicitly allowing pnpm prepare permits dependency code to run during installation. That step is not constrained by the agent session sandbox.

At minimum:

• Read the repository and installation scripts.
• Pin a specific commit.
• Perform the first install in a disposable container or virtual machine.
• Do not treat the dsh-plugin GitHub topic as review or security endorsement.
• Keep “discovered,” “source reviewed,” “installed,” and “task tested” as separate states.

A sensible team default

Begin routine work with workspace-write and expand permissions one capability at a time. Verify third-party plugins in an isolated environment before bringing them into a real codebase. A tutorial that gives only an installation command without describing installation-time code and permission scope is incomplete.