DeepSeek Harness is an open-source framework for building and running AI agents, organized so that its functionality is provided through plugins. Developers use it to launch agent workflows through a local web interface or from source, while the catalogue add-ons extend the harness as plugins.
Borrowing it
Nothing to install: this file belongs to deepseek-ai/deepseek-harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/deepseek-ai/deepseek-harness/master/.agents/skills/dsh-code-review/SKILL.mdgit clone --depth 1 https://github.com/deepseek-ai/deepseek-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/deepseek-ai/deepseek-harness/dsh-code-review)<a href="https://agentmods.dev/skills/deepseek-ai/deepseek-harness/dsh-code-review"><img src="https://agentmods.dev/badge/skills/deepseek-ai/deepseek-harness/dsh-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/deepseek-ai/deepseek-harness/dsh-code-review"><img src="https://agentmods.dev/badge/skills/deepseek-ai/deepseek-harness/dsh-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk warn
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02163 |
| Opus 5.5 | $0.00022 | $0.00865 |
| Sonnet 5.5 | $0.00011 | $0.00433 |
| Haiku 4.5 | $0.00005 | $0.00216 |
Grade A, and why
dsh-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
7 near-identical copies found in the catalogue:
- dsh-code-review — 92% identical, 25 lines differ
- dsh-code-review — 86% identical, 26 lines differ
- dsh-code-review — 86% identical, 26 lines differ
- dsh-code-review — 86% identical, 25 lines differ
- dsh-code-review — 86% identical, 26 lines differ
- dsh-code-review — 86% identical, 26 lines differ
- alego-code-review — 81% identical, 40 lines differ
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reviewing a DeepSeek-Harness PR
This skill is guidance, not a complete checklist. Verify and fetch the PR's live base and exact head, then run pnpm --silent run change-scope --base <verified-base-ref> --head <verified-head-ref> before reading the diff and enough surrounding code to understand the design. The report identifies paths and dirty layers but does not replace semantic review. Re-establish the base and rerun it after a retarget or merge. Prioritize correctness, lifecycle, security, and broken required behavior over style; a short review with one substantiated blocker is better than a list of nits.
Read the requirements before judging the diff. Map the changed paths to the artifacts below, open each owning page from Sources of truth, and only then read the diff against those requirements. Judging a diff against memory of the rules is how a violation passes review.
Sources of truth
- AGENTS.md and packages/AGENTS.md: standing repository and package authoring rules.
- docs/defensive-patterns/: the architecture requirements a change must satisfy and the habits behind them. Each page owns one artifact; read every page the diff touches:
- general.md — timing, async state, value representation, shared ownership, decentralization, refactors, migrations, performance evidence, disposal, callbacks, subprocesses.
- package-surface.md — exports, package shape, build faces, dependency declarations, resolve hooks.
- remote-and-api.md — remote services,
@Remotemethods, API dispatch, business ownership inpackages/api. - client-components.md — client components, slots, stores, hooks, effects, shared base packages.
- conversation-and-session.md — projection reads, Session retention, conversation nodes, renderers.
- docs/AGENTS.md: documentation placement and prose discipline.
- dsh-prose-standard: required coverage and editorial judgment for comments, docs, prompts, and visible strings.
- dsh-ci-test-reliability: isolation and regression-proof rules for resource-owning, asynchronous, or flaky tests and fixtures.
- dsh-client-ui-ux: feedback-surface choice, overlay safety, platform window adaptation, and visual token discipline for product-user-visible GUI changes.
- dsh-error-handling: failure classification, handling ownership, containment, state guarantees, and actionable reports.
- docs/testing.md and the quality-gates reference: required test tiers and gates.
- Agent Notes: design rationale. Treat disagreement with an Agent Note as a design discussion, not an automatic veto.
- For bilingual changes, read translation-rules.md and terminology.md; the extended translation skill is outside automatic review and runs only on explicit user invocation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +7 lines f8c6985c099d
- 6d ago Changed · +2 lines 8a28cc43eaa7
- 13d ago Changed · -1 lines 9163880d1a57
- 22d ago Changed · +1 lines 8a91213a7d97
- 1mo ago Changed 6c862b17bca7
- 1mo ago First seen · 53 lines · 54 tokens per session scan A d5231233f899
dsh-code-review is a skill published in the GitHub repository deepseek-ai/deepseek-harness (250,433 stars, last pushed today), licensed MIT. It adds 54 tokens to every session and 2,163 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
triage
Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.
code-review
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use…
improve-codebase-architecture
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
manage-taskboard
Manage work in the native DeepSeek Harness Taskboard with exact task ids and optimistic versions. Use when an Agent must inspect project work, claim an eligible todo, record progress or blockers, verify an implementation, submit it for human review, or release its own claim; also use when a human asks how to accept…
industry-research-method
A Chinese-language method for researching an industry by mapping its supply chain, tracking policies and news, and writing sourced reports. It separates the chain into upstream inputs, midstream production, and downstream distribution or use.
company-research-method
A documented process for researching a company using supplied files and selected public sources. It produces a company overview with business details, sourced financial figures, and stated risks.