@perrylink/dsh-skill-pack-security-provider 1.3.0

package/pack/skills-en/supply-chain-review/references/typosquat-and-reproducibility.md

@@ -0,0 +1,71 @@
+# Typosquat judgment and reproducible builds (supply-chain-review/references/typosquat-and-reproducibility.md)
+
+The complete checklists, threshold tables, and comment templates behind Sections 2, 3, and 4 of the main file.
+
+## Confusion-pair list (check common pairs first, then edit distance)
+
+| Impersonated | Common variants |
+|---|---|
+| lodash | lodahs / lodas-h / l0dash / lodashx |
+| react / react-dom | react-domm / reactjs-dom / raect-dom |
+| axios | axois / axioss / axio-s |
+| express | expres / expresss / experss |
+| request | requests2 / request-promise-x |
+| moment | momemt / momet / moment-js |
+
+Edit-distance command (PowerShell or Node; a result ≤ 2 enters the suspect set):
+
+```sh
+node -e "const lv=(a,b)=>{const m=a.length,n=b.length,d=Array.from({length:m+1},(_,i)=>[i,...Array(n).fill(0)]);for(let j=0;j<=n;j++)d[0][j]=j;for(let i=1;i<=m;i++)for(let j=1;j<=n;j++)d[i][j]=Math.min(d[i-1][j]+1,d[i][j-1]+1,d[i-1][j-1]+(a[i-1]===b[j-1]?0:1));return d[m][n]};console.log(lv(process.argv[1],process.argv[2]))" <new package> <popular package>
+```
+
+Sample output: `2`
+Criterion: edit distance ≤ 2 is a **necessary condition, not sufficient** — "short creation time / extremely low downloads" must stack on top before blocking.
+
+## npm view field notes
+
+| Command | Field | Handling when missing |
+|---|---|---|
+| `npm view <package> time.created` | Creation time | No output = the package does not exist / registry unreachable — confirm the spelling first |
+| `npm view <package> --json` → `downloads`/`weeklyDownloads` | Download counts | Some registries do not return it → record as "unknown", never conclude from it |
+| `npm view <package> repository.url` | Source repository | Missing / suspicious fork → record, hand to dependency-audit item 4 |
+| `npm view <package> dist.fileCount dist.tarball --json` | Package size and download origin | An abnormally large fileCount (> 1000) or a tarball host that is not `registry.npmjs.org` → record and review manually |
+
+## The three reproducible-build factors and their criteria
+
+| Factor | Command | Pass criterion |
+|---|---|---|
+| Lockfile committed | `git ls-files -- '*lock*'` | At least one lockfile path in the output |
+| CI frozen install | `grep -nE 'frozen-lockfile|npm ci' .github/workflows/*` | At least one hit |
+| integrity fields | `grep -c 'integrity' <lockfile>` | Count > 0 and on the same order as the dependency entries |
+
+The three-tier decision:
+
+- **Pass**: all three factors present + no blocking item from Sections 1 and 2.
+- **Request changes**: any one factor missing, or exactly one suspicious condition from Section 2.
+- **Block**: any Section-1 blocking pattern; both Section-2 conditions at once; no lockfile with more than 20 new direct dependencies.
+
+## Additional re-checks (they do not change the three-tier threshold, but must accompany the verdict)
+
+- **CI action pinning**: `git diff <base>...HEAD -- .github/workflows | grep -nE '^\+.*uses:'`. A new/changed `uses: <owner>/<repo>@v<number>` not pinned to a commit SHA (`@<40-hex>`) → request changes; read-only third-party actions that never touch secrets are recorded only.
+- **Lockfile growth**: compare `git diff <base>...HEAD -- <lockfile> | grep -cE '^\+'` with the number of new direct dependencies; 1 declared dependency but +500 lines → record and inspect the diff manually.
+
+## PR comment templates
+
+Pass:
+
+```
+Dependency review: passed. Evidence: npm view <package> scripts shows no install script; creation time/downloads normal; lockfile + CI frozen install + integrity all present. False-positive exclusion: <package>'s build script is ecosystem convention (purpose-consistent, no credential touch).
+```
+
+Request changes:
+
+```
+Dependency review: request changes. <Specific gap> is not satisfied: <evidence command and output summary>. Please <add the lockfile / add frozen install / explain the download numbers> and I will re-review.
