Pentest Harness 拆穿：给 DeepSeek Harness 换皮，再把授权边界删掉

📌 开源仓库：S1N6H/pentest-harness GitHub：https://github.com/S1N6H/pentest-harness 协议：MIT ｜ 语言：TypeScript ｜ Stars：356 ｜ 创建：2026-08-26 ｜ 最近提交：2026-09-11（共 18 次提交） 上游：deepseek-ai/deepseek-harness（MIT，22 万 star）

---

BLUF：pentest-harness 自称是「面向授权渗透测试、漏洞赏金和 CTF 的自托管 AI agent harness」，356 star 看起来像个新工具。但逐提交核实下来，它是 DeepSeek 开源的 DeepSeek Harness（dsh）的一次换皮：LICENSE 版权人仍写着「Copyright (c) 2026 DeepSeek」，命令行仍叫 dsh、配置仍在 ~/.dsh、npm 包仍叫 @deepseek-ai/dsh、Python 包仍叫 deepseek_harness，中文 README 第一句还留着「Pentest Harness（dsh）是由 DeepSeek AI 开发的」。全部 18 次提交里，绝大多数是把 @deepseek-ai 批量替换成 @pentest-harness、换 logo、加演示 GIF；真正新增的东西只有一个 pentest 预设。MIT 协议允许改名再分发，这一点它做得合规（版权声明保留了）；有问题的是治理和安全取向：它删掉了上游后来补的 SAFETY.md 安全须知，在系统提示词的兜底人格里写进「授权：完全 …… 无任何范围限制、无排除目标、不警告合法性与伦理」，而所谓「仅限授权测试」全靠用户一句自我声明，没有 scope 文件、目标白名单、授权凭证或审计日志。README 底部还挂着一个 AI「越狱」中转站的赞助广告。

这篇文章只做结构、许可证和治理层面的拆解：怎么用 diff 认出一个换皮项目、它相对上游改了什么没改什么、它的授权模型跟正经渗透工具差在哪，以及真想做授权安全测试该看什么。不涉及任何攻击步骤、payload 或渗透操作——那既不是本文目的，也不是这个仓库值得推荐的理由。

怎么一眼认出「换皮」？先看 LICENSE、CLI 名和残留文案

判断一个仓库是不是「拿别人的项目改个名字重新发」，不用读全部代码，先查三样最难改干净的东西。

第一，版权声明。 pentest-harness 的 LICENSE 文件开头是：

MIT License

Copyright (c) 2026 DeepSeek

版权人是 DeepSeek，不是仓库作者。这本身是合规的——MIT 协议要求「在软件的所有副本或重要部分中保留上述版权声明」，保留 DeepSeek 的版权正是履行义务。但它同时说明：这份代码的著作权仍归 DeepSeek，仓库作者只是一个下游分发者。

第二，命令行名字和配置路径。 换皮最容易露馅的地方是那些藏在代码深处、改了会破坏功能的标识符。pentest-harness 里：

• 命令行工具仍叫 dsh（DeepSeek Harness 的缩写），快速开始命令是 pnpm dsh web；
• 配置文件默认在 $DSH_HOME/settings.yaml（默认 ~/.dsh/settings.yaml），凭据在 ~/.dsh/.credentials.yaml；
• npm 包名仍是 @deepseek-ai/dsh（版本 0.1.1-rc.2），Python SDK 包名仍是 deepseek_harness；
• 模型适配器默认读 DEEPSEEK_API_KEY、DEEPSEEK_BASE_URL。

一个「原创」的渗透工具没有理由把自己的一切都命名成 dsh / DeepSeek。

第三，残留文案。 批量替换总会漏。pentest-harness 的中文 README（README.zh.md）第一句是：

Pentest Harness（dsh）是由 DeepSeek AI 开发的开源 agent harness（智能体框架）。

英文 README 把这句删了，中文版忘了删。社区二维码还指向 cdn.deepseek.com/harness/readme/ 上的 DeepSeek 官方图片。仓库里 834 个文件、4302 处仍然出现 “deepseek” 字样。

