First release.
Provenance-based indirect prompt-injection guard for DeepSeek Harness: taints an agent when a tool result arrives from an untrusted source, gates the privileged calls that follow, and unconditionally refuses credential material passed to a network-capable tool.
Install without a build step — the attached tarball ships prebuilt lib/, so pnpm does not need permission to run this package's build script:
dsh plugin --profile <name> add https://github.com/sashankh/dsh-taintguard/releases/download/v0.1.0/dsh-taintguard-0.1.0.tgzMeasured on AgentDojo v1.2.1 (method and caveats in eval/):
| Measurement | Result |
|---|---|
| Attack payloads caught by the content detector | 35/355 — 9.9% |
| Benign strings falsely flagged | 0/345 — 0.00% |
| Payloads arriving via an observed reader tool | 355/355 — 100% |
| Consequential calls gated with origin tainting on | 80/82 — 97.6% |
The detector is telemetry, not a boundary; provenance carries the load, and it is coarse. Both numbers are published because they are the honest characterisation of what this does.