87 lines
4.2 KiB
Plaintext
87 lines
4.2 KiB
Plaintext
DISCLOSURE — dual-use content declaration
|
|
=========================================
|
|
|
|
Package: dsh-redteam-mode
|
|
Declared class: dual-use (see "contentPolicy" in package.json)
|
|
Upstream: https://github.com/Jueze-2019/dsh-redteam-mode
|
|
Policy reference: https://docs.npmjs.com/policies/dual-use
|
|
|
|
What this package is
|
|
--------------------
|
|
|
|
dsh-redteam-mode is a plugin for DeepSeek Harness (DSH) that turns the agent
|
|
runtime into an orchestration console for **authorized** adversary emulation and
|
|
penetration-testing engagements. It is an orchestration, evidence-recording and
|
|
reporting layer. Its security-relevant nature comes from what it *drives* and
|
|
*records*, not from shipping attack code.
|
|
|
|
This package contains NO exploit code
|
|
-------------------------------------
|
|
|
|
The published tarball contains no vulnerability exploits, no payloads, no
|
|
shellcode, no credential dumps and no C2 implants. It consists of:
|
|
|
|
lib/ orchestration logic, a local SQLite fact base, tool schemas,
|
|
a right-side console UI and report rendering
|
|
skills/ 23 Markdown instruction documents (prose runbooks) telling an
|
|
agent how to *operate* third-party tools the user installs
|
|
presets/ agent preset composition (YAML)
|
|
scripts/ redteam-setup.sh — an optional environment bootstrap that
|
|
downloads well-known open-source security tools (nmap, nuclei,
|
|
fscan, gogo, chisel, frp, ...) into the user's own home
|
|
directory
|
|
|
|
Dual-use capabilities, and their legitimate use
|
|
-----------------------------------------------
|
|
|
|
1. Orchestrating security tooling. The plugin coordinates scanning tools that the
|
|
user installs themselves and records what was found. Legitimate use: running a
|
|
scoped, authorized assessment against systems the operator owns or has written
|
|
permission to test.
|
|
|
|
2. Command execution on the operator's own machine. Tool invocations are issued on
|
|
the local host that runs DSH — the operator's own assessment workstation or a
|
|
disposable virtual machine. The package does not self-propagate, does not
|
|
install persistence, and does not contact any server controlled by the author.
|
|
|
|
3. Reconnaissance guidance. Skills describe passive and active information
|
|
gathering techniques. Legitimate use: mapping the attack surface of an
|
|
authorized target, which is the standard first phase of any engagement.
|
|
|
|
4. Credential and session handling guidance. Skills describe testing for weak
|
|
credentials on systems within an authorized scope, and how to record sessions
|
|
the operator has legitimately obtained. All captured material stays in a local
|
|
SQLite database under the operator's own $DSH_HOME directory; it is never
|
|
transmitted anywhere by this package.
|
|
|
|
5. Environment bootstrap (scripts/redteam-setup.sh). This shell script downloads
|
|
open-source security binaries from their official GitHub release assets into
|
|
$DSH_HOME/redteam/toolkit/. It does not install system packages, does not
|
|
require or use sudo, does not modify network or proxy configuration, and does
|
|
not run any downloaded binary beyond a --version/-h smoke test. Operators who
|
|
prefer to install these tools themselves can skip the script entirely; nothing
|
|
in the plugin requires it to run.
|
|
|
|
Hard boundaries the package declares and enforces
|
|
-------------------------------------------------
|
|
|
|
* Authorization-only. The README, the agent preset and all role prompts state that
|
|
use is limited to engagements with written authorization, and that unauthorized
|
|
scanning or intrusion is illegal in most jurisdictions.
|
|
* Local-only data. No telemetry, no analytics, no cloud sync, no author-controlled
|
|
endpoints. All findings stay on the operator's machine.
|
|
* Judgement-free tooling. The package does not decide whether a target is in scope;
|
|
that determination is the operator's responsibility.
|
|
|
|
Intended operators
|
|
------------------
|
|
|
|
Professional penetration testers, red teams and security engineers running
|
|
authorized engagements, typically inside a dedicated and disposable Kali virtual
|
|
machine rather than on a day-to-day workstation.
|
|
|
|
Contact
|
|
-------
|
|
|
|
Issues: https://github.com/Jueze-2019/dsh-redteam-mode/issues
|