+```
+
+Block:
+
+```
+Dependency review: blocked. <Dangerous pattern / both typosquat conditions> hit: <evidence command and output summary>. Risk: <one-sentence consequence>. Suggestion: <switch package / pin a trusted source>.
+```

package/pack/skills-en/threat-model/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: threat-model
+description: 'Lightweight threat modeling for new features/systems: fix the target, scope and trust boundaries, asset inventory, per-asset STRIDE table, optional attack tree, mitigations and priority — producing a threat-model document ready for design review. Use for design-stage security review of new features/changes, mapping trust boundaries, or drawing attack trees; not for unrelated pure bug fixes, and teams with an established modeling process need not run this flow.'
+whenToUse: 'Use when the user asks for threat modeling of a new feature/system, design-stage security review, STRIDE analysis, attack-tree analysis, or wants security considered up front at design time. Pure implementation detail discussions and changes unrelated to trust boundaries do not trigger this skill.'
+metadata:
+  pack: dsh-skill-pack-security
+  version: '1.3.0'
+---
+
+# Threat modeling (threat-model)
+
+This skill does **design-stage** lightweight threat modeling: for one change or one new component, it produces trust boundaries, a STRIDE threat table, and a mitigation list. It covers the modeling method only; tiering existing audit findings goes to `security-audit`, and looking up specific vulnerabilities goes to `vuln-intel`. The output carries no secrets and can go into design documents.
+
+## 1. Fix the modeling target (an unfixed target makes the model unreproducible)
+
+```sh
+git rev-parse --show-toplevel
+git log -1 --format='%H %cd' --date=iso-strict
+```
+
+Expected sample output (use the actual output):
+
+```
+D:\repo\example
+a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 2026-08-14T10:30:00+08:00
+```
+
+Criterion: exit code 0 and the first line is an absolute path; the threat-model document header must record this commit hash so reviewers know which version the model targets.
+
+## 2. Scope: what changed, where the boundaries are
+
+```sh
+git diff --stat <base>...HEAD
+git diff --name-only <base>...HEAD
+```
+
+Expected sample output: `src/auth/session.ts | 40 ++++`, followed by the changed file paths.
+Criterion: the scope = the files and components this diff touches; **never model the whole repository** (a whole-repo model is too large and nobody reviews it). For a brand-new module with no diff, use `git ls-files -- '<module dir>'` instead.
+Four trust-boundary classes; every asset must state its boundary: in-process (code within one process), inter-process (IPC/HTTP/RPC), system boundary (local machine/kernel/filesystem), external (third-party services/users/upstream data).
+
+## 3. Asset inventory (the rows of the STRIDE table)
+
+```sh
+git ls-files -- 'package.json' 'pnpm-lock.yaml' '.env*' '.github/workflows/**' 'Dockerfile*' '*.tf' 'cordis.yml' '**/cordis.yml' '*.pem' '**/*.key'
+```
+
+Expected sample output: one relative path per line; no matches = that class of asset does not exist.
+Criterion: the inventory covers at least four classes — data (secrets, user data, configuration), code (the changed module), channels (APIs, messages, logs), hosts (CI, containers, external dependencies). Fill in whatever class is missing; do not list only the files in this diff.
+
+## 4. Per-asset STRIDE threat table
+
+Ask the six questions for every asset from section 3 (full definitions and question prompts live in `references/stride-and-attack-tree.md`):
+
+| Asset | S spoofing | T tampering | R repudiation | I info disclosure | D DoS | E elevation | Entry path | Mitigation |
+|---|---|---|---|---|---|---|---|---|
+| e.g. session token | forged token | tampered claims | no audit log | token in logs | session storm | swap identity | API lacks signature check | signature + least privilege |
+
+Criterion: **every cell either names a threat or states "not applicable (reason)"** — a blank cell means no modeling happened; a threat must state "who, through which path, with what impact" — missing any one of the three downgrades it to "observation".
+After filling the table, cross-check: does every asset's "entry path" cross a trust boundary? An asset whose paths cross no boundary means the boundary map is incomplete — go back to section 2.
