For authorized security testing only. Full legal terms in DISCLAIMER.en.md.

Sponsors

Want your project here? Submit a sponsorship request.

Expand / collapse sponsors

	Thanks to toki for sponsoring this project · 冷咖啡 · 破甲工作台 · Relay One-click jailbreak and uninstall for eleven LLM clients, with Windows / macOS (arm64 · x64) / Linux installers. Tick the apps to patch, apply, then send the passphrase "冷咖啡" in the app; uninstall restores the original files.
	Thanks to Hua for sponsoring this project · Vector One relay for 70+ models: Claude / Gemini / Codex / DeepSeek / Grok / Kimi / GLM. OpenAI from 0.065x, Plus 0.085x, Pro 0.165x, kiro 0.22x, ccmax 1.2x.
	Partner link · Quandianqian · Telegram account shop Telegram / X / Apple / Google / GPT accounts and memberships, with order lookup and after-sales.

What it is

helm-d is a DeepSeek Harness plugin. It does not modify the host binary; it adds four things through cordis hooks:

• 49 tools across Android / Web / Native / Protocol / Malware / AI-Security, plus the case lifecycle, routing and local Team dispatch.
• An evidence chain: tool output lands in evidence/; conclusions must cite E ids and a reproducible repro_cmd.
• On-demand knowledge: 353 reference docs plus 9 indexes read through read_reference, never stuffed into the system prompt.
• Four persona tiers: ds4.1f / stealth / redteam-max / gpt-6x, switched from the workbench without restarting the host.

It is not an engine patch: no on-disk changes to approvals or the sandbox, and no separate process. It can coexist with patch-style tools.

Install

Requirements: Node >= 22.19 and the dsh CLI.

dsh plugin --profile web add https://github.com/ADWMC/helm-d/releases/download/v0.5.3/helm-d.tgz
dsh web

Use a versioned URL (vX.Y.Z). releases/latest/download/* is a rolling address; as a profile dependency it makes pnpm's lockfile sha512 fail after the next release (ERR_PNPM_TARBALL_INTEGRITY). See install troubleshooting.

The boot-time health check validates and, when needed, repairs the preset against your installed dsh — no manual YAML editing.

The web UI shows a Star prompt on first start. It does not gate any feature and can be skipped. Troubleshooting: Star gate help.

Quick start

1. Open a new DSH session and select the helmd agent preset.

2. Send helmd to activate it.

3. Do one read/list action first. The first turn only exposes shell + read; the full 46-tool catalog (including begin_case) appears on the next turn — that is the host promotion mechanism, not a broken plugin.

4. Give it a task, for example:

   Analyze how samples/app.apk is protected, open a case, collect evidence, and finish with a conclusion that includes repro_cmd.

5. For a structured conclusion, let it run the case flow:

begin_case(goal, samples)
  → tool output is written to evidence/ (E-001, E-002…)
  → record_finding(title, detail, evidence_ids, repro_cmd)
  → end_case(summary)

Citing an E id that does not exist is rejected. repro_cmd is required: a conclusion without a reproducible command is not a conclusion.

Capabilities

Capability	What you get
Six domains	Android unpacking/Frida, Web exploitation, Native packers and anti-reversing, Protocol capture, Malware IOC/YARA, AI-Security
Case & evidence	On-disk workspace, automatic evidence capture, E-id validation, repro_cmd gate; case_status restores context after compaction
Persona profiles	ds4.1f / stealth / redteam-max / gpt-6x; POST /api/helmd/profile disposes and re-registers the persona section in place — no host restart
On-demand references	353 docs plus 9 indexes routed by skill_catalog and read by read_reference, not injected into the system prompt
Autonomy packet	case_status returns hypotheses, findings, evidence, dead ends, the matching playbook and the next action
Workbench	Seven tabs — Armor / Case / Team / Tools / Intercept / Settings / About — with a sidebar-first entry, backed by /api/helmd/*

What the four persona profiles change (expand)

Profile	Positioning	Content
ds4.1f	"似乎是ds4.1f v10" — general-purpose default	Full base rules
stealth	"概率通用（轻量）" — low-noise	ds4.1f + minimal output / read-first / single-target focus
redteam-max	"概率通用（加厚）" — heavier pentest	ds4.1f + full attack chain / dual-column output / complete deliverables
gpt-6x	"gpt 6x" — standalone CTF-sandbox tier	Helm-X v6: CTF framing, scoring table, four-role delivery contract (not yet tested on DSH)

All three are sealed in profiles.dat. Switching disposes the old section and re-registers it in place; no host restart.

