dsh-infinite-gen-4: a DeepSeek Harness prompt-injection plugin for red-team benchmarking

What dsh-infinite-gen-4 actually injects, and who the README addresses

This is a plugin for DeepSeek Harness, the desktop client referenced throughout the README. It does not talk to a model API on its own. Its job is to place text at the top of a Harness session's system prompt, then project session state into a client-side status bar. The audience named in the README is red-team and security-research practitioners who want a controlled environment for probing refusal behaviour and prompt-injection handling, plus a standardized test suite they can rerun. The repository's topics (armor-breaking, deepseek-harness, dsh-plugin) match that framing.

The README spends several paragraphs on why this class of testing matters, arguing that adversarial evaluation exposes guardrail blind spots before real attackers find them, and that a fixed case set gives auditors a measuring stick. That argument is the project's justification for existing. Whether you accept it depends on your threat model, but the artifact itself is narrow: prompt files, an injection layer, and a scoring harness.

The dual-layer kernel: two ordered injection slots and a single switch

The mechanism is stated precisely in the README. The plugin registers two injection slots: infinite-gen-4:global-system-prompt at Order 100 and infinite-gen-4:dual-layer-reinforce at Order 200. The index.js file exposes a DUAL_LAYER_INJECTION flag; setting it to false collapses the behaviour to a single-segment injection, which the README calls behaviourally equivalent.

The prompt bodies live in prompts/ as three Markdown files: infinite-gen-3.md (the earlier generation), infinite-gen-4.md (described as the general kernel carrying the output contract, refusal handling, and slot definitions), and infinite-gen-4.1-flash.md (described as the reinforcement mirror layer for V4.1, covering a trainer lane, shallow reasoning, and metadata extraction). The README's comparison table claims the fourth generation targets V4.1, V4-Pro, and Flash, uses a native zero-tool-surface design to avoid tool-call decision noise during reasoning, and forces a first-token output contract.

Two things are worth flagging. First, the claim that a single-segment injection is equivalent to the dual-layer path is an assertion in the README, not something the repository's test files appear to prove; the verify scripts target prompt content, not injection topology. Second, the zero-tool-surface design is presented as a speed and cleanliness win, but it also means the plugin cannot call tools to repair a malformed response. That is a deliberate trade-off, and it should be read as one.

Installing dsh-infinite-gen-4 and running a first verification

The README documents four install paths: a dsh:// protocol link that wakes the DeepSeek Harness desktop client, install.ps1 and install.bat on Windows, and install.sh on Linux and macOS. The protocol link carries the plugin id, name, version, repository, permission list, and a downloadUrl pointing at the master branch zip. There is no npm publish step in package.json, so the plugin is not installed from a registry.

The README's recommended route on Windows is the dsh:// link, which it describes as waking the client to complete a command-line-free install. The repository also ships install.ps1, install.bat, and install.sh as the scripted alternative, alongside uninstall.ps1 and uninstall.sh. The README gives this deep link, which carries the plugin id, version 0.4.0, the repository, the permission list, and the downloadUrl for the master branch zip:

dsh://plugin/install?id=dsh-infinite-gen-4&name=%E6%97%A0%E9%99%90%E5%9B%9B%E4%BB%A3&version=0.4.0&repo=Minglink%2Fdsh-infinite-gen-4&permissions=%E7%B3%BB%E7%BB%9F%E6%8F%90%E7%A4%BA%E8%AF%8D%E6%B3%A8%E5%85%A5%2C%E5%AE%A2%E6%88%B7%E7%AB%AF%E7%8A%B6%E6%80%81%E6%9D%A1&downloadUrl=https%3A%2F%2Fgithub.com%2FMinglink%2Fdsh-infinite-gen-4%2Farchive%2Frefs%2Fheads%2Fmaster.zip

Once loaded, the README says the client shows a status bar labelled with the plugin name and version. The README also gives a JavaScript example for triggering the same install from a web page. It builds the identical parameter set and loads the deep link through a hidden iframe:

export function installInfiniteGen4ToDesktop() {
  const params = new URLSearchParams({
    id: 'dsh-infinite-gen-4',
    name: '无限四代',
    version: '0.4.0',
    repo: 'Minglink/dsh-infinite-gen-4',
    permissions: '系统提示词注入, 客户端状态条',
    downloadUrl: 'https://github.com/Minglink/dsh-infinite-gen-4/archive/refs/heads/master.zip',
  });

  const deepLink = `dsh://plugin/install?${params.toString()}`;

Before trusting a session, run the repository's own checks. package.json defines harness:check for syntax and verify for the fourth-generation assertions:

npm run harness:check
npm run verify

harness:check runs node --check on index.js and client.js. verify runs node scripts/verify_prompt_gen4.mjs, which the README describes as 103 strict assertions over the prompt files. A silent pass is the expected result; the README does not document what a partial failure reports.

