DSH Skills Manager

An npm-installable DeepSeek Harness Web plugin for managing local skills safely.

Report an issue · View on npm

English · 简体中文

The screenshot shows the Skills panel layout. In the current plugin, shared Agent skills are read-only and do not expose action buttons.

DSH Skills Manager is a community-maintained plugin. It is not an official DeepSeek AI product.

What it provides

• Two skill groups — view local $DSH_HOME\skills and shared $DSH_AGENTS_HOME\skills in one Settings panel.
• Local lifecycle controls — enable, disable, upload, replace, and delete only DSH-local skills.
• Safe shared-skill view — public Agent skills are visible but strictly read-only; their global metadata is never changed.
• Native file selection — select a plugin SKILL.md from the operating system file picker, or explicitly choose its directory when the client cannot expose the selected file path.
• Protected replacement — a same-name import always requires confirmation, including a flat skill and a bundled skill with the same normalized name.
• Safer imports — importing from the DSH skills directory itself, its parent, or a child path is rejected; symbolic links are also rejected.
• Predictable dialogs — Escape closes only the active upload or confirmation dialog, leaving the Settings page open.

Directory permissions

Directory	View	Enable/Disable	Upload/Replace	Delete
$DSH_HOME\skills	Yes	Yes	Yes	Yes
$DSH_AGENTS_HOME\skills	Yes	No	No	No

The shared Agent directory is intentionally read-only in both the interface and the server API.

Safety behavior

• Enable, disable, and delete only accept one ordinary skill-name path segment; directory traversal names are rejected.
• Replacements are first copied to a temporary sibling path. Existing files are kept until that copy succeeds.
• Mutation endpoints require JSON and the DSH client request marker, so a cross-site browser request cannot trigger a local file operation.

Quick start

You need a working DeepSeek Harness Web installation. Do not run npm install in an arbitrary directory: install the plugin into the DSH Web profile instead.

1. Run:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$OutputEncoding = [System.Text.Encoding]::UTF8
dsh plugin --profile web add @michengai/dsh-skills-manager

2. Restart DSH or reload the active Web profile.
3. Open Settings → Skills. No source checkout is required.

If a package mirror has not synchronized the latest version yet, append --registry=https://registry.npmjs.org/ to the install command.

Use the Skills panel

Goal	What to do	Scope
Check a skill	Open Settings → Skills to see its name, form, description, and invocation status.	DSH and shared Agent skills
Enable or disable	Choose Enable or Disable. This changes model invocation and the / manual command without rewriting other SKILL.md metadata.	DSH skills only
Upload a plugin	Choose Upload Plugin, then select the plugin directory's SKILL.md. DSH copies the complete directory, including scripts and resources.	DSH skills only
Select a directory instead	If the selected file has no usable path, choose Choose Plugin Directory and select the directory that contains SKILL.md.	DSH skills only
Replace or delete	Confirm a same-name replacement; use Delete for a DSH-local skill you no longer need.	DSH skills only
Inspect shared skills	Review shared Agent skills without changing their metadata.	Read-only

Press Escape to close only the frontmost upload or confirmation dialog; the Settings page remains open.

Development and verification

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$OutputEncoding = [System.Text.Encoding]::UTF8
node test\core-test.mjs

Project documentation

Project status, usage boundaries, architecture, and iteration records start at the documentation entry point. The Chinese operational guide is available at docs\02-产品与业务\01-使用说明.md in the repository.

Maintainer release

The package is published as @michengai/dsh-skills-manager. To release a new version:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$OutputEncoding = [System.Text.Encoding]::UTF8
npm version patch
npm publish

prepublishOnly runs the core test suite before publication. The package always publishes to the official npm registry; use npm run pack:check to inspect the tarball first.

License

Licensed under the Apache License 2.0.