Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pingfanfan/hello-dsh --skill dsh-troubleshootgit clone --depth 1 https://github.com/pingfanfan/hello-dshWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-troubleshoot)<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-troubleshoot"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/dsh-troubleshoot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pingfanfan/hello-dsh/dsh-troubleshoot"><img src="https://agentmods.dev/badge/skills/pingfanfan/hello-dsh/dsh-troubleshoot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 102 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01393 |
| Opus 5 | $0.00030 | $0.00696 |
| Sonnet 5 | $0.00012 | $0.00279 |
| Haiku 4.5 | $0.00006 | $0.00139 |
Grade A, and why
dsh-troubleshoot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DSH 排障
DSH 的故障有个特点:很多问题不报错。配置写了没生效、插件加载了但没注入、技能存在但不出现,这类静默失效比崩溃难查得多,所以要先排它们。
处于 developer preview,官方明确警告有破坏性变更。任何"应该可以"都要用命令验证。
先定位在哪一层
| 层 | 症状 |
|---|---|
| 进程起不来 | 端口占用、Node 版本、依赖安装失败 |
| 配置没生效 | 命令跑了但行为没变、插件像不存在 |
| 插件加载但异常 | cannot get property X without inject |
| 工具不存在 | UNKNOWN_TOOL |
| 技能不出现 | 文件在那儿但列表里没有 |
| 模型层 | 401、限流、余额 |
先用这条命令确认组装后的配置,不启动服务:
dsh --profile web --dump-config
它比读文档快,也比猜准。想知道某个插件到底加载了没有,直接 grep 它的输出。
静默失效:优先排查
一、!!js 写在了 config 之外
这是官方自己踩过并写了复盘的坑(docs/postmortem/0002)。
- insert:
- id: fs
name: '@deepseek-ai/dsh-tool-fs'
disabled: !!js ctx.mode !== 'full' # ← 永远为真
Cordis 只在插件的 config 内部对 !!js 求值。disabled、isolate、intercept 这些配置项元数据是直接读取的,拿到的是一个表达式对象,而对象恒为 truthy。结果是插件在所有模式下永久禁用,没有任何诊断信息。
修法:条件组合改用显式的 overlay 文件,不要在元数据字段上用表达式。
二、插件带了 default export
同样有官方复盘(docs/postmortem/0001)。症状是 cannot get property "agents" without inject。
export const name = 'acp'
export const inject = ['agents', 'sessions']
export function apply(ctx, config) { }
export default apply // ← 就是这行
Loader 的 unwrapExports 优先取 exports.default ?? exports。有默认导出时它解析出裸的 apply 函数,而 inject、name、Config 作为同级命名导出被整体丢弃。插件于是在一个没注入任何服务的 fiber 里运行,第一次访问 ctx.xxx 就崩。
注意这个 bug 当时有 178 个绿色单元测试和 100% 行覆盖率,因为所有测试都是手动挂载插件的,绕过了真实 Loader 路径。
修法:删掉 default export,只保留命名导出。
三、技能不见了
先查 frontmatter 键名,不要先查路径:
user-invocable: true # 对
userInvocable: true # 整条技能被丢弃,只有一条警告
调用策略键必须 kebab-case,值必须是布尔或 yes/no/on/off/1/0。写错的结果是整个技能被丢弃,不是忽略那个字段。
其次查:name 是不是 kebab-case、description 有没有缺、是不是放成了嵌套目录(只扫一层)。
四、UNKNOWN_TOOL
意味着模型调用了注册表里不存在的工具。顺序:
--dump-config确认对应的插件真的在配置里- 确认它没有被
disabled掉(回到第一条) - 确认它的 fiber 真的 ACTIVE,而不是因为依赖不满足停在 INACTIVE
依赖不满足时组件会静默保持不活跃,这是 Cordis 的设计:consumer 声明的依赖没有 provider 时它不会报错,只是不激活。
进程起不来
按出现频率:
EADDRINUSE: 127.0.0.1:3080——lsof -nP -iTCP:3080 -sTCP:LISTEN看谁占的。最常见是自己之前的实例没退干净。- Node 版本 ——
node -v先确认,再排查别的方向。 - 首次
npx很慢 —— 在下载,不是卡死。 - 路径含空格 —— 插件路径必须绝对路径,含空格务必加引号。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 125 lines · 61 tokens per session scan A b0b4c9798b5b
dsh-troubleshoot is a skill published in the GitHub repository pingfanfan/hello-dsh (90 stars, last pushed 27d ago), licensed MIT. It adds 61 tokens to every session and 1,393 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dsh-plugin-guide
Use when developing, reviewing, packaging, debugging, or answering questions about DeepSeek Harness (DSH) plugins — the plugin-based agent harness on vendored Cordis. Applies the official plugin-development constraints (plugin contract, cordis.yml layers, services/events/effects, tool DSL, bundles/profiles) backed by…
systematic-debugging
Diagnose failures from runtime evidence before editing code.
diagnosing-bugs
A structured workflow for finding the cause of difficult bugs and performance slowdowns. It first builds a small, repeatable check that clearly shows whether the problem is present, then uses tests, scripts, traces, or comparisons to investigate it.
dsh-debug-session
A troubleshooting guide for DSH startup failures, inactive plugins, and broken sessions. It describes collecting logs, narrowing down causes, backing up configuration, and rolling back changes.
diagnosing-bugs
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
dsh-web-community-plugin-developer
Develop a DSH community plugin and register it in the dsh-web Community Plugins index — author the plugin in the contributor's own repository following the official cordis bundle standard, add its entry to packages/dsh-community-plugins/community.json, regenerate the index with scripts/community-index, rebuild and…