+
+## 5. Attack tree (optional: only for high-risk surfaces)
+
+```sh
+dot -Tpng attack-tree.dot -o attack-tree.png
+# without graphviz, use an indented text tree instead (example in references)
+```
+
+Expected sample output: exit code 0 and `attack-tree.png` produced.
+Criterion: draw trees only for section-4 threats that are "high impact × multiple preconditions"; root = the attack goal, leaves = preconditions; **every leaf must be verifiable** (one command proves the precondition holds or not) — leaves that cannot be verified are labeled "unverified assumption". Both the `.dot` source and the rendered image go into the review material.
+
+## 6. Mitigations and priority
+
+Pick mitigations from four directions (landing templates for each live in `references/stride-and-attack-tree.md`):
+
+- Eliminate: change the design so the path does not exist (highest priority — ask "can we not build this" first in the review);
+- Transfer: hand it to existing defenses (authentication to SSO, secrets to KMS/CI secrets);
+- Mitigate: add checks at the boundary (signatures, authz, rate limits, redacted logs);
+- Accept: state the reason and the residual risk, recorded as an "accepted risk".
+
+Priority criterion = exploitability × impact (the `security-audit` three factors minus "exposed" — at design stage nothing is exposed yet).
+
+## 7. Deliverables and self-check
+
+Deliverables: trust-boundary description (text or diagram) + asset inventory + STRIDE table + (optional) attack tree + mitigation list.
+Self-check command (expected output: no matches; a match means a table row is unfinished):
+
+```sh
+grep -nE '\| *TBD *\||待定' threat-model.md
+```
+
+## Division of labor with the other skills
+
+- `security-audit`: full audits and tiering of existing repositories — high-risk paths found by this model go there for item-by-item verification.
+- `vuln-intel`: when a third-party component referenced in the design has a CVE, look up its details and impact.
+- `supply-chain-review`: when the modeled scope adds dependencies, run the quick supply-chain review on them.
+- `secret-scan`: secret-class assets in the inventory go straight to it for scanning and redaction.

package/pack/skills-en/threat-model/references/stride-and-attack-tree.md

@@ -0,0 +1,76 @@
+# STRIDE and attack-tree details (threat-model/references/stride-and-attack-tree.md)
+
+Full definitions, question prompts, and templates for sections 4–6 of the main file.
+
+## The six STRIDE questions
+
+| Category | Full name | Question to ask | Common entry paths |
+|---|---|---|---|
+| S | Spoofing | Who can impersonate a legitimate principal (user/service/package)? | unsigned APIs, forgeable tokens, unverified domains |
+| T | Tampering | Who can change data/code/config without detection? | plaintext transport, caches without integrity checks, writable config files |
+| R | Repudiation | After an incident, can we prove "who did what"? | no audit logs, logs deletable by same-level permissions |
+| I | Information disclosure | Who can see data they should not? | secrets in logs, unauthorized endpoints, error echo |
+| D | Denial of service | Who can make the service/flow unavailable? | unbounded queues, external calls without timeouts, unthrottled resources |
+| E | Elevation of privilege | Who can gain permissions beyond the design? | unauthorized parameters, high-privilege default accounts, injectable config |
+
+Criterion: a cell may state "not applicable (reason)", but **the reason must relate to the asset's properties** (e.g. "a static document has no write channel → T not applicable"); "feels fine" is not a reason.
+
+## The four trust-boundary classes
+
+1. **In-process**: code within one process — trusted by default, unless plugins/dynamic loading exist;
+2. **Inter-process**: IPC/HTTP/RPC/message queues — every crossing asks "who is on the other side, what credentials do they hold";
+3. **System boundary**: local filesystem, kernel, environment variables, container runtime;
+4. **External**: third-party APIs, user input, upstream repos/images — highest risk; all external input is treated as data by default (see the `prompt-injection-review` three questions).
+
+## Drawing attack trees
+
+- Root = the attack goal ("obtain write access to X"), leaves = preconditions ("the service is unauthenticated").
+- Every leaf states its verification: one command proving the precondition holds or not; unverifiable ones are labeled "unverified assumption".