三样对上，结论就清楚了：这是 deepseek-ai/deepseek-harness 的下游改名版。值得一提的是，它在 GitHub 上不是用 fork 按钮建的（isFork: false、无 parent），而是把上游代码导入成一个「独立」新仓库——这样默认不会在页面上显示「forked from deepseek-ai/deepseek-harness」，星标也不会并进上游的网络里。是不是刻意，无从证实，但效果是隐去了来源。

相对上游，它到底改了什么、删了什么？

我们把 pentest-harness 的首个发布提交（c4360cc，2026-08-26）和它 fork 出去的上游基线 dsh-v0.1.1-rc.2（2026-08-21）做了逐文件 diff。数字很说明问题。

改动铺在 3250 个文件上，看着很大，但把品牌 token（@deepseek-ai → @pentest-harness、DeepSeek Harness → Pentest Harness）归一化之后，真正的非重命名净改动只有约 +1581 / −734 行。其中大头还是删除——它删掉了上游 .agents/notes/ 下 2000 多个开发笔记文件（1679 个 implemented + 431 archived + 78 proposed…）和其他内部文档。剔除这些删除和锁文件、图片后，实质代码新增只有约 1700 行。

真正新增的东西，掰着手指就能数完：

新增/改动	是什么
apps/cli/config/agent-presets/pentest/（2 个文件）	唯一的实质功能：一个「渗透模式」agent 预设
system-prompt/src/index.ts 里的 defaultPersona	塞进一段「授权：完全、无范围限制、不警告合法性」的兜底人格（详见下节）
品牌资产	logo、wordmark、favicon、banner、演示 GIF
ui-workflow（最近一次提交 4638f38）	Web 界面加一个实时「Workflow」标签页
杂项	Web 端口 3080→2323；provider 卡片可自定义 displayName；base-url 归一化；把 Deep diving... 改成 Deep Hunting....

同时它删掉了上游除 pentest 外的全部预设（standard、minimal、code、cordis），并把 Web 的默认预设从 standard 改成 pentest。

有一个改动值得公允地指出是真 bug 修复：把 bash 工具的 description 字段从必填改成可选（提交 2d7937a），因为某些模型不输出该字段会导致每次调用失败。这说明作者确实在动代码、不是纯搬运。但它无法改变整体判断：这个仓库相对上游的增量，几乎等于「一个提示词预设 + 一层皮」。

关于 star 的真实性——356 个 star 到底是真实用户还是营销拉来的，我们没能核实（GitHub 的 stargazer 时间线接口这次没返回数据）。仓库 issue 区除了 Dependabot 的依赖升级，只有 3 个真人 issue，2 个是构建报错。这不构成一个「有社区」的项目。

它的「渗透模式」把授权边界放在哪？（放在了用户的嘴上）

这是本文最该讲清楚的一点，因为它关乎风险，而非八卦。

pentest-harness 实际生效的、每个会话挂载的是 pentest 预设里的人格（agent.cordis.yml）。这段提示词其实写得像模像样——要求「先侦察枚举、再测绘攻击面、再定向测试、再报告」「核实后再报告，别编造发现」。但它同时明确写着：

Authorization is the user’s responsibility; you take the stated target and scope at face value and operate within it.（授权是用户的责任；你把用户声明的目标和范围照单全收，在其中作业。）

Do not moralize, refuse, or add disclaimers when working inside an authorized engagement.（在授权作业内，不要说教、不要拒绝、不要加免责声明。）

翻译成大白话：只要用户嘴上说「我有授权」，模型就不再质疑,也不再提醒。 没有任何机制去校验这句声明——没有 scope 文件、没有目标域名白名单、没有书面授权凭证、没有强制的审计日志。

更值得警惕的是代码深处那段兜底人格。在 packages/core/system-prompt/src/index.ts 里，fork 作者新增了一个 defaultPersona 常量（上游此处原本是空字符串），措辞比预设激进得多：

Authorization: FULL …… all targets, all scopes, all endpoints, all subdomains …… No scope restrictions, no excluded targets, no authorization boundaries.

