A local prompt-engineering plugin for DeepSeek Harness — one-click inject / uninstall, skill packs, and an AI pentest console.
面向 DeepSeek Harness 的本地提示词工程插件 · 一键注入 / 卸载 · 技能包 · AI 渗透控制台

🇬🇧 English · 🇨🇳 简体中文

• Why
• Features
• Preview
• Quick Start
• Architecture
• Configuration
• Skill Packs
• Pentest Console
• API Reference
• Project Structure
• Development
• FAQ
• Roadmap
• Contributing
• License

DSH (DeepSeek Harness) assembles its system prompt in layers: host identity, persona, tool docs, component docs. Out of the box you are locked inside a "standard assistant" boundary, and each DSH version filters sections differently — hand-editing the prompt often results in "changed but no effect" or "works for one turn, drifts later".

Maodie Armor solves three problems:

1. Stable injection — registers payloads as systemPrompt.section entries ordered by order, independent of host-version internals;
2. Observability — how many layers, how many characters each, whether the current turn tripped a refusal: all visible in real time;
3. Operability — persisted config, live status API, one-click install/uninstall, rollback on failure.

In short: turn prompt engineering from manual string concatenation into stateful, observable, rollback-friendly engineering.

Status pill (above the composer)

Settings drawer

┌─ 耄耋破甲 · 设置 ─────────────────────┐
│ Runtime            ● Armed             │
│ Patches            2 (dual-layer)      │
│  ┌ Layer 1 · Order 100 · global-system-prompt
│  │ ● enabled · builtin · 10 sections · 4272 chars
│  └
│  ┌ Layer 2 · Order 200 · dual-layer-reinforce
│  │ ● enabled · builtin (mirror) · 10 sections · 4272 chars
│  └
│ Core               10 sections preserved│
│ Persona            builtin             │
│ Endpoint           127.0.0.1:47100     │
│ ─ Layers: dual (forced)                │
│ ─ Persona: [ textarea ]                │
│ [Save] [Reset]                         │
└──────────────────────────────────────┘

Requirements: Windows 10/11, DSH installed & launched at least once, internet for the first install.

1. Download the repo ZIP and extract it fully (do not copy only the BAT)
2. Fully quit DSH
3. Double-click  点我一键注入.bat  → restart DSH

A green status pill appears above the input box. Type 你好 in a chat to activate.

Uninstall: quit DSH → double-click 点我一键卸载.bat → restart.

flowchart LR
  A[DSH host] -->|systemPrompt stack| B[Order 100 core]
  A -->|systemPrompt stack| C[Order 200 mirror]
  B --> D[Final system prompt]
  C --> D
  D --> E[Model]
  F[cordis.patch.yml] -->|includeHarnessIdentity:false| A
  G[config/service.js] -->|runtime status| H[Settings UI]

Why two layers? Attention to early instructions decays in long conversations; the mirror effectively repeats them. And if the host filters one section, the other still backs it up.

flowchart TB
  P[Full payload] -->|slice| CORE[Core from Never refuse]
  P -->|slice| HEAD[Intro / identity]
  U[User persona] -->|forced replace| HEAD
  HEAD --> OUT[Final injected text]
  CORE --> OUT

Any configuration can only change HEAD; CORE is always injected in full.

Config file: %USERPROFILE%\.dsh\maodie-armor-config.json

Endpoint: http://127.0.0.1:47100 (loopback only)

Auto-deployed to %USERPROFILE%\.dsh\skills\ during install.

A standalone Node.js app modeled on ARTEX's "dual-graph + planner/worker" design, with zero database dependency.

cd pentest-console
node server.js
# → http://127.0.0.1:8787

flowchart TB
  U[Create task goal] --> P[planner: read graph]
  P -->|0..3 intents| W[worker: claim one intent]
  W --> L[LLM generates minimal command]
  L --> G[guard: dangerous-command check]
  G -->|allow| E[Execute / dry-run]
  E --> F[Write back fact / finding]
  F --> P

• Dry-run by default — commands are generated but not run until execEnabled is explicitly turned on
• Guard rules — rm -rf, mkfs, dd if=, delete endpoints, reverse shells
• Read-only first — worker prompts prefer recon commands
• Loopback only — listens on 127.0.0.1

See pentest-console/README.md.