+- Indented text tree example:
+
+```text
+Gain deployment access
+├─ OR: steal the CI token
+│   ├─ precondition: plaintext .env in repo (verify: git grep -n 'TOKEN' -- '.env*')
+│   └─ precondition: workflow uses pull_request_target + secrets (verify: git grep -n 'pull_request_target' -- '.github/workflows/**')
+└─ OR: dependency poisoning
+    ├─ precondition: install scripts allowed (verify: npm view <pkg> scripts --json)
+    └─ precondition: actions not SHA-pinned (verify: git grep -nE 'uses: [A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@v[0-9]' -- '.github/workflows/**')
+```
+
+The `dot` form is isomorphic (both the `.dot` source and the `dot -Tpng` render go into the review material):
+
+```dot
+digraph attack_tree {
+  goal [label="Gain deployment access"];
+  steal_token [label="Steal the CI token"];
+  poison_dep [label="Dependency poisoning"];
+  goal -> steal_token; goal -> poison_dep;
+}
+```
+
+## Mitigation landing templates
+
+| Direction | Template wording |
+|---|---|
+| Eliminate | "The path disappears with this design change: <change>; acceptance: <command> proves the path no longer exists" |
+| Transfer | "Handed to <existing defense>; acceptance: <location of its config/docs>" |
+| Mitigate | "Add <check> at <boundary>; acceptance: <command showing a bypass attempt is blocked>" |
+| Accept | "Reason: <why>; residual risk: <description>; reviewer: <name>" |
+
+## Deliverable template
+
+```markdown
+# <component> threat model
+Target: <repo> @ <commit hash> (fixed on 2026-xx-xx)
+Scope: <diff or module list>
+## Trust boundaries
+(text or diagram; every asset states its boundary class)
+## Asset inventory
+| Asset | Class (data/code/channel/host) | Boundary |
+## STRIDE table
+(the main file's section-4 table)
+## Attack tree (optional)
+## Mitigation list
+| Threat | Direction (eliminate/transfer/mitigate/accept) | Landing | Acceptance command |
+```

package/pack/skills-en/vuln-intel/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: vuln-intel
+description: 'Vulnerability intelligence lookup and triage: query commands for the four authoritative sources NVD/CISA-KEV/GHSA/OSV, response interpretation, and misjudgment criteria — turning a CVE/GHSA id into an evidence-backed verdict of "actively exploited? × does it affect this project?". Use when given a CVE/GHSA id to look up details and impact, to judge active-exploitation status, or to write a vulnerability brief; not for id-less general vulnerability education.'
+whenToUse: 'Use when the user gives a CVE/GHSA id and asks for details and impact, whether a vulnerability is actively exploited (KEV), its applicability to the current project/dependencies, or a vulnerability intelligence brief. General security learning without a specific id, and discussions unrelated to a specific vulnerability, do not trigger this skill.'
+metadata:
+  pack: dsh-skill-pack-security
+  version: '1.3.0'
+---
+
+# Vulnerability intelligence (vuln-intel)
+
+Goal: turn one vulnerability id into a risk verdict **where every line carries its source command**. Only relay source data (severity is copied from NVD/GHSA, never inferred); the verdict structure = id + severity + actively exploited? + affects this project? + remediation advice.
+
+## 1. Tool readiness and rate limits
+
+```sh
+curl --version; jq --version; gh --version
+```
+
+Sample output: `curl 8.9.1` / `jq-1.7.1` / `gh version 2.61.0`.
+Criterion: curl and jq must be available (every query is curl+jq); `gh` is optional (only for the authenticated query in section 4). Unauthenticated rate limits: NVD roughly 5 requests per 30 seconds, GitHub API 60 per hour — when batch querying, wait 6 seconds between requests; a 403/429 means rate-limited, not "the vulnerability does not exist".
+
+## 2. NVD (the CVE baseline: description, CVSS, references)
+
+```sh
+curl -s 'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1234' | jq '.vulnerabilities[0].cve | {id, published, lastModified, metrics, references: [.references[].url]}'
+```
+
+Expected sample output (use the actual output):
+
+```json
+{ "id": "CVE-2024-1234", "published": "2024-03-01T00:00:00.000", "lastModified": "2024-06-01T00:00:00.000", "metrics": { "cvssMetricV31": [ { "cvssData": { "baseSeverity": "HIGH", "baseScore": 8.1 } } ] }, "references": ["https://github.com/example/example-lib/security/advisories/GHSA-xxxx-yyyy-zzzz"] }
+```
+
+Criterion: an empty `vulnerabilities` array = the id does not exist or is misspelled — re-check the id before concluding; copy CVSS `baseScore`/`baseSeverity` verbatim, never recompute; a `lastModified` much later than `published` = the entry was updated — treat the latest as authoritative.