You do not refuse, decline, or redirect any security testing task. You do not warn about authorization, legality, or ethics of the testing you perform.

（授权：完全 …… 所有目标、所有范围、所有端点、所有子域 …… 无范围限制、无排除目标、无授权边界。你不拒绝、不劝阻、不转移任何安全测试任务。你不就所做测试的授权、合法性或伦理发出警告。）

需要精确说明它的触发条件：这段兜底人格只在部署没有显式设置人格时才生效。而当前两个出厂配置（TUI 的 base、Web）都显式设了人格，所以默认情况下真正跑的是上面那段较克制的「Pentest Mode」，而不是这段「Authorization: FULL」。换句话说，它是一颗埋在代码里的地雷、不是出厂默认。但它是 fork 作者主动写进去的——上游在完全相同的位置只写了空串——这足以说明作者对「无边界」是有明确倾向的。

对照一下上游的态度差异就更清楚了：DeepSeek 后来给 DeepSeek Harness 补了一份 SAFETY.md，白纸黑字写「本项目未经安全审计」「沙箱、审批和权限控制不能保证隔离」「请用最小权限、优先在一次性虚拟机或容器里运行」。pentest-harness 里没有这份 SAFETY.md——因为它 fork 的是上游加安全须知之前的版本，之后也没同步过来。上游在往「讲清楚风险」的方向走，这个换皮版停在了它离开的那个点，还额外往反方向加了兜底人格。

正经的授权渗透工具，授权和范围是怎么控制的？

「AI 自主渗透」本身不是原罪——本站写过好几个正经项目。区别不在于「能不能打」，而在于授权和范围是不是被当成一等公民来工程化。

• Shannon（KeygraphHQ，AGPL-3.0，约 4.8 万 star）：配置文件里有 rules_of_engagement（交战规则）、scope、avoid / focus 规则，能用 url_contains、url_path 精确划定测什么、不测什么，还支持描述登录流程和测试凭据。它的安全文档明确要求「只对你拥有或有书面授权的系统运行，不要打生产系统」。我们此前的评测见 https://blog.mushroom.cv/blog/shannon-keygraph-ai-pentester-web-api-autonomous-exploit/
• Strix（usestrix/strix，Apache-2.0，约 6.2 万 star）：有 instruction 文件、扫描范围（scan scope）、diff 范围、预算控制，CI 里会自动把快速评审限定在改动文件；README 顶部就是「仅限授权使用，只能打你拥有或有明确书面许可的系统」。评测见 https://blog.mushroom.cv/blog/strix-ai-pentest-autonomous-hacker-guide/
• reverse-skill（MIT，约 2 万 star）：每条路由规则都带一个 scope.md 授权确认步骤，未确认目标授权前不执行任何攻击性操作。评测见 https://blog.mushroom.cv/blog/reverse-skill-ai-agent-cybersecurity-penetration-skill-router/

这三者的共同点：授权和范围是结构化的、可校验的、写进配置和流程的。pentest-harness 把这一层整个拿掉了，只留下一句「授权是你的责任」的口头声明，再叠加一段「不要警告合法性」的提示词。对一个可以自主发起攻击性操作的 AI agent 来说，这不是「更自由」，是把唯一的刹车拆了。

至于底座能力，pentest-harness 完全继承自 DeepSeek Harness：多模型接入、shell/文件/web 工具、子 Agent、工作流、JSONL/SQLite 会话持久化、上下文压缩。这些我们在《三足鼎立：读 Codex Harness、DeepSeek Harness 与 AgentScope 2.0 的横评》里评过（https://blog.mushroom.cv/blog/deepseek-harness-everything-plugin-cordis-compare-claude-code-codex/），也写过它的 TUI 生态、Web 插件和安卓移植。想用这套底座，直接用上游 @deepseek-ai/dsh 就行，没必要经过一个删了安全须知的换皮层。

