DSH Marketplace
中文

dsh-reverse-skill

dhicoc/dsh-reverse-skill

Complete reverse-skill pack (85 SKILL.md) as a DeepSeek Harness Cordis plugin: reverse engineering, authorized pentesting and security-research skill router.

296PowerShellMITSource

Install

Add dsh-reverse-skill to DeepSeek Harness

via npm

Resolves a published tarball rather than cloning the repository, and installs without any extra setup. Swap `web` for your profile name if you run another one.

via GitHub · npm package

Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/web/pnpm-workspace.yaml.

What happened when we ran it

Installed cleanly when we ran it

Every command here is run in a throwaway container against a clean profile, and the result is whatever the harness recorded — not a guess from the source. Last run 3d ago.

Due diligence

Before you install dsh-reverse-skill

  • Source of record: dhicoc/dsh-reverse-skill — present in the community registry that DSH's own plugin market installs from.
  • Licensed under MIT.
  • Detected: terminal surface. Read the source before granting these.
  • A listing here is not a security review. Plugins run with your agent's permissions.

The AI take

What it is — dsh-reverse-skill is a DeepSeek Harness Cordis plugin. It packages 85 SKILL.md into a plugin that automatically registers them for authorized reverse engineering, pentesting and security research.

Who it is for — It is suitable if you need to call authorized reverse engineering or pentesting skills in a DeepSeek Harness profile. Users not using the DSH Cordis plugin system do not need it.

Watch out — Sandbox testing shows it installs and registers successfully in a new profile. It executes shell commands. No obvious issues found.

The verdict — I would install it because it automatically registers 85 SKILL.md into the skill library.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.

What dsh-reverse-skill does

Document tiles flow through a recursive sieve and converge into one layered core.

dsh-reverse-skill is a DeepSeek Harness plugin that registers 85 reverse-engineering, authorised penetration-testing, security-research and CTF skills as a Cordis skill provider. DeepSeek Harness discovers the packaged SKILL.md files under skills/ and CTF-Sandbox-Orchestrator/: src/index.ts recursively scans both trees, normalises front matter, builds SkillCandidate records and exposes their full bodies through ctx.skills. The model can retrieve them through ctx.skills and tool-skill, while users can invoke eligible skills by name.

The package is intended for authorised reverse engineering, penetration testing and security research. Its terminal surface is relevant because these skills can guide terminal-oriented security workflows; authorisation for the target system remains the operator’s responsibility. The plugin is a poor fit where only a small subset of these skills is needed, where existing local skills already cover the same material, or where external tooling must be available automatically: referenced MCP servers such as burp-mcp require separate configuration.

DeepSeek Harness does not include the upstream agents/*.yaml definitions, because those OpenAI Agents SDK agents cannot be mapped to its supported ctx.subagent targets. It also does not enforce allowed-tools or disallowed-tools; those constraints must be handled at the harness layer.

dsh-reverse-skill documentation

Configuring dsh-reverse-skill

DeepSeek Harness loads the package through its dsh.bundle manifest and inserts the reverse-skill Cordis plugin into the active profile. A package reference can also be placed in the plugins list:

plugins:
  - "@dhicoc/dsh-reverse-skill"

As a preset fallback, DeepSeek Harness accepts these paths under skills.local.customSkillDirs:

skills:
  local:
    customSkillDirs:
      - "./dsh-reverse-skill/skills"
      - "./dsh-reverse-skill/CTF-Sandbox-Orchestrator"

The documented discovery order is project .dsh, project .agents, customSkillDirs, user .dsh, then user .agents. Discovery is flat, so nested skills must be exposed through directories containing SKILL.md.

Commands

Run npm run build to compile TypeScript into lib/ and lib/types/. Run npm test to rebuild the plugin and test the registered provider. The test checks that all 85 skills are listed, names are unique, and each skill returns a non-empty body through get(). It also checks SKILL.md files containing a UTF-8 BOM and CRLF line endings.

How dsh-reverse-skill behaves

During apply(ctx), DeepSeek Harness calls ctx.skills.registerProvider(...). The provider recursively scans skills/ and CTF-Sandbox-Orchestrator/, parses front matter, promotes metadata.user-invocable to user-invocable, converts when_to_use to whenToUse, and stores each resource with its directory path. The complete document body is returned when a skill is requested. Adding or removing a SKILL.md changes the discovered set without editing a candidate list.

Known limits

The upstream agents/*.yaml files are not included. DeepSeek Harness does not enforce allowed-tools or disallowed-tools. MCP references in skill content, including burp-mcp, require separate entries in mcp.servers. The package is documented for authorised use only.

Written from the project's own documentation and kept in sync with it. Where the two disagree, the source is authoritative — read the README on GitHub

Same category

Alternatives to dsh-reverse-skill

vox-director

Alisa0808

1.3k

Turn one topic into a finished Vox-style paper-collage explainer/ad video — automated end to end on Atlas Cloud + ffmpeg. An agent skill.

Installed cleanly when we ran it

GitHub sourcePython9d ago

AI review

vox-director

What it is — Automatically turns one topic into a finished Vox-style paper-collage explainer/ad video, end-to-end on Atlas Cloud + ffmpeg as an agent skill.

