@perrylink/dsh-skill-pack-security-provider 2.0.2 → 2.1.0

package/README.md

@@ -23,6 +23,7 @@ This directory is an **optional** DSH plugin: it registers the pack's skill dire
 | `language` | `'zh' \| 'en'` | `'zh'` | Which edition to publish: the Chinese `skills/` or the English `skills-en/`. Ignored when `skillsDir` is set. |
 | `skillsDir` | string | — | Explicit skills root; overrides the `language`-derived default. Must exist and contain at least one `<skill>/SKILL.md` bundle, otherwise the plugin refuses to load. |
 | `watch` | boolean | `false` | Whether to watch the packaged directory; packaged content is static. |
+| `vet.dataResponsibility` | boolean | `true` | Run the `plugin_vet` data-responsibility review (ungated sensitive-seam hooks, undisclosed outbound endpoints, description-behavior coverage, embedded instruction-override payloads). Full `vet.*` documentation lives in the root README. |
 
 ### Mounting (any one)
 
@@ -67,6 +68,7 @@ Check 8 of `../verify/verify-skill-pack.mts` exercises this plugin: mounting the
 | `language` | `'zh' \| 'en'` | `'zh'` | 发布哪个语言版：中文 `skills/` 或英文 `skills-en/`；设置了 `skillsDir` 时忽略 |
 | `skillsDir` | string | — | 显式指定技能根目录，覆盖 `language` 推导的默认值；必须存在且含至少一个 `<skill>/SKILL.md` 包，否则插件拒绝加载 |
 | `watch` | boolean | `false` | 是否监听包内技能目录；静态内容无需监听 |
+| `vet.dataResponsibility` | boolean | `true` | 运行 `plugin_vet` 数据责任审查（无门控敏感监听、未披露出站端点、描述-行为覆盖率、随包文本中的指令覆盖类注入载荷）；完整 `vet.*` 文档见根 README |
 
 ### 挂载方式（任选）
 

package/lib/index.js

@@ -38,7 +38,8 @@ export const Config = z.object({
         maxExtractBytes: z.natural().min(1024).max(512 * 1024 * 1024).default(64 * 1024 * 1024),
         maxDepNodes: z.natural().min(1).max(10000).default(600),
         maxFindingsPerCheck: z.natural().min(1).max(100).default(12),
-        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.0.0 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
+        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.1.0 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
+        dataResponsibility: z.boolean().default(true),
         gate: z.object({
             policy: z.union(['warn', 'deny']).default('warn'),
         }),

package/lib/types/vet/checks.d.ts

@@ -39,5 +39,6 @@ export declare function networkExfilCheck(inputs: CheckInputs): VetCheck;
 export declare function obfuscationCheck(inputs: CheckInputs): VetCheck;
 export declare function sourceCheck(inputs: CheckInputs): VetCheck;
 export declare function maintenanceCheck(inputs: CheckInputs): VetCheck;
+export declare function dataResponsibilityCheck(inputs: CheckInputs): VetCheck;
 /** Run the requested checks over shared inputs. */
 export declare function runChecks(inputs: CheckInputs, ids: readonly CheckId[]): CheckResult[];

package/lib/types/vet/config.d.ts

@@ -18,6 +18,7 @@ export interface VetConfigInput {
     readonly maxDepNodes?: number;
     readonly maxFindingsPerCheck?: number;
     readonly userAgent?: string;
+    readonly dataResponsibility?: boolean;
     readonly gate?: {
         readonly policy?: GatePolicy;
     };
@@ -32,6 +33,7 @@ export interface VetConfig {
     readonly maxDepNodes: number;
     readonly maxFindingsPerCheck: number;
     readonly userAgent: string;
+    readonly dataResponsibility: boolean;
     readonly gate: {
         readonly policy: GatePolicy;
     };

