Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill dsh-onboardinggit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-onboarding)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-onboarding"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/dsh-onboarding/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-onboarding"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/dsh-onboarding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 39 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01485 |
| Opus 5 | $0.00030 | $0.00743 |
| Sonnet 5 | $0.00012 | $0.00297 |
| Haiku 4.5 | $0.00006 | $0.00148 |
Grade A, and why
dsh-onboarding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
带一个人跑通 DeepSeek Harness
这是引导，不是照抄清单。先判断对方卡在哪一层，再给对应的动作；不要把七个步骤一次性倒给一个只是端口被占用的人。
DSH 处于 developer preview，官方明确警告会有破坏兼容性的变更。任何"应该可以"的说法都要用实际命令验证一次。
事实来源
- 官方 README 与
docs/user/guide/—— 启动方式与 Web UI 指南 docs/user/develop/basic/—— 插件编写与cordis.yml加载packages/skill/skill-filesystem/README.md—— 技能发现路径与 frontmatter 规则dsh --help/dsh --profile web --dump-config—— 当前版本的权威命令面
不要凭记忆回答版本相关的问题。dsh --version 和 --dump-config 的输出才算数。
先分清四个东西
新手最常见的混乱是把这四层当成一个东西。回答任何问题前先定位在哪一层：
| 层 | 是什么 | 出问题的表现 |
|---|---|---|
| 模型 | DeepSeek 的 API，在云端 | 401、余额不足、限流 |
| Harness（DSH） | 本机跑的 agent 运行时 | 端口占用、Node 版本、插件加载失败 |
| Profile | 一组插件的组合（web / headless） |
某个工具不存在、配置没生效 |
| 工作区 | agent 实际读写的目录 | 找不到文件、权限被拒 |
"它没反应"这类描述必须先追问是哪一层，否则会浪费两轮。
启动
最短路径，不需要克隆仓库：
npx @deepseek-ai/dsh web
默认服务在 http://127.0.0.1:3080。首次运行会在 ~/.dsh/ 下生成 profiles/、skills/、storages/。
从源码跑（需要改 DSH 本身时才用）：
git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness && pnpm install && pnpm run build && pnpm dsh web
不启动服务、只看组装后的配置：
dsh --profile web --dump-config
这条命令在排查"某个插件到底加载了没有"时比读文档快得多。
常见启动失败
按出现频率排序，每条都给可执行的下一步：
- 端口被占用 ——
EADDRINUSE: 127.0.0.1:3080。先lsof -nP -iTCP:3080 -sTCP:LISTEN看是谁占的；常见是自己之前起的实例没退干净。 - Node 版本 —— DSH 要求较新的 Node。
node -v确认后再排查其他方向。 - 路径含空格或中文 —— 插件路径必须是绝对路径，含空格时务必加引号。
- 首次 npx 下载慢 —— 不是卡死。观察是否有网络代理需要配置。
- API Key 未配置 —— 启动本身不需要 Key，但任何模型任务都需要。启动成功不等于能对话。
权限：看懂它要什么
DSH 会请求读文件、执行命令、写文件。批准前至少确认三件事：
- 要执行的确切命令，包括参数——不是"运行测试"这种概括
- 工作目录——是不是你以为的那个目录
- 写入范围——会碰哪些文件
拒绝一次不会破坏会话。第一次使用时，主动拒绝一个越界请求是有价值的练习：你会看到被拒后的表现，也会知道边界在哪。
不要在真实项目上做第一次尝试。 新建一个空目录作为工作区，代价为零。
技能（skill）：DSH 的能力扩展
技能是纯 Markdown，不需要写代码、不需要构建、不需要发包：
~/.dsh/skills/<name>/SKILL.md
---
name: my-skill # 必需，kebab-case
description: ... # 必需，决定模型何时会用它
---
发现路径按优先级（rank 小的优先）：
| Rank | 位置 |
|---|---|
| 100 | <项目>/.dsh/skills |
| 200 | <项目>/.agents/skills |
| 400 | ~/.dsh/skills |
| 500 | ~/.agents/skills |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 134 lines · 60 tokens per session scan A 5758fc1d07b6
dsh-onboarding is a skill published in the GitHub repository pingfanfan/hello-dsh (89 stars, last pushed 25d ago), licensed MIT. It adds 60 tokens to every session and 1,485 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
codex-sync
Operate dsh-codex-sync from this session — preview and import Codex chats, toggle Skills/MCP/import settings, check MCP mirror health, install the reverse MCP bridge.
wizard
Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…
dsh-web-skin-developer
Build a new skin for the dsh-web skin collection (DSH Web GUI) and publish it into the Skin Center — the first-level settings section — scaffold with scripts/dsh-skin-new, author the v2 skin.json manifest plus skin.css token remap (pure asset directory, no package.json, no build step), validate with scripts/dsh-skin…
dsh-sdk-upgrade
Safely select and install a compatible official @deepseek-ai SDK release for dsh plugin projects (dsh-web, dsh-trading, and similar monorepos) from npm using an isolated worktree, explicit cohort review, CI-equivalent validation, and controlled rollout — including syncing the project's declared DSH host-version floor…