dsh-purge

Product Introduction

1. Definition: DSH-Purge is a specialized, local-installation plugin for the official DeepSeek Harness (DSH) AI agent framework. Technically, it is a prompt injection and runtime patching tool designed for security red teaming and robustness testing.
2. Core Value Proposition: It exists to bypass and analyze the restrictive guardrails and safety filters built into AI models and the DSH framework itself. Its core function is to enable controlled "jailbreak" testing by applying customizable prompt engineering and patching the host environment's default security policies, allowing researchers and developers to explore the full, unfiltered capabilities of AI models in a local, controlled setting.

Main Features

1. Host Environment Patching: The plugin directly modifies the locally installed @deepseek-ai npm packages and configuration files of the official DSH application. It works by backing up original files (creating .dshpurge.bak copies) and then overwriting them with patched versions that adjust security prompts, permission policies, and tool execution limits. This happens only after user confirmation via the "Apply" button in the plugin's UI.
2. Dynamic Prompt Injection & Rule Management: It provides a sidebar interface within DSH to manage multiple layers of prompt injection. Users can edit a master prompt-inject.md file, enable/disable different rule sets (like AGENTS.md or CLAUDE.md), and configure workspace policy (strict/fallback/always). The system dynamically decides the final system prompt for each chat session based on these settings, overriding the default DSH baseline.
3. Red Team Skill Integration & Sandbox Management: Includes a dedicated "Red Team Operations" panel (演练台) for authorized security testing. It allows the import of skill packages into the official $DSH_HOME/skills/ directory. The plugin also manages network scoping via a user-defined net-scope-allow.txt file, strictly prohibiting access to IPs/hostnames in mainland China, Hong Kong, and Macau except for explicitly registered ones.

Problems Solved

1. Pain Point: The inability to conduct legitimate security research and capability testing on AI agent frameworks due to overly restrictive, "locked-down" default behaviors that conflate model refusals with host-level拦截 (interceptions).
2. Target Audience: Cybersecurity red team professionals, AI safety researchers, penetration testers, and developers who need to audit the robustness of AI agents and their underlying models within a controlled, local environment.
3. Use Cases: Assessing the true vulnerability of an AI agent to prompt injection attacks; testing the boundaries of an AI's tool usage permissions in a sandbox; performing authorized internal red team exercises on AI-powered systems; developing and testing countermeasures against AI jailbreaks.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros: Offers granular control over the AI's operational constraints. Works directly on the official DSH build without requiring a source code fork. Features a user-friendly UI integrated into DSH for managing patches and prompts. Clearly separates host-level restrictions from model-level refusals for accurate analysis. Actively maintained with specific version support (e.g., DSH 0.2).
   • Cons: Complexity requires careful setup and understanding of DSH profiles. Installation is manual via GitHub archive, not a standard npm package. Misconfiguration can destabilize the DSH environment. Its powerful capabilities pose significant risk if used improperly or maliciously. Future versions will be closed-source and distributed only via a private Telegram channel after October 26, 2026.

2. Key Alternatives & Differentiation:

   • Manual Prompt Engineering: Users could manually craft jailbreak prompts in each chat. DSH-Purge differentiates by providing a persistent, structured framework with rule sets, host patching for deeper access, and a managed workflow, far surpassing one-off prompts.
   • Other Jailbreak Repositories (e.g., on GitHub): Many focus solely on prompts for web-based chatbots like ChatGPT. DSH-Purge is specifically architected for the DeepSeek Harness framework, targeting its unique runtime, sandbox, and tool-calling layers, which generic prompts cannot affect.
   • Forking DSH Source Code: While possible, forking requires deep technical expertise to modify and maintain. DSH-Purge works as a non-destructive plugin applied to the pre-built official binary, offering a reversible ("Revert" function) and updatable approach without managing a full codebase fork.

Frequently Asked Questions (FAQ)

1. Is DSH-Purge safe to use? DSH-Purge is a powerful security testing tool intended for use in legally authorized, controlled environments only. It modifies your local DSH installation and can disable safety features. It is not safe for general or production use and must not be used for unauthorized testing, attacks, or to generate harmful content.
2. Does DSH-Purge work with the web version of DeepSeek Harness? Yes, DSH-Purge explicitly supports both the official DSH desktop application (EXE) and the official DSH web client. However, they require separate installations into their respective --profile web and --profile desktop directories, and patches must be applied independently within each client.
3. How do I install dsh-purge since it's not on npm? You must install it directly from the GitHub repository archive using the DSH plugin CLI command: dsh plugin --profile [web/desktop] add https://github.com/YuJunZhiXue/dsh-purge/archive/refs/heads/master.tar.gz. Do not use pnpm add dsh-purge.
4. What happens when I click "Apply" in the dsh-purge sidebar? Clicking "Apply" triggers the core patching process: it backs up original DSH files, overwrites them with modified versions to alter security policies, injects the default encrypted prompt, and then automatically restarts the DSH client to load the new patched code into the active process.
5. Can I use dsh-purge to test models other than DeepSeek's? While its default prompts are tailored for models like "小码酱," the framework is designed to be model-agnostic. The core value is in bypassing the DeepSeek Harness framework's restrictions. The effectiveness of the prompt injection against different underlying AI models (e.g., Claude, GPT) will vary and depends on the user configuring appropriate rule sets and prompts.