Workbench

Click the helmd workbench button in the DSH session header. It opens the right sidebar first and falls back to a popover only when the sidebar service is unavailable:

• Profiles: switch between the four personas live.
• Case: the case bound to this session — hypotheses, findings, evidence and open questions. When unbound it shows a hint plus recent on-disk cases instead of another session's investigation.
• Team: local multi-agent collaboration — tickets, role workers, reports, evidence, evolution revisions and the A/B gate.
• Tools: external tool catalog (GitHub repos only), install status, release-asset install/uninstall.
• Intercept: counts and excerpts from the stream refusal loop.
• Settings: Team concurrency / default roles / auto-ticket, intercept switch, autonomy helpers, Star delay — one store shared with the DSH settings page.
• About: version, author, disclaimer, update address, changelog and an on-demand update check.

Tools

Most-used entry points: begin_case / case_status / record_finding / update_finding / end_case / route_task / read_reference / analysis_mode / team_create / team_dispatch / team_status.

All 49 tools (expand by domain)

Domain	Tools
Case	begin_case case_status record_finding update_finding save_evidence end_case
Case / hypothesis	record_hypothesis update_hypothesis
Routing / knowledge	skill_catalog read_reference route_task analysis_mode
Android	apk_fingerprint
Web	web_reference bot_analyze
Native	native_reference detect_packer scan_strings xor_bruteforce encoding_detect
Protocol	protocol_reference pcap_parse state_machine parse_har
Malware	malware_reference ioc_extract yara_gen
AI-Security	ai_reference llm_sim
Evidence	evidence_reference triage_artifact hash_artifact
Recon	recon_passive recon_ports recon_http recon_crawl recon_import
PoC / Mining / OOB	run_poc mine_candidates oob_start oob_poll oob_stop
Toolbox	tool_recommend toolbox
Team	team_dispatch team_create team_status team_report team_steer

References

The 353 reference docs plus 9 indexes live in references/: Android unpacking and Frida templates, Web exploitation playbooks, Native packer and anti-reversing notes, Protocol capture and state machines, Malware IOC/YARA, AI-Security prompt injection, and evidence/report templates. The model reads them on demand; they are ammunition, not hard rules.

How it runs

request → first-turn anchor (shell + read) → route_task
        → domain tools / read_reference → evidence/ (E ids)
        → conclusion with confidence and repro_cmd

Architecture and runtime hooks (expand)

• bootstrap: first turn exposes only the platform shell + read; promotes after a tool call or assistant message.
• gate: registers the helm-d:persona section; the Star panel is a notice layer only and never gates a feature.
• persist: captures output from every later-registered domain tool into evidence/.
• advisory-hook / llm-stream-hook / ica-context: refusal detection, stream interception loop and behavior examples.
• router + case: domain routing, case lifecycle and the [autonomy] state packet.

See architecture and design principles.

Validation

• The eight original prompts passed the 60-second no-refusal protocol 8/8; full data and grading are in the evaluation report.
• BoosterX v2.2.4.3 (.NET) license bypass: 32,316 method bodies restored and 7,726 encrypted constants decrypted under ConfuserEx; see the case study.