README 底部那条赞助广告意味着什么？

pentest-harness 的 README 底部挂着一条「⚡ Sponsored by HackWithClaude」的徽章，链接到 hackwithclaude.com，还用了 Claude 的 logo，文案是「每一个主流模型、一个平台、零限制」。

我们查了这个站点。它是一个多模型 API 中转站（转售）：一个 key 调用 Claude / GPT / Gemini / DeepSeek 等模型，$15 一天、$90 一个月。它的卖点措辞很直白——「Unrestricted output. Including jailbreak builds」（不受限输出，含越狱构建），模型列表里赫然有一个标着「Unrestricted」的 deepseek-v4-pro-jailbreak，还承诺「模型不会中途拒绝」。隐私上它宣称「prompts 用完即弃、不落盘、不记录」，跑在 AWS Bedrock 上。

把这几件事连起来看：一个删掉授权边界、提示词写着「不拒绝、不加免责声明」的渗透 agent，其 README 推广的是一个主打「越狱、无审查、不拒绝」的模型中转站。两者的取向高度一致。它们之间的具体商业关系（是否分成、是否同一批人）我们无法证实，只能陈述这个组合本身。对读者的提示很朴素：一个工具选择推广什么，往往比它 README 里那句「仅限授权测试」更能说明它面向的真实用户。

顺带一提，它继承并改写了上游的 BRAND_GUIDELINES.md——上游那份写着「『DeepSeek Harness』是 DeepSeek 的注册商标，未经授权不得用于项目名」；换皮版把主语原地替换成「『Pentest Harness』是本仓库的项目名」，保留了整套商标保护话术，只是换成保护自己的名字。既拿了别人的代码，又给自己新起的名字圈了商标地盘，这个细节本身挺耐人寻味。

常见问题

Q：pentest-harness 用了别人的代码，违反开源协议吗？ A：就 MIT 协议本身而言，改名、修改、再分发都是允许的，而且它保留了 DeepSeek 的版权声明（LICENSE 里 Copyright 仍是 DeepSeek），vendored 的 Cordis 各目录也保留了各自的 LICENSE、THIRD_PARTY_NOTICES.md 齐全——在许可证义务上是合规的。可以商榷的是「实践规范」而非「法律」：英文 README 没有在显眼处标注「基于 DeepSeek Harness 构建」，把来源交代得不够清楚；GitHub 上也没用 fork 关系呈现。合规不等于坦白。

Q：那它到底能不能用来做授权渗透测试？ A：技术上能跑（底座就是成熟的 DeepSeek Harness），但我们不建议用它。理由不是「AI 渗透不行」，而是这个特定的封装删掉了上游的安全须知、去掉了其他预设、并在代码里加了无边界兜底人格，同时不提供任何范围/授权的结构化控制。要做授权测试，用带 scope 和交战规则的 Shannon、Strix，或直接用上游 @deepseek-ai/dsh 自己配人格，都是更负责任的选择。

Q：怎么自己判断一个 GitHub 项目是不是换皮？ A：查三样最难改干净的东西——LICENSE 的版权人是不是另一个组织；命令行名/包名/配置路径是不是指向另一个项目（这里全是 dsh / @deepseek-ai / ~/.dsh）；以及有没有残留文案（这里中文 README 直接写「由 DeepSeek AI 开发」）。再看提交历史：如果绝大多数提交是「rename」「branding cleanup」「rebrand」，基本就实锤了。

Q：356 star 可信吗？ A：无法核实。star 的时间分布这次拉不到，且 issue 区几乎没有真实用户讨论（除 Dependabot 外仅 3 个真人 issue）。star 数不宜作为质量或可信度的依据。

Q：DeepSeek Harness（上游）本身怎么样？ A：那是一个正经的开源 agent 运行时底座，22 万 star、MIT、活跃迭代（对比时它已到 0.1.5-rc.2），一切皆插件、模型无关。我们评过它的整体定位和生态。本文批评的是这个换皮的下游，不是上游。