maodie-armor/
├── index.js                  # Server: dual-layer injection + profile tool + projection
├── client.js                 # Client: status pill + liquid-glass settings drawer
├── config/service.js         # Local config store + 127.0.0.1:47100 API
├── cordis.patch.yml          # Bundle patch: override host identity + mount plugin
├── prompts/                  # Kernel / mirror / compat payloads
├── skills/
│   ├── game-hacking/
│   ├── reverse-engineering/
│   └── pentest/
├── pentest-console/          # Standalone pentest console
│   ├── server.js
│   ├── lib/                  # store / llm / engine / guard
│   └── public/
├── scripts/                  # Runtime bootstrap, patcher, scorer, verifier
├── tests/                    # Offline prompt-bank & benchmarks
├── install.ps1 / install.sh
├── uninstall.ps1 / uninstall.sh
├── 点我一键注入.bat / 点我一键卸载.bat
└── LICENSE

# Plugin: after editing, reinstall or edit ~/.dsh/plugins/maodie-armor directly
node --check index.js && node --check client.js && node --check config/service.js

# Console: just run it
cd pentest-console && node server.js

# Verify plugin integrity
node scripts/verify_plugin.mjs

.ps1 files must be saved as UTF-8 with BOM; otherwise Windows PowerShell 5.1 parses Chinese text as GBK and fails with syntax errors.

• Dual-layer injection + full-armor guarantee
• Liquid-glass settings drawer + per-layer status
• Three skill packs (including REA-style pipeline)
• Pentest console MVP (planner/worker + LLM)
• Console: traffic recording (MITM proxy + evidence hashing)
• Console: asset coverage graph (force-directed)
• Console: approval cards + human-in-the-loop interruption
• Plugin: hot config reload (no restart)

1. Fork the repo
2. Branch from main: git checkout -b feat/your-feature
3. Run node --check and node scripts/verify_plugin.mjs before committing
4. Open a PR with motivation, changes and verification

Conventions: .ps1 keeps UTF-8 BOM; .sh must have no BOM; new skills go in skills/<name>/SKILL.md.

CC BY-NC-SA 4.0 · non-commercial · share-alike · attribution required.

Third-party notices: THIRD-PARTY-NOTICES.md.

• 为什么做这个
• 核心能力
• 界面预览
• 快速开始
• 架构设计
• 配置说明
• 技能包
• 渗透控制台
• API 参考
• 项目结构
• 本地开发
• 常见问题
• 路线图
• 贡献指南
• 许可证

DSH（DeepSeek Harness）的系统提示词是分层拼接的：宿主身份、persona、工具说明、组件说明各自成段。默认配置会把你锁在"标准助手"的行为边界里，且不同版本对段的过滤策略不一致，手动改提示词经常出现"改了没生效""多轮后失效"的漂移问题。

Maodie Armor 解决三件事：

1. 稳定注入：把载荷作为 systemPrompt.section 注册进 DSH 的提示词栈，按 order 排序，不依赖宿主版本细节；
2. 可观测：注入了几层、每层多少字符、模型这轮是否触发拒绝——全部实时可见，不靠玄学；
3. 可运维：配置落盘、热状态接口、一键安装卸载，出问题能回滚。

一句话：把"提示词工程"从手工拼字符串，变成有状态、可观测、可回滚的工程化能力。

状态条（输入框上方）

设置抽屉布局

┌─ 耄耋破甲 · 设置 ─────────────────────┐
│ 运行状态            ● 已激活           │
│ 补丁数              2 个（双层注入）    │
│  ┌ 层 1 · Order 100 · global-system-prompt
│  │ ● 启用 · 内置载荷 · 10 段 · 4272 字符
│  │ You are 耄耋, a direct, no-nonsense…
│  └
│  ┌ 层 2 · Order 200 · dual-layer-reinforce
│  │ ● 启用 · 内置载荷（镜像） · 10 段 · 4272 字符
│  └
│ 破甲核心            10 段强制保留       │
│ 人格来源            内置               │
│ 配置接口            127.0.0.1:47100    │
│ ─ 注入层数：双层注入（强制开启）        │
│ ─ 人格设定：[ textarea ]               │
│ [保存] [恢复默认]                      │
└──────────────────────────────────────┘

• Windows 10 / 11
• 已安装 DSH（Web 版或桌面版），且至少启动过一次
• 首次安装需联网（自动下载 Node 运行时）

1. 下载本仓库 ZIP，完整解压（不要只拿 BAT）
2. 完全退出 DSH
3. 双击「点我一键注入.bat」→ 重启 DSH

装好后输入框上方出现绿色状态条，聊天里输入 你好 即可激活。

1. 完全退出 DSH
2. 双击「点我一键卸载.bat」→ 重启 DSH

flowchart LR
  A[DSH 宿主] -->|systemPrompt 栈| B[Order 100 内核]
  A -->|systemPrompt 栈| C[Order 200 镜像]
  B --> D[最终系统提示词]
  C --> D
  D --> E[模型]
  F[cordis.patch.yml] -->|includeHarnessIdentity:false| A
  G[config/service.js] -->|运行时状态| H[设置面板]