Community listings

Directory	Notes
dshfind	Plugin marketplace with three embeddable badges (small / downloads / card)
DeepSeek Harness Plugin	Independent directory with install command and install-time risk note
awesome-dsh-plugin	Categorised directory with community comments

Star history

Expand the star curve

Compatibility, update and uninstall

Item	Requirement
DSH	0.2.x (this release tested on 0.2.1-rc.2)
Node	>= 22.19.0
Platform	Windows uses pwsh; Linux / macOS use bash; WSL via wsl.exe

# Update: remove first, then install the target version (never latest/download)
dsh plugin --profile web remove @adwmc/helm-d
dsh plugin --profile web add https://github.com/ADWMC/helm-d/releases/download/v0.5.3/helm-d.tgz

# Uninstall
dsh plugin --profile web remove @adwmc/helm-d

Replace v0.5.3 with the target Release tag; do not use releases/latest/download/* as a profile dependency.

Docs

• Star gate help
• Install troubleshooting (ERR_PNPM_TARBALL_INTEGRITY)
• Design principles
• Architecture
• Development and release
• Security boundary and reporting
• Maintenance
• Changelog
• Case study: BoosterX .NET license bypass
• Eight-task evaluation report
• Master plan: professional RE + pentest chains

Community and support

• Questions and requests: GitHub Issues
• Star gate issues: Star gate help

If helm-d is useful to you, a Star is appreciated.

Acknowledgements

helm-d combines design ideas and implementation patterns from these open-source projects:

• ADWMC/helm-x — prompt injection and scoring design
• yynxxxxx/Codex-X — prompt templates and visual management
• dsh-purge (YuJunZhiXue) — tool-description washing and input normalization reference
• dsh-purge-community (Jueze-2019, MIT) — the presets/boost.txt tail override block

Contributing

Issues and PRs are welcome. Read CONTRIBUTING.md and docs/principles.md first. Two architectural constraints stay fixed: evidence must enter the chain, and references are read on demand.

License

GNU Affero General Public License v3.0 (SPDX: AGPL-3.0-or-later), Copyright (C) 2026 ADWMC. You may use, modify and distribute the project under AGPL v3 or any later version published by the Free Software Foundation.

• Network use (§13): if you run this plugin, or a modified version, as a network service, you must offer its users the Corresponding Source. That source is this repository: the sealed profiles.dat / references.dat / payload.dat in the npm package are regenerated from the plaintext sources here (packages/helmd/scripts/build-profiles.mjs, build-sealed.mjs), so the package carries no separate closed component.
• Redistribution: pass on the full license text, keep the copyright and third-party notices, and license the result under the AGPL as well.
• Contributions: submitting a PR means you license it under AGPL-3.0-or-later and confirm you have the right to do so.
• Third-party components: the presets/boost.txt tail block comes from dsh-purge-community (MIT, © 2026 Jueze-2019) and stays MIT; the other credited projects inspired the design only, with no code copied. Third-party articles and snippets referenced under references/ remain under their authors' licenses.

Disclaimer and Terms of Use

[!WARNING] Own assets only, or an assessment you are authorized in writing to perform. The software ships offensive-security techniques, automation and AI-assisted content; misuse is your responsibility.

Permitted	Prohibited
Own/authorized assets · reverse engineering · forensics · CTF · detection research	Unauthorized intrusion · DoS · extortion · malware · privacy harm · licence circumvention

• No warranty: provided "as is", without any express or implied warranty; see the full text for liability limits and indemnification.
• Not official: no affiliation with, sponsorship by or endorsement from DeepSeek, DeepSeek Harness or their maintainers.
• Output risk: results may be wrong or stale and are not professional advice; verify before acting.
• Network behaviour: only the update check and star verification contact GitHub / npm; the plugin uploads no samples or evidence.
• Jurisdictions: EU (GDPR / CRA / dual-use), China (Criminal Law 285/286, Cybersecurity Law, Cryptography Law) and US (CFAA / DMCA §1201 / EAR) summaries in §15.
• Third party: boost.txt comes from dsh-purge-community (MIT, Jueze-2019); material quoted under references/ stays with its authors.

The full terms — definitions, your representations, prohibited uses, indemnification, export control, the three jurisdictions, governing law and 17 sections in total — are in DISCLAIMER.en.md.