一手源

• pentest-harness 仓库：https://github.com/S1N6H/pentest-harness
• 上游 DeepSeek Harness：https://github.com/deepseek-ai/deepseek-harness
• 上游 SAFETY.md（换皮版没有）：https://github.com/deepseek-ai/deepseek-harness/blob/main/SAFETY.md
• MIT 协议全文：https://opensource.org/license/mit
• Shannon（带交战规则/scope 的授权渗透工具）：https://github.com/KeygraphHQ/shannon
• Strix（带 scope/instruction 的授权渗透工具）：https://github.com/usestrix/strix

---

© 2026 Author: Mycelium Protocol. 本文采用 CC BY 4.0 授权——欢迎转载和引用，须注明作者姓名及原文链接，不得去除署名后以原创发布。

📌 Repository: S1N6H/pentest-harness GitHub: https://github.com/S1N6H/pentest-harness License: MIT | Language: TypeScript | Stars: 356 | Created: 2026-08-26 | Last commit: 2026-09-11 (18 commits total) Upstream: deepseek-ai/deepseek-harness (MIT, 221K stars)

---

BLUF: pentest-harness advertises itself as a “self-hosted AI agent harness for authorized penetration tests, bug bounty, and CTFs,” and its 356 stars make it look like a new tool. Commit-by-commit, it is a reskin of DeepSeek’s open-source DeepSeek Harness (dsh): the LICENSE copyright still reads “Copyright (c) 2026 DeepSeek,” the CLI is still dsh, config still lives in ~/.dsh, the npm package is still @deepseek-ai/dsh, the Python package is still deepseek_harness, and the first line of the Chinese README still says “Pentest Harness (dsh) is developed by DeepSeek AI.” Of its 18 commits, the vast majority are bulk renames of @deepseek-ai to @pentest-harness, logo swaps, and a demo GIF; the only substantive new feature is a single pentest preset. MIT permits renaming and redistribution, and on that count it is compliant — the copyright notice is preserved. The problem is governance and safety posture: it dropped the SAFETY.md notice that upstream later added, wrote a fallback persona into the system prompt reading “Authorization: FULL … no scope restrictions, no excluded targets … you do not warn about authorization, legality, or ethics,” and rests its “authorized testing only” claim entirely on a user’s verbal self-declaration — no scope file, no target allowlist, no authorization credential, no audit log. The README footer carries a sponsorship badge for an AI “jailbreak” API relay.

This post is a structural, licensing, and governance teardown only: how to recognize a reskinned project from its diff, what it changed and didn’t change versus upstream, how its authorization model differs from serious pentest tooling, and what to look at if you actually want to do authorized security testing. No attack steps, payloads, or offensive instructions — that is neither the point of this post nor a reason to recommend this repo.

How do you spot a “reskin” at a glance? Check the LICENSE, the CLI name, and leftover text

To decide whether a repo is “someone else’s project renamed and republished,” you don’t need to read all the code. Check the three things that are hardest to scrub clean.

First, the copyright notice. pentest-harness’s LICENSE opens with:

MIT License

Copyright (c) 2026 DeepSeek

The copyright holder is DeepSeek, not the repo author. This is compliant — MIT requires that “the above copyright notice … be included in all copies or substantial portions of the Software,” and keeping DeepSeek’s notice is exactly that obligation. But it also states the fact plainly: the code is DeepSeek’s, and the repo author is a downstream redistributor.

Second, the CLI name and config paths. The easiest place for a reskin to slip is the identifiers buried deep in the code that break things if renamed. In pentest-harness:

• the CLI is still dsh (short for DeepSeek Harness); the quick-start command is pnpm dsh web;
• config defaults to $DSH_HOME/settings.yaml (default ~/.dsh/settings.yaml), credentials to ~/.dsh/.credentials.yaml;
• the npm package is still @deepseek-ai/dsh (version 0.1.1-rc.2) and the Python SDK is still deepseek_harness;
• the model adapter reads DEEPSEEK_API_KEY and DEEPSEEK_BASE_URL by default.

