dhicoc/dsh-reverse-skill
Complete reverse-skill pack (85 SKILL.md) as a DeepSeek Harness Cordis plugin: reverse engineering, authorized pentesting and security-research skill router.
Install
via npm
Resolves a published tarball rather than cloning the repository, and installs without any extra setup. Swap `web` for your profile name if you run another one.
via GitHub · npm package
Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/web/pnpm-workspace.yaml.
What happened when we ran it
Installed cleanly when we ran it
Every command here is run in a throwaway container against a clean profile, and the result is whatever the harness recorded — not a guess from the source. Last run 15d ago.
Show it in your README
For maintainers: the badge serves this listing's latest sandbox verdict, so a re-run updates it on its own — and it links readers to the full result here.
Due diligence
What it is — This is a DeepSeek Harness Cordis plugin providing skill routing for reverse engineering, authorized pentesting, and security research.
Who it is for — Users conducting security research with DeepSeek Harness can install this plugin. Users who do not want to manually maintain candidate lists can skip it because the plugin automatically synchronizes.
Watch out — Sandbox testing passes with successful registration and enabling in a new profile. It executes shell commands. No obvious issues found.
The verdict — I will not install it because it is only suitable for authorized security research scenarios, which may not be needed for other tasks.
Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.
dsh-reverse-skill is a DeepSeek Harness plugin that registers 85 reverse-engineering, authorised penetration-testing, security-research and CTF skills as a Cordis skill provider. DeepSeek Harness discovers the packaged SKILL.md files under skills/ and CTF-Sandbox-Orchestrator/: src/index.ts recursively scans both trees, normalises front matter, builds SkillCandidate records and exposes their full bodies through ctx.skills. The model can retrieve them through ctx.skills and tool-skill, while users can invoke eligible skills by name.
The package is intended for authorised reverse engineering, penetration testing and security research. Its terminal surface is relevant because these skills can guide terminal-oriented security workflows; authorisation for the target system remains the operator’s responsibility. The plugin is a poor fit where only a small subset of these skills is needed, where existing local skills already cover the same material, or where external tooling must be available automatically: referenced MCP servers such as burp-mcp require separate configuration.
DeepSeek Harness does not include the upstream agents/*.yaml definitions, because those OpenAI Agents SDK agents cannot be mapped to its supported ctx.subagent targets. It also does not enforce allowed-tools or disallowed-tools; those constraints must be handled at the harness layer.
DeepSeek Harness loads the package through its dsh.bundle manifest and inserts the reverse-skill Cordis plugin into the active profile. A package reference can also be placed in the plugins list:
plugins:
- "@dhicoc/dsh-reverse-skill"
As a preset fallback, DeepSeek Harness accepts these paths under skills.local.customSkillDirs:
skills:
local:
customSkillDirs:
- "./dsh-reverse-skill/skills"
- "./dsh-reverse-skill/CTF-Sandbox-Orchestrator"
The documented discovery order is project .dsh, project .agents, customSkillDirs, user .dsh, then user .agents. Discovery is flat, so nested skills must be exposed through directories containing SKILL.md.
Run npm run build to compile TypeScript into lib/ and lib/types/. Run npm test to rebuild the plugin and test the registered provider. The test checks that all 85 skills are listed, names are unique, and each skill returns a non-empty body through get(). It also checks SKILL.md files containing a UTF-8 BOM and CRLF line endings.
During apply(ctx), DeepSeek Harness calls ctx.skills.registerProvider(...). The provider recursively scans skills/ and CTF-Sandbox-Orchestrator/, parses front matter, promotes metadata.user-invocable to user-invocable, converts when_to_use to whenToUse, and stores each resource with its directory path. The complete document body is returned when a skill is requested. Adding or removing a SKILL.md changes the discovered set without editing a candidate list.
The upstream agents/*.yaml files are not included. DeepSeek Harness does not enforce allowed-tools or disallowed-tools. MCP references in skill content, including burp-mcp, require separate entries in mcp.servers. The package is documented for authorised use only.
Written from the project's own documentation and kept in sync with it. Where the two disagree, the source is authoritative — read the README on GitHub
Same category
zhu1090093659
Skill center for the dsh web GUI: browse all loaded skills grouped by source, enable or disable model invocation, create new skills, and delete into a recoverable trash.
Installed cleanly when we ran it
chuspeeism
现代化可灵活嵌入的任务面板，支持 Codex、DeepSeek Harness
Installed cleanly when we ran it
Alisa0808
Turn one topic into a finished Vox-style paper-collage explainer/ad video — automated end to end on Atlas Cloud + ffmpeg. An agent skill.
Installed cleanly when we ran it
GanyuanRan
Software-engineering method pack for coding agents, with skills for baseline-first planning, systematic debugging, prompt hygiene, verification before completion, and repair/retirement tracking.
Installed cleanly when we ran it
superdesigndev
Design skill for UI and marketing graphics on the Superdesign canvas: reads the repo for context, extracts its design system, then generates and iterates branchable design drafts, flow pages, and reusable components through the Superdesign CLI.
Installed cleanly when we ran it