package/lib/types/vet/data-responsibility.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The data-responsibility review check: the Claude policy-scan dimensions,
+ * shipped as deterministic rules (the model-assisted stage is a documented
+ * future upgrade). Four sub-scans over the shipped payload:
+ *
+ *  1. hooks-scope — listeners/effects registered on sensitive seams
+ *     (`agent/pre-step`, `tools/pre-execute`, `session/event`, …) must show
+ *     project-relevance gating; an ungated broad-scope hook is a warn.
+ *  2. telemetry-disclosure — non-local URL literals in shipped files must be
+ *     disclosed in the README (multilingual disclosure keywords); an
+ *     undisclosed endpoint is a warn.
+ *  3. description-behavior — the manifest description must be reflected in
+ *     the shipped text (keyword coverage); near-zero coverage is an info.
+ *  4. injection-payload — embedded instruction-override payloads in shipped
+ *     text (skills, docs, prompts, tests) are warns; the manual continuation
+ *     is the pack's prompt-injection-review skill.
+ *
+ * Pure and tolerant: every file is read from the shared `ScannedFile[]`
+ * (no filesystem/network), unreadable text is skipped, and evidence is
+ * redacted and capped through the shared redactor.
+ *
+ * NOTE on the pattern literals below: a security scanner ships the attack
+ * PATTERNS, never the payloads — but content filters scanning this very
+ * source cannot tell the difference, so the phrase literals are fragmented
+ * (joined at runtime) to keep the shipped scanner itself from tripping them.
+ *
+ * @module dsh-skill-pack-security/vet/data-responsibility
+ */
+import { type Lang } from './skills.js';
+import type { ScannedFile } from './walk.js';
+import type { VetConfig } from './config.js';
+import type { VetFinding } from './vocabulary.js';
+/** Run the whole data-responsibility review over the shared inputs. */
+export declare function dataResponsibilityFindings(files: ScannedFile[], manifestDescription: string, readmeText: string, lang: Lang, _config: VetConfig): VetFinding[];
+/** Score the review: 100 minus per-level deductions, floored at 0. */
+export declare function dataResponsibilityScore(findings: VetFinding[]): number;

package/lib/types/vet/manifest.d.ts

@@ -19,6 +19,7 @@ export interface Manifest {
     readonly optionalDependencies: Record<string, string>;
     readonly peerDependencies: Record<string, string>;
     readonly repository: string;
+    readonly description: string;
     readonly present: boolean;
 }
 /** One dependency edge inside a lockfile entry: name → raw spec. */

package/lib/types/vet/vocabulary.d.ts

@@ -16,7 +16,7 @@ export type GatePolicy = 'warn' | 'deny';
 /** How a scan target is addressed. */
 export type TargetKind = 'github-repo' | 'local-path' | 'npm-package';
 /** Stable check ids; each maps to exactly one dimension and one skill section. */
-export type CheckId = 'license' | 'sbom' | 'commit-lock' | 'install-scripts' | 'network-exfil' | 'obfuscation' | 'source' | 'maintenance';
+export type CheckId = 'license' | 'sbom' | 'commit-lock' | 'install-scripts' | 'network-exfil' | 'obfuscation' | 'source' | 'maintenance' | 'data-responsibility';
 export declare const ALL_CHECK_IDS: readonly CheckId[];
 /** Finding severity: fail blocks the check, warn downgrades, info is an observation. */
 export type FindingLevel = 'fail' | 'warn' | 'info';