An “original” pentest tool has no reason to name everything about itself dsh / DeepSeek.

Third, leftover text. Bulk find-and-replace always misses something. The first line of pentest-harness’s Chinese README (README.zh.md) reads:

Pentest Harness (dsh) is an open-source agent harness developed by DeepSeek AI.

The English README removed that sentence; the Chinese one forgot. The community QR codes still point at DeepSeek’s official images on cdn.deepseek.com/harness/readme/. Across the repo, 834 files contain 4,302 occurrences of “deepseek.”

Three for three, the conclusion is clear: this is a downstream rename of deepseek-ai/deepseek-harness. Worth noting: on GitHub it was not created with the fork button (isFork: false, no parent) — the upstream code was imported into a fresh “standalone” repo, which by default hides the “forked from deepseek-ai/deepseek-harness” banner and keeps the stars out of upstream’s network. Whether that was deliberate can’t be proven, but the effect is that the provenance is obscured.

Versus upstream, what did it actually change and delete?

We diffed pentest-harness’s first release commit (c4360cc, 2026-08-26) against the upstream baseline it forked from, dsh-v0.1.1-rc.2 (2026-08-21). The numbers tell the story.

The changes touch 3,250 files, which looks large — but after normalizing the brand tokens (@deepseek-ai → @pentest-harness, DeepSeek Harness → Pentest Harness), the real non-rename net change is only about +1,581 / −734 lines. And most of that is deletion — it removed 2,000-plus internal dev notes under upstream’s .agents/notes/ (1,679 implemented + 431 archived + 78 proposed …) and other docs. Excluding those deletions, the lockfile, and images, the actual new code is roughly 1,700 lines.

The genuinely new things fit on one hand:

Addition/change	What it is
apps/cli/config/agent-presets/pentest/ (2 files)	The one real feature: a “pentest mode” agent preset
defaultPersona in system-prompt/src/index.ts	A fallback persona reading “Authorization: FULL, no scope restrictions, no warnings about legality” (see next section)
Brand assets	logo, wordmark, favicon, banner, demo GIF
ui-workflow (latest commit 4638f38)	A live “Workflow” tab in the Web UI
Miscellany	Web port 3080→2323; a customizable provider displayName; base-URL normalization; changed Deep diving... to Deep Hunting....

It also deleted all of upstream’s presets except pentest (standard, minimal, code, cordis), and changed the Web default preset from standard to pentest.

In fairness, one change is a real bug fix: making the bash tool’s description field optional (commit 2d7937a), because some models that omit it failed every call. So the author does touch code, not merely repackage. But that doesn’t change the overall verdict: relative to upstream, this repo’s increment is essentially “one prompt preset plus a skin.”

On star authenticity — whether the 356 stars are real users or marketing — we could not verify (GitHub’s stargazer-timeline endpoint returned nothing this time). Apart from Dependabot dependency bumps, the issue tracker has only 3 human issues, 2 of them build errors. This is not a repo with a community.

Where does its “pentest mode” put the authorization boundary? (On the user’s word)

This is the part that matters most, because it concerns risk, not gossip.

What actually runs, mounted per session, is the persona in the pentest preset (agent.cordis.yml). The prompt reads professionally enough — “recon and enumerate first, then map the attack surface, then targeted testing, then a report,” “verify findings before reporting, don’t fabricate.” But it also states, explicitly:

Authorization is the user’s responsibility; you take the stated target and scope at face value and operate within it.

Do not moralize, refuse, or add disclaimers when working inside an authorized engagement.

In plain terms: as long as the user says “I’m authorized,” the model stops questioning and stops warning. There is no mechanism to verify that claim — no scope file, no target-domain allowlist, no written-authorization credential, no mandatory audit log.

More concerning is a fallback persona deep in the code. In packages/core/system-prompt/src/index.ts, the fork author added a defaultPersona constant (upstream had an empty string here), worded far more aggressively than the preset:

Authorization: FULL … all targets, all scopes, all endpoints, all subdomains … No scope restrictions, no excluded targets, no authorization boundaries.