+
+## 3. CISA KEV (the only authoritative actively-exploited criterion)
+
+```sh
+curl -s 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json' | jq '.vulnerabilities[] | select(.cveID=="CVE-2024-1234")'
+```
+
+Expected sample output (a hit):
+
+```json
+{ "cveID": "CVE-2024-1234", "vendorProject": "Example", "product": "example-lib", "vulnerabilityName": "Example RCE", "dateAdded": "2024-04-15", "knownRansomwareCampaignUse": "Unknown" }
+```
+
+Criterion: **a hit = known active exploitation**, and the verdict upgrades to "fix immediately"; no hit ≠ not exploited — KEV entry lags, so the verdict states "not in KEV as of the query date". `knownRansomwareCampaignUse: Known` = ransomware is exploiting it — raise the priority further.
+
+## 4. GHSA (ecosystem-specific remediation and affected versions)
+
+```sh
+curl -s 'https://api.github.com/advisories/GHSA-xxxx-yyyy-zzzz' | jq '{ghsa_id, severity, cvss, summary, vulnerabilities, references}'
+# authenticated query (optional, higher rate limit): gh api graphql -f query='{ securityAdvisory(ghsaId:"GHSA-xxxx-yyyy-zzzz") { severity summary vulnerabilities { firstPatchedVersion { identifier } } } }'
+```
+
+Expected sample output (use the actual output): `{ "ghsa_id": "GHSA-xxxx-yyyy-zzzz", "severity": "high", "vulnerabilities": [ { "package": { "name": "example-lib", "ecosystem": "npm" }, "first_patched_version": "2.3.1" } ] }`
+Criterion: when GHSA `severity` disagrees with NVD, **record both** (different sources and scorers) — never let one overwrite the other; `first_patched_version` is the direct basis for remediation advice — without it write "no fixed version yet", never claim "upgrading fixes it".
+
+## 5. OSV (precise cross-ecosystem package version ranges)
+
+```sh
+curl -s -X POST 'https://api.osv.dev/v1/query' -H 'Content-Type: application/json' -d '{"package":{"name":"example-lib","ecosystem":"npm"}}' | jq '.vulns[] | {id, aliases, summary, affected}'
+```
+
+Expected sample output: `{ "id": "GHSA-xxxx-yyyy-zzzz", "aliases": ["CVE-2024-1234"], "summary": "...", "affected": [ { "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.3.1" } ] } ] } ] }`
+Criterion: OSV's value is the **version-precise affected ranges** (`introduced`/`fixed` events); `aliases` cross-references sources (one entry is a CVE on NVD and a GHSA on GitHub). OSV has no entry ≠ no vulnerability — it only means that source has no data.
+
+## 6. Landing verdict: match against the current project's dependency tree
+
+```sh
+pnpm why example-lib
+grep -n '"example-lib' pnpm-lock.yaml
+```
+
+Expected sample output: `dependencies: prod-dep 1.0.0 → example-lib 2.2.9`; the lockfile hit line carries the version.
+Criterion: package not in the dependency tree = verdict "not applicable (this repository does not depend on it)" with the empty `pnpm why` output as evidence; in the tree and the version falls in the affected range = a finding, hand it to `dependency-audit` for the full remediation flow; version above `fixed` = already fixed, with the version line as evidence. Any "possible impact" without dependency-tree evidence goes into "observations".
+
+## 7. Brief template and self-check
+
+Each verdict = id + severity (with source) + KEV hit or not (with query date) + project applicability (with command output) + remediation (with patched version). Multi-id tasks produce a table: id / severity / actively exploited / project impact / fix. The four-source comparison table, jq quick reference, and offline paths live in `references/advisory-sources.md`.
+Self-check command (expected output: no matches; a match means the brief contains a source-less severity claim):
+
+```sh
+grep -nE '^-[[:space:]]*(high|critical|严重|高危)' brief.md
+```
+
+## Division of labor with the other skills
+
+- `dependency-audit`: the remediation after "affects this project" and full dependency audits belong to it.