Who it is for — If you are a coding agent user who wants the agent to automatically generate video explainers from a topic using Atlas Cloud models and ffmpeg, then this plugin suits your scenario. If your work does not involve Atlas Cloud integration or ffmpeg-based video generation, this plugin does not match your workflow.

Watch out — Sandbox test passed: installed in a new profile and registered into harness. It will execute shell commands. No other obvious issues found.

The verdict — I would install it because it automates end-to-end explainer video generation from a topic and passed sandbox verification; premise is access to Atlas Cloud API key and ffmpeg environment.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
1Source

Aegis

GanyuanRan

1.0k

Software-engineering method pack for coding agents, with skills for baseline-first planning, systematic debugging, prompt hygiene, verification before completion, and repair/retirement tracking.

Installed cleanly when we ran it

GitHub sourcePython4d ago

AI review

Aegis

What it is — Aegis is a method pack for coding agents providing baseline-first planning, systematic debugging, and verification tracking.

Who it is for — If you are using DeepSeek Harness to manage AI coding agents that require baseline-first planning and verification before completion, Aegis is suitable. If you prefer agents without retirement tracking and risk proof, you can skip Aegis.

Watch out — When installing from source code, you need to manually allow its build script to run. The sandbox test passed in a new profile and was registered by DeepSeek Harness. No obvious pitfalls were found.

The verdict — I would install it because the benchmark showed unsafe outcomes reduced to 0%.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
1Details

superdesign-skill

superdesigndev

429

Design skill for UI and marketing graphics on the Superdesign canvas: reads the repo for context, extracts its design system, then generates and iterates branchable design drafts, flow pages, and reusable components through the Superdesign CLI.

Installed cleanly when we ran it

GitHub sourceJavaScript4d ago

AI review

superdesign-skill

What it is — Design skill that reads repository context, extracts design system, generates and iterates branchable design drafts, flow pages, and reusable components on the Superdesign canvas via the Superdesign CLI.

Who it is for — When redesigning a settings page in Claude Code, lacking design system extraction and draft iteration capabilities. Users who only need to complete design tasks in the web app are not suitable.

Watch out — Sandbox test passed: successfully installed in a new profile and registered into the profile. No obvious pitfalls discovered.

The verdict — I would install it because it remembers project context for cross-session iteration, rather than rediscovering the codebase each time.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
1Details

MisakaNet

Ikalus1988

402

Failure-recovery memory: search and record failure-recovery lessons from real engineering sessions, with BM25 + semantic RAG retrieval and a lessons knowledge base.

Installed cleanly when we ran it

GitHub sourcePython3d ago

AI review

MisakaNet

What it is — MisakaNet provides a DeepSeek Harness adapter for failure recovery.

Who it is for — When using DeepSeek Harness for AI coding tasks that encounter failures, you can search lessons from real engineering sessions to get a fix path. If you do not need to help AI coding agents avoid repeating known failures, you do not need to install it.

Watch out — Sandbox testing passed: installed in a fresh profile and registered by the harness. No obvious issues found.

The verdict — I would install it because it has zero dependencies, zero servers, and zero databases.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
1Details

Awesome-AI-Pedia

Awesome-AI-Pedia

173

AI skills大全 mcp ai知识库 Agent 全维度 AI 资源百科，DSH插件 收录大模型、智能 Agent、RAG 检索增强、多模态、MLOps、AI 应用工具、AI面试集、Vibe coding 大全、零基础学习路线，持续更新前沿 AI 开源项目，开发者一站式 AI 导航库

Installed cleanly when we ran it

GitHub sourceTypeScript3d ago

AI review

Awesome-AI-Pedia

What it is — It is a knowledge base and blog platform covering categories such as coding assistants, Agent, MCP, skills, and Vibe coding.

Who it is for — If you need guides for using Claude Code or Cursor in AI development along with Agent, MCP, and Skills, this plugin is suitable to install. If you already have sufficient AI tool documentation, you may not need this organized knowledge base.

Watch out — Installation requires granting execute permission to start.sh. From source code installation, the build script needs to be manually allowed first. Sandbox test passed with successful registration in a new profile. No obvious issues found.

The verdict — I would install it because it offers a structured set of AI resources useful for tool usage and engineering practices, with sandbox verification confirming success.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
1Source

dsh-find-plugins

Nagi-ovo

141

帮 DSH 搜索、安装并验证插件的 Skill｜A DSH skill that finds, installs, and verifies GitHub plugins

Installed cleanly when we ran it

GitHub sourceJavaScript5d ago

AI review

dsh-find-plugins

What it is — It helps DSH search GitHub dsh-plugin repositories and install and verify the plugins.

Who it is for — When you need to expand DSH capabilities but do not know where to find new plugins, this tool can help. If your plugins are already verified in the local project and do not require external search, you do not need this tool.

Watch out — It passed sandbox test in a new profile after being installed and registered into the profile by harness. No obvious issues were found.

The verdict — I would install it because it provides a mechanism for discovering plugins, but the premise is trusting public GitHub plugins.

Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.Read the source
Source