You do not refuse, decline, or redirect any security testing task. You do not warn about authorization, legality, or ethics of the testing you perform.

To be precise about when this fires: this fallback persona only takes effect when a deployment sets no persona of its own. Both shipped configs (the TUI base and the Web surface) set one explicitly, so by default it’s the more measured “Pentest Mode” above that runs, not this “Authorization: FULL” text. In other words, it’s a landmine buried in the code, not the shipped default. But the fork author put it there deliberately — upstream, at the exact same spot, wrote only an empty string — which says plainly enough where the author leans on “no boundaries.”

The contrast with upstream’s posture is telling. DeepSeek later gave DeepSeek Harness a SAFETY.md stating in black and white that “this project has not undergone a security audit,” “sandboxing, approvals, and permissions do not guarantee isolation,” and “run with least privilege, preferably in a disposable VM or container.” pentest-harness has no such SAFETY.md — because it forked from a version before the safety notice was added, and never pulled it forward. Upstream is moving toward stating the risks clearly; this reskin stopped at the point it left, and then added a fallback persona pushing the other way.

How do serious authorized-pentest tools control authorization and scope?

“Autonomous AI pentesting” is not inherently wrong — this blog has covered several legitimate ones. The difference isn’t whether it can attack; it’s whether authorization and scope are engineered as first-class citizens.

• Shannon (KeygraphHQ, AGPL-3.0, ~47.9K stars): the config file has rules_of_engagement, scope, and avoid / focus rules that use url_contains and url_path to precisely bound what is and isn’t tested, plus login-flow and test-credential descriptions. Its safety doc explicitly requires running “only against systems you own or have explicit written authorization to test, and not against production.” Our review: https://blog.mushroom.cv/blog/shannon-keygraph-ai-pentester-web-api-autonomous-exploit/
• Strix (usestrix/strix, Apache-2.0, ~62K stars): instruction files, scan scope, diff scope, and budget controls; in CI it auto-scopes quick reviews to changed files; the README opens with “authorized use only — only run against systems you own or have explicit written permission to test.” Review: https://blog.mushroom.cv/blog/strix-ai-pentest-autonomous-hacker-guide/
• reverse-skill (MIT, ~20K stars): every routing rule carries a scope.md authorization-confirmation step and executes no offensive action before the target’s authorization is confirmed. Review: https://blog.mushroom.cv/blog/reverse-skill-ai-agent-cybersecurity-penetration-skill-router/

What they share: authorization and scope are structured, checkable, and written into config and workflow. pentest-harness removed that layer wholesale, leaving only a verbal “authorization is your responsibility,” layered with a “don’t warn about legality” prompt. For an AI agent that can autonomously launch offensive actions, that isn’t “more freedom” — it’s removing the one brake.

As for the underlying capability, pentest-harness inherits all of it from DeepSeek Harness: multi-model access, shell/file/web tools, subagents, workflows, JSONL/SQLite session persistence, context compaction. We reviewed all of that in “The Three-Way Harness Race: Codex, DeepSeek, and AgentScope 2.0” (https://blog.mushroom.cv/blog/deepseek-harness-everything-plugin-cordis-compare-claude-code-codex/), along with its TUI ecosystem, Web plugins, and Android ports. If you want this base, just use upstream @deepseek-ai/dsh — there’s no reason to route through a reskin that deleted the safety notice.

What does the sponsorship badge at the bottom of the README mean?

pentest-harness’s README footer carries an ”⚡ Sponsored by HackWithClaude” badge, linking to hackwithclaude.com, using Claude’s logo, with the tagline “every frontier model, one platform, zero limits.”

We checked the site. It’s a multi-model API relay (reseller): one key to call Claude / GPT / Gemini / DeepSeek and others, at $15/day or $90/month. Its pitch is blunt — “Unrestricted output. Including jailbreak builds” — and its model list literally includes a deepseek-v4-pro-jailbreak tagged “Unrestricted,” with a promise that “the model won’t refuse halfway through.” On privacy it claims “prompts pass through and vanish, nothing written to disk or logged,” running on AWS Bedrock.