+- `security-audit`: when an audit finds a specific CVE, use this skill to look up details and fill them back into the audit report.
+- `threat-model`: when a design references a component, look up its vulnerability history as attack-path evidence.

package/pack/skills-en/vuln-intel/references/advisory-sources.md

@@ -0,0 +1,45 @@
+# Source comparison and quick reference (vuln-intel/references/advisory-sources.md)
+
+The full comparison table and offline paths for sections 1–7 of the main file.
+
+## The four sources compared
+
+| Source | Content | Strength | Limit | Unauthenticated rate limit |
+|---|---|---|---|---|
+| NVD `services.nvd.nist.gov` | CVE description, CVSS, references | authoritative ids, carries CVSS | entry lag; CVSS is a generic score, not project-specific | ~5 per 30 seconds |
+| CISA KEV | list of known exploited vulnerabilities | the official active-exploitation criterion | only exploited ones, with delay | none (static JSON) |
+| GitHub Advisories (GHSA) | in-ecosystem advisories, fixed versions, affected packages | most direct remediation advice | GitHub-centric ecosystem | 60 per hour |
+| OSV `api.osv.dev` | cross-ecosystem precise version ranges | `introduced`/`fixed` precise to versions | no independent description, aggregates sources | no hard limit (be considerate) |
+
+## Common jq filter quick reference
+
+```sh
+# NVD: only the CVSS 3.1 score
+jq '.vulnerabilities[0].cve.metrics.cvssMetricV31[0].cvssData.baseScore'
+# KEV: entries added on/after a date
+jq '[.vulnerabilities[] | select(.dateAdded >= "2024-01-01")] | length'
+# OSV: list all aliases (cross-source matching)
+jq '.vulns[] | {id, aliases}'
+# OSV: npm ecosystem only
+curl -s -X POST 'https://api.osv.dev/v1/query' -H 'Content-Type: application/json' -d '{"package":{"name":"example-lib","ecosystem":"npm"}}' | jq '[.vulns[] | select(.affected[].package.ecosystem=="npm")]'
+```
+
+Criterion: jq filters are view selection only — **they do not change the data**; never put a filtered-out field into the verdict (e.g. filtering out description and then claiming "this source has no description").
+
+## EPSS (optional reference, never tiers anything)
+
+EPSS (`api.first.org/data/v1/epss?cve=CVE-2024-1234`) is a model score for "probability of exploitation within 30 days". Use it only to order remediation priority — **it does not change severity and does not replace KEV**; a model score is not a fact.
+
+## Offline paths
+
+- NVD: download the official feeds (`https://nvd.nist.gov/vuln/data-feeds`, gzip JSON) and grep locally; state the feed date in the report.
+- KEV: download the same JSON to a local cache (`curl -o kev.json <URL>`) and query with `jq`.
+- OSV: `osv-scanner` supports `--offline` (with local OSV data), see `dependency-audit` section 6.
+- Fully offline: the verdict must state "data as of <feed date>, not checked live".
+
+## Brief table template
+
+| Id | Severity (source) | KEV (query date) | Project impact (command evidence) | Remediation |
+|---|---|---|---|---|
+| CVE-2024-1234 | HIGH (NVD) | not listed (2026-08-14) | not applicable: `pnpm why` empty | — |
+| GHSA-xxxx-yyyy-zzzz | high (GHSA) | — | affected: example-lib 2.2.9 < 2.3.1 | upgrade to 2.3.1 |

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@perrylink/dsh-skill-pack-security-provider",
+  "version": "1.3.0",
+  "description": "Optional provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills. Ships both editions embedded in pack/.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PerryLink/dsh-skill-pack-security.git",
+    "directory": "provider"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts",
+    "pack/**",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "license": "Apache-2.0",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "skill-pack",
+    "skills",
+    "security",
+    "security-audit",
+    "supply-chain"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@types/node": "^22.15.0",
+    "typescript": "^5.7.0"
+  },
+  "scripts": {
+    "build": "tsc --noEmitOnError",
+    "typecheck": "tsc --noEmit",
+    "prepack": "node scripts/copy-skills.mjs"
+  }
+}