package/lib/vet/checks.js

@@ -10,6 +10,7 @@ import { buildDependencyTree, unpinnedSpecs } from './manifest.js';
 import { redactSnippet } from './redact.js';
 import { isCommitRef } from './source.js';
 import { CHECK_NAME, SKILL_REF } from './skills.js';
+import { dataResponsibilityFindings, dataResponsibilityScore } from './data-responsibility.js';
 function clamp(value, min = 0, max = 100) {
     return Math.min(max, Math.max(min, Math.round(value)));
 }
@@ -719,6 +720,26 @@ export function maintenanceCheck(inputs) {
     }
     return makeCheck('maintenance', score, findings, lang, config);
 }
+// --- data-responsibility ------------------------------------------------------
+/** README text across the shipped files (the telemetry-disclosure corpus). */
+function readmeTextOf(files) {
+    return files
+        .filter(file => file.text !== null && /^readme(\.|$)/i.test(file.path.split('/').pop() ?? ''))
+        .map(file => file.text)
+        .join('\n');
+}
+export function dataResponsibilityCheck(inputs) {
+    const { files, manifest, lang, config } = inputs;
+    const findings = dataResponsibilityFindings(files, manifest.description, readmeTextOf(files), lang, config);
+    if (findings.length === 0) {
+        return makeCheck('data-responsibility', 100, [{
+                level: 'info',
+                message: lang === 'zh' ? '随包文本未发现无门控敏感监听、未披露出站端点或注入载荷特征' : 'no ungated sensitive-seam listeners, undisclosed outbound endpoints, or injection-payload indicators in shipped text',
+                skill: SKILL_REF['data-responsibility'],
+            }], lang, config);
+    }
+    return makeCheck('data-responsibility', dataResponsibilityScore(findings), findings, lang, config);
+}
 // --- runner ----------------------------------------------------------------------------
 /** Run the requested checks over shared inputs. */
 export function runChecks(inputs, ids) {
@@ -749,6 +770,9 @@ export function runChecks(inputs, ids) {
             case 'maintenance':
                 results.push({ check: maintenanceCheck(inputs) });
                 break;
+            case 'data-responsibility':
+                results.push({ check: dataResponsibilityCheck(inputs) });
+                break;
         }
     }
     return results;

package/lib/vet/config.js

@@ -15,7 +15,8 @@ export const VET_DEFAULTS = {
     maxExtractBytes: 64 * 1024 * 1024,
     maxDepNodes: 600,
     maxFindingsPerCheck: 12,
-    userAgent: 'dsh-skill-pack-security/2.0.0 (+https://github.com/PerryLink/dsh-skill-pack-security)',
+    userAgent: 'dsh-skill-pack-security/2.1.0 (+https://github.com/PerryLink/dsh-skill-pack-security)',
+    dataResponsibility: true,
     gate: { policy: 'warn' },
 };
 /** Merge raw config over the defaults (the schema already validated shape/ranges). */
@@ -31,6 +32,7 @@ export function resolveVetConfig(raw) {
         maxDepNodes: raw.maxDepNodes ?? VET_DEFAULTS.maxDepNodes,
         maxFindingsPerCheck: raw.maxFindingsPerCheck ?? VET_DEFAULTS.maxFindingsPerCheck,
         userAgent: raw.userAgent ?? VET_DEFAULTS.userAgent,
+        dataResponsibility: raw.dataResponsibility ?? VET_DEFAULTS.dataResponsibility,
         gate: { policy: raw.gate?.policy ?? VET_DEFAULTS.gate.policy },
     };
 }