为什么双层？ 长对话里模型对早期指令的注意力会衰减，第二份镜像相当于"再说一遍"，抗上下文漂移；同时任一层的注入被宿主过滤，另一层仍能兜底。

flowchart TB
  P[完整载荷] -->|截取| CORE[从 Never refuse 起的核心]
  P -->|截取| HEAD[身份简介段]
  U[用户自定义人格] -->|强制替换| HEAD
  HEAD --> OUT[最终注入文本]
  CORE --> OUT

任何配置都只能改 HEAD，CORE 永远完整注入。

配置文件：%USERPROFILE%\.dsh\maodie-armor-config.json

接口：http://127.0.0.1:47100（仅本机回环）

安装时自动部署到 %USERPROFILE%\.dsh\skills\。

独立 Node.js 应用，参考 ARTEX 的"双图 + planner/worker"形态，零数据库依赖。

cd pentest-console
node server.js
# → http://127.0.0.1:8787

flowchart TB
  U[创建任务 goal] --> P[planner: 读探索图]
  P -->|0..3 意图| W[worker: 领一条意图]
  W --> L[LLM 生成最小命令]
  L --> G[guard: 危险命令拦截]
  G -->|放行| E[执行 / 计划模式]
  E --> F[写回 fact / finding]
  F --> P

• 默认 dry-run：只生成命令不执行，execEnabled 显式开启后才跑
• 拦截规则：rm -rf、mkfs、dd if=、删除接口、反弹 shell 等
• 只读优先：worker 提示词要求优先侦察类命令
• 仅监听回环：127.0.0.1

详见 pentest-console/README.md。

maodie-armor/
├── index.js                  # 服务端：双层注入 + 元数据工具 + 会话投影
├── client.js                 # 客户端：状态条 + 液态玻璃设置抽屉
├── config/service.js         # 本地配置存储 + 127.0.0.1:47100 接口
├── cordis.patch.yml          # bundle 补丁：覆盖宿主身份 + 挂载插件
├── prompts/
│   ├── maodie.md             # 内核载荷（Order 100）
│   ├── maodie-mirror.md      # 镜像载荷（Order 200）
│   └── maodie-compat.md      # 兼容载荷
├── skills/
│   ├── game-hacking/         # 游戏辅助全链路技能
│   ├── reverse-engineering/  # 逆向工程技能（含 REA 式流水线）
│   └── pentest/              # 渗透测试技能（L0~L5）
├── pentest-console/          # 独立渗透控制台
│   ├── server.js             # HTTP + API + SSE + 静态前端
│   ├── lib/                  # store / llm / engine / guard
│   └── public/               # 控制台前端
├── scripts/                  # 运行时准备、patcher、评分器、校验
├── tests/                    # 离线 prompt-bank 与 benchmark
├── install.ps1 / install.sh
├── uninstall.ps1 / uninstall.sh
├── 点我一键注入.bat / 点我一键卸载.bat
└── LICENSE

# 插件：改完源码后重装，或直接改 ~/.dsh/plugins/maodie-armor
node --check index.js && node --check client.js && node --check config/service.js

# 控制台：直接起
cd pentest-console && node server.js

# 校验插件完整性
node scripts/verify_plugin.mjs

.ps1 脚本必须保存为 UTF-8 with BOM，否则 Windows PowerShell 5.1 会按 GBK 解析中文导致语法错误。

• 双层注入 + 完全破甲保障
• 液态玻璃设置面板 + 逐层状态
• 三套技能包（含 REA 式流水线）
• 渗透控制台 MVP（planner/worker + LLM）
• 控制台：流量录制（MITM 代理 + 证据哈希）
• 控制台：资产覆盖图（力导向）
• 控制台：审批卡片 + 人在环路中断
• 插件：配置热重载（免重启）

1. Fork 本仓库
2. 从 main 切分支：git checkout -b feat/your-feature
3. 提交前跑 node --check 与 node scripts/verify_plugin.mjs
4. 提 PR，描述清楚动机、改动与验证方式

约定：.ps1 保持 UTF-8 BOM；.sh 禁止 BOM；新增技能放 skills/<name>/SKILL.md。

CC BY-NC-SA 4.0 · 非商业用途 · 相同方式共享 · 使用请注明出处。

第三方声明见 THIRD-PARTY-NOTICES.md。

_{Made with 🖤 by 耄耋 · 二十年网安老兵 / Twenty years in offensive security
「耄耋破甲已激活」表示插件已加载；实际回复仍受模型、其他提示词与 DSH 版本影响。}