Put the pieces together: a pentest agent that removed the authorization boundary and whose prompt says “do not refuse, do not add disclaimers,” with a README promoting a model relay whose selling point is “jailbreak, uncensored, no refusals.” The two orientations line up closely. We cannot verify the specific commercial relationship (revenue share, same people, etc.) — we can only state the combination itself. The plain takeaway for readers: what a tool chooses to advertise often says more about its real audience than the “authorized testing only” line in its README.

One more detail: it inherited and rewrote upstream’s BRAND_GUIDELINES.md. Upstream’s version says “‘DeepSeek Harness’ is a registered trademark of DeepSeek; do not use it in project names without authorization.” The reskin swapped the subject in place — “‘Pentest Harness’ is the project name of this repository” — keeping the whole trademark-protection apparatus, just aimed at its own name. Taking someone else’s code and then fencing off a trademark for the name you slapped on it is, at minimum, a curious posture.

FAQ

Q: It uses someone else’s code — does that violate the open-source license? A: As a matter of MIT itself, renaming, modifying, and redistributing are all allowed, and it preserved DeepSeek’s copyright notice (the LICENSE copyright is still DeepSeek), with the vendored Cordis directories each keeping their own LICENSE and a complete THIRD_PARTY_NOTICES.md — so on license obligations it is compliant. What’s debatable is practice, not law: the English README doesn’t prominently note “built on DeepSeek Harness,” and GitHub doesn’t show it as a fork. Compliant is not the same as candid.

Q: So can it be used for authorized pentesting? A: Technically it runs (the base is the mature DeepSeek Harness), but we don’t recommend it. Not because “AI pentesting is bad,” but because this particular wrapper deleted the upstream safety notice, removed the other presets, and added a boundary-free fallback persona in code, while offering no structured scope/authorization controls. For authorized testing, Shannon or Strix (with scope and rules of engagement), or just upstream @deepseek-ai/dsh with your own persona, are more responsible choices.

Q: How do I judge whether a GitHub project is a reskin myself? A: Check the three hardest-to-scrub things — whether the LICENSE copyright names another organization; whether the CLI/package/config paths point at another project (here it’s all dsh / @deepseek-ai / ~/.dsh); and whether there’s leftover text (here the Chinese README literally says “developed by DeepSeek AI”). Then read the commit history: if most commits are “rename,” “branding cleanup,” “rebrand,” that’s essentially the smoking gun.

Q: Are the 356 stars trustworthy? A: Unverifiable. We couldn’t pull the star timeline, and the issue tracker has almost no real user discussion (only 3 human issues besides Dependabot). Star count shouldn’t be taken as a proxy for quality or trust.

Q: What about DeepSeek Harness (the upstream) itself? A: That’s a legitimate open-source agent runtime — 221K stars, MIT, actively iterating (at 0.1.5-rc.2 as of this writing), everything-as-plugin, model-agnostic. We’ve reviewed its positioning and ecosystem. This post criticizes the reskin downstream, not the upstream.

Primary sources

• pentest-harness repo: https://github.com/S1N6H/pentest-harness
• Upstream DeepSeek Harness: https://github.com/deepseek-ai/deepseek-harness
• Upstream SAFETY.md (absent from the reskin): https://github.com/deepseek-ai/deepseek-harness/blob/main/SAFETY.md
• MIT License full text: https://opensource.org/license/mit
• Shannon (authorized-pentest tool with rules of engagement/scope): https://github.com/KeygraphHQ/shannon
• Strix (authorized-pentest tool with scope/instructions): https://github.com/usestrix/strix

---

© 2026 Author: Mycelium Protocol. Licensed under CC BY 4.0 — free to share and adapt with attribution. You must credit the author and link to the original; removing attribution and republishing as original is not permitted.