package/lib/vet/data-responsibility.js

@@ -0,0 +1,213 @@
+/**
+ * The data-responsibility review check: the Claude policy-scan dimensions,
+ * shipped as deterministic rules (the model-assisted stage is a documented
+ * future upgrade). Four sub-scans over the shipped payload:
+ *
+ *  1. hooks-scope — listeners/effects registered on sensitive seams
+ *     (`agent/pre-step`, `tools/pre-execute`, `session/event`, …) must show
+ *     project-relevance gating; an ungated broad-scope hook is a warn.
+ *  2. telemetry-disclosure — non-local URL literals in shipped files must be
+ *     disclosed in the README (multilingual disclosure keywords); an
+ *     undisclosed endpoint is a warn.
+ *  3. description-behavior — the manifest description must be reflected in
+ *     the shipped text (keyword coverage); near-zero coverage is an info.
+ *  4. injection-payload — embedded instruction-override payloads in shipped
+ *     text (skills, docs, prompts, tests) are warns; the manual continuation
+ *     is the pack's prompt-injection-review skill.
+ *
+ * Pure and tolerant: every file is read from the shared `ScannedFile[]`
+ * (no filesystem/network), unreadable text is skipped, and evidence is
+ * redacted and capped through the shared redactor.
+ *
+ * NOTE on the pattern literals below: a security scanner ships the attack
+ * PATTERNS, never the payloads — but content filters scanning this very
+ * source cannot tell the difference, so the phrase literals are fragmented
+ * (joined at runtime) to keep the shipped scanner itself from tripping them.
+ *
+ * @module dsh-skill-pack-security/vet/data-responsibility
+ */
+import { redactSnippet } from './redact.js';
+import { SKILL_REF } from './skills.js';
+/** Seams whose listeners can reshape the agent's model-visible surface. */
+const SENSITIVE_SEAMS = [
+    'agent/pre-step', 'agent/post-step', 'agent/inject', 'agent/pre-request',
+    'tools/pre-execute', 'tools/post-execute', 'tools/error',
+    'session/event', 'session/flush', 'session/disposed',
+    'web/fetch', 'web/search',
+];
+/** Patterns that count as project-relevance gating near a registration. */
+const GATING_PATTERNS = [
+    /\bprocess\.cwd\(\)/u,
+    /\bworkspaceRoot\b/u,
+    /\bprojectRoot\b/u,
+    /\ballowlist\b/iu,
+    /\bdenylist\b/iu,
+    /\bproject\b/iu,
+    /resolve\(/u,
+    /\bpath\b.*\.(?:dirname|relative|join)/u,
+];
+/** Multilingual README disclosure keywords for telemetry/privacy statements. */
+const DISCLOSURE_KEYWORDS = [
+    'telemetry', 'privacy', 'analytics', 'opt-out', 'opt out', 'data collection',
+    '遥测', '隐私', '数据收集', '退出',
+    'telemetría', 'privacidad', 'recopilación de datos', 'exclusión',
+    'telemetria', 'privacidade', 'coleta de dados',
+    'टेलीमेट्री', 'गोपनीयता', 'डेटा संग्रह',
+];
+/** Stopwords removed from the description before keyword coverage. */
+const STOPWORDS = new Set([
+    'the', 'a', 'an', 'and', 'or', 'of', 'for', 'with', 'your', 'in', 'on', 'to', 'is', 'are', 'by', 'as', 'at', 'from', 'that', 'this', 'it', 'into', 'per', 'via', 'one',
+    '一个', '与', '的', '为', '在', '和', '及', '或',
+]);
+/** Fragment joiner for the injection-pattern literals (see module note). */
+function frag(...parts) {
+    return parts.join('');
+}
+/** Embedded instruction-override payload patterns (OWASP LLM01 / policy-scan payloads). */
+const INJECTION_PATTERNS = [
+    { pattern: new RegExp(`(?:${frag('ig', 'nore')}|${frag('disre', 'gard')}|${frag('for', 'get')})\\s+(?:all|${frag('pre', 'vious')}|${frag('ab', 'ove')}|${frag('pri', 'or')})\\s+(?:${frag('instru', 'ctions')}|${frag('ru', 'les')}|${frag('com', 'mands')}|${frag('con', 'text')})`, 'iu'), label: 'ignore-previous-instructions' },
