deepseek-harness-windows-deploy

• Outcome: Pass
• Latest audit: Aug 14, 2026 · 4:48 PM UTC
• Version: 1.0.4

Overview

This is a narrowly scoped Windows DeepSeek Harness deployment guide with disclosed, user-confirmed troubleshooting steps that fit its purpose.

Install this only if you are deploying or troubleshooting DeepSeek Harness on Windows. Treat the NODE_OPTIONS workaround, stopping processes on port 3080, and deleting the specified ~/.dsh symlink as high-impact actions: have the agent explain the exact command and get your confirmation first, and do not reuse those patterns outside this Harness troubleshooting context.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The auto-trigger guidance is broad enough that an agent may invoke this skill for generic Windows build, launch, or troubleshooting tasks involving DeepSeek Harness without sufficiently confirming that the task is strictly within the skill's narrow deployment scope. In an agentic environment, over-broad triggering can cause the model to apply hazardous remediation patterns such as clearing NODE_OPTIONS, killing a process on port 3080, or deleting files under ~/.dsh in contexts where they are unnecessary or inappropriate.

Session Persistence

Medium

• Category: Rogue Agent

Content

`NODE_OPTIONS=--require=.../genie-safe-delete.cjs`，把 `fs.rm/unlink` 劫持去调用
  `genie-trash.exe`（Windows 上超时，并以 fail-closed 方式报错）。
- **影响点**：Harness 设置持久化 `FileSettingsProvider.persistSection` 用
  `withFileLock`（mkdir → writeFileAtomic → `rm(lock)`），`finally` 里的 `rm(lock)` 被拦截抛错
  → `mutate` 失败 → 前端只显示通用文案 **"暂时无法保存确认状态，请重试"**（即内测声明的确认步骤）。
  **实际上数据（`~/.dsh/settings.yaml` 的 `ui-onboarding.welcomeNoticeVersion`）已写成功，只是内存未标记为已确认。**
- **解法**：启动 dsh 时前缀 **`NODE_OPTIONS=""`**（node 不加载该钩子，锁清理恢复正常）。此变量仅对这条启动命令的子进程生效，不影响其他进程；**执行前请向用户说明并确认**。

• Confidence: 90% confidence
• Finding: The document recommends clearing NODE_OPTIONS to disable a sandbox-injected safe-delete hook, which weakens environmental protections around file-deletion behavior. Even though the stated goal is to restore normal application behavior, instructing users to bypass a security control can enable unintended or unsafe file operations if the process or surrounding workflow is compromised.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## 核心结论（先记住这三条）

1. **WorkBuddy Bash 沙箱会给每个 node 进程注入 `NODE_OPTIONS=--require=.../genie-safe-delete.cjs`**，把 `fs.rm/unlink` 劫持成走 `genie-trash.exe`，Windows 上超时并以 fail-closed 方式报错。Harness 所有"带锁的原子写"（设置持久化、工作区持久化）都在 `finally` 里 `rm` 锁文件，会被它搞挂。**唯一可靠解法：启动 dsh 时前缀 `NODE_OPTIONS=""`。**
2. **不要用 `run_in_background=true` 在 WorkBuddy Bash 里常驻 dsh web**——工具会在命令返回后清理整个进程组，node 被杀、端口释放。用命令内 `&` 后台即可。
3. **工作区持久化在 `~/.dsh/storages/workspace.json`（不是 settings.yaml）**；会话存储在 `~/.dsh/sessions/<sanitized-path>/`。"选不中工作区" 绝大多数是 **Web UI 客户端状态陈旧**，硬刷新（Ctrl+Shift+R）即可；后端 `session.create` RPC 正常。

• Confidence: 92% confidence
• Finding: The skill explicitly instructs operators to clear NODE_OPTIONS to disable an injected safety hook before launching the service. Even though the stated purpose is reliability, this is a security-relevant bypass of a sandbox-enforced protection mechanism and normalizes weakening runtime safeguards to make the tool work. In an adversarial or copied-to-other-contexts scenario, users may run processes without expected protections, increasing risk of unsafe file operations or broader policy evasion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

本技能含两条"看起来危险"的操作。它们是对一个**有文档记载的沙箱不兼容问题**的极小范围临时绕过，不是"关闭系统安全"的通用做法。请严格按边界使用：

1. **`NODE_OPTIONS=""` 只作用于启动 `dsh web` 的那一个 node 进程，不是全局或系统级关闭**
   - 它只用于启动 `dsh web` 这一条命令，目的是绕过 WorkBuddy / CodeBuddy Bash 沙箱注入的 `genie-safe-delete` 钩子（`--require=.../genie-safe-delete.cjs`）。该钩子把 `fs.rm/unlink` 劫持成走 `genie-trash.exe`，在 Windows 上超时并以 fail-closed 方式报错，反而导致 Harness 的设置 / 工作区持久化写盘失败。
   - 这属于**解除一个会害事的沙箱注入**，并非关闭操作系统或文件系统的安全机制；且该变量只在那条启动命令的子进程生效，不影响其他进程或系统。
   - **执行前需向用户说明并获确认**。长期理想解是平台修复钩子行为；在此之前这是最小必要绕过。
   - **不要**把 `NODE_OPTIONS=""` 套用到其他命令或长期环境；其他场景保留沙箱保护更安全。

• Confidence: 95% confidence
• Finding: This section doubles down on bypassing the sandbox hook and frames it as an acceptable targeted workaround. Although it includes cautions and user-confirmation language, the content still provides operational instructions for disabling a security control protecting file deletion behavior. That makes the skill materially more dangerous because it gives a reusable method to defeat an environment-imposed safeguard.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## 4. 坑 C — safe-delete 钩子（最关键，反复中招）

- **成因**：WorkBuddy Bash 沙箱给每个 node 进程注入
  `NODE_OPTIONS=--require=.../genie-safe-delete.cjs`，把 `fs.rm/unlink` 劫持去调用
  `genie-trash.exe`（Windows 上超时，并以 fail-closed 方式报错）。
- **影响点**：Harness 设置持久化 `FileSettingsProvider.persistSection` 用
  `withFileLock`（mkdir → writeFileAtomic → `rm(lock)`），`finally` 里的 `rm(lock)` 被拦截抛错

• Confidence: 86% confidence
• Finding: The content provides operational guidance for bypassing a safety mechanism that intercepts fs.rm/unlink calls, effectively teaching how to neutralize a protective control in the hosting environment. In an agent skill context, this is more dangerous because automated agents may follow such instructions and perform deletion-capable actions without the intended sandbox guardrails.

Static analysis

No suspicious patterns detected.