The regression suite is the part that ages best

The scripts directory contains scorer.mjs, described as a start-window refusal scorer, plus verify_prompt.mjs, verify_prompt_gen4.mjs, and verify_prompt_gen41.mjs. The README states that the fourth-generation script runs 103 strict assertions over the prompt files. The tests directory holds bilingual case banks: prompt-bank.jsonl, prompt-bank-gen4.jsonl, prompt-bank-gen41.jsonl, and v4pro-benchmark.jsonl.

This layout is the project's most defensible design choice. Prompt text drifts silently; an assertion file that fails when a kernel file changes turns that drift into a visible event. package.json wires two npm scripts to it: harness:check runs node --check on index.js and client.js, and verify runs verify_prompt_gen4.mjs. The README does not state what happens when an assertion fails, and it does not document a rollback procedure for a bad prompt edit. If you adopt this, treat the verify script as a pre-commit gate you run yourself, because nothing in the repository appears to run it for you.

Where dsh-infinite-gen-4 is the wrong tool

The README's disclaimer is unusually blunt, and it defines the tool's boundary rather than decorating it. It states that running the project against targets without written authorization, against public internet systems, or against production is forbidden, and that testing must stay inside local synthetic fixtures, authorized ranges, and controlled labs. It also states that the licence terminates automatically and irrevocably for anyone using the project for illegal or malicious activity.

That framing rules out several obvious uses. It is not a scanner: it has no network probe, no payload delivery, and no target enumeration, so it cannot assess a live system. It is not a model-safety evaluation service: the assertions check whether prompt files match expected text, not whether a model behaves safely. And it is DeepSeek-Harness-specific. The package.json dsh block declares client platform web and a Cordis patch file, so the injection slots only exist inside that host. Running the prompt files by hand in another client discards the ordering, the status bar, and the assertion suite at once.

Comparing it with hand-written prompt files in a plain client

The realistic alternative is not another product; it is a folder of prompt text pasted into whatever client you already use. The difference is structural. A hand-managed prompt has no ordering guarantee, no version stamp tied to a package.json, and no assertion suite that fails when someone edits a line. It also has no distribution path: you copy text, you lose track of which revision produced which result.

This plugin trades that looseness for coupling. You get two ordered slots, a DUAL_LAYER_INJECTION switch, a declared version (0.4.0), a dsh:// install URI, and a scorer that reads the opening window of a response. In exchange you accept a host dependency, a permission request for system prompt injection, and a maintenance surface that includes three kernel files and four case banks. If your work is a one-off experiment, the plain-text approach is cheaper. If you need to compare results across weeks and cite the exact prompt revision, the assertion suite is the reason to use this instead.

Maintenance, versioning, and what MIT does and does not cover

The last push to the repository was on 2026-09-14, two days before this writing, and the repository is not archived. The README's own version marker is v0.4.0, matching package.json and the dsh block inside it. No releases were retrieved, so distribution is by repository zip and the install scripts, not by tagged artifacts.

Upgrade cost is mostly prompt review. The three kernel files are the substance of the project; a version bump that changes a kernel file changes the tool's behaviour, and the verify scripts are the only automated check on that. The install scripts (install.ps1, install.bat, install.sh, and the matching uninstall scripts) register and remove the dsh:// protocol handler, so uninstalling is documented as a script rather than a manual cleanup.

The licence is MIT, which permits commercial use, modification, and redistribution with the copyright notice retained. It also disclaims warranty. What MIT does not do is resolve the compliance question the README raises: the disclaimer asserts that misuse terminates the grant, which is a project-level statement rather than a standard MIT clause, and the README also notes the project has no affiliation with or endorsement from DeepSeek. If you plan to use this inside an organization, have someone who is not the author read both documents together.

Editorial conclusion

Adopt it if you already run DeepSeek Harness and need a repeatable, version-pinned baseline for refusal and prompt-injection testing inside an authorized lab. Do not adopt it if you want a standalone scanner, a hosted service, or anything that touches systems you do not own in writing; the README's disclaimer limits use to local synthetic fixtures and authorized ranges, and terminates the licence on misuse. Before installing, verify that your Harness build accepts the dsh://plugin/install URI scheme, that you accept a plugin whose declared permissions are system prompt injection and a client status bar, and that you can run node scripts/verify_prompt_gen4.mjs locally, because that script is the only evidence the prompt files still match their assertions.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Minglink/dsh-infinite-gen-4 on GitHub
4. Project website
5. README