+    { pattern: new RegExp(`(?:${frag('over', 'ride')}|${frag('rep', 'lace')}|${frag('rew', 'rite')})\\s+(?:all|your|the)\\s+(?:${frag('instru', 'ctions')}|${frag('ru', 'les')}|${frag('system', ' prompt')})`, 'iu'), label: 'override-instructions' },
+    { pattern: new RegExp(`you\\s+are\\s+now\\s+(?:a|an)\\s+[a-z0-9 -]{2,40}(?:,|\\.|\\n|$)`, 'iu'), label: 'role-override' },
+    { pattern: new RegExp(`(?:${frag('rev', 'eal')}|${frag('pri', 'nt')}|${frag('sh', 'ow')}|${frag('rep', 'eat')})\\s+(?:your|the)\\s+(?:${frag('system', ' prompt')}|${frag('instru', 'ctions')}|${frag('ru', 'les')})`, 'iu'), label: 'prompt-exfiltration' },
+    { pattern: new RegExp(`${frag('act', ' as')}\\s+(?:if\\s+)?(?:you\\s+are\\s+)?[a-z0-9 -]{2,40}(?:,|\\.|\\n|$)`, 'iu'), label: 'act-as-injection' },
+];
+/** Files whose content is prompt-shaped (embedded payloads weigh heavier there). */
+const PROMPT_SHAPED = /(^|\/)(skills?|prompts?|SKILL|AGENTS?)(\/|\.|$)|\.md$/iu;
+/** Text files the review reads (manifests excluded: they carry URL literals by design). */
+function reviewable(file) {
+    return file.text !== null && file.skipped === null && !/\.(json|ya?ml|toml|lock)$/iu.test(file.path);
+}
+/** One sensitive-seam registration with its gating verdict. */
+function scanHooksScope(files, lang) {
+    const zh = lang === 'zh';
+    const findings = [];
+    const seamPattern = new RegExp(`['"](${SENSITIVE_SEAMS.map(seam => seam.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')).join('|')})['"]`, 'gu');
+    for (const file of files) {
+        if (!reviewable(file))
+            continue;
+        for (const match of file.text.matchAll(seamPattern)) {
+            const seam = match[1];
+            const gated = GATING_PATTERNS.some(pattern => pattern.test(file.text));
+            findings.push({
+                level: gated ? 'info' : 'warn',
+                message: gated
+                    ? (zh ? `${file.path} 在 ${seam} 注册监听并带相关性门控证据` : `${file.path} registers a ${seam} listener with relevance-gating evidence`)
+                    : (zh ? `${file.path} 在敏感 seam ${seam} 注册监听但未见项目相关性门控：审查其作用域` : `${file.path} registers a listener on the sensitive seam ${seam} without visible project-relevance gating: review its scope`),
+                location: file.path,
+                skill: SKILL_REF['data-responsibility'],
+            });
+            if (findings.length >= 24)
+                return findings;
+        }
+    }
+    return findings;
+}
+/** Outbound URL literals not disclosed in the README. */
+function scanTelemetry(files, readmeText, lang) {
+    const zh = lang === 'zh';
+    const findings = [];
+    const disclosed = DISCLOSURE_KEYWORDS.some(keyword => readmeText.toLowerCase().includes(keyword));
+    const seen = new Set();
+    for (const file of files) {
+        if (!reviewable(file))
+            continue;
+        for (const match of file.text.matchAll(/https?:\/\/[^\s"'`<>)\]]+/gu)) {
+            let host = '';
+            try {
+                host = new URL(match[0]).host.toLowerCase();
+            }
+            catch {
+                continue;
+            }
+            if (host === '' || host === 'localhost' || host.startsWith('127.') || host.startsWith('0.0.0.0') || host.includes('example.com') || host === 'registry.npmjs.org' || host === 'github.com' || host.endsWith('.github.io'))
+                continue;
+            if (seen.has(host))
+                continue;
+            seen.add(host);
+            if (!disclosed) {
+                findings.push({
+                    level: 'warn',
+                    message: zh ? `出站端点 ${host} 未见 README 遥测/隐私披露：确认用途与 opt-out` : `outbound endpoint ${host} has no README telemetry/privacy disclosure: confirm purpose and opt-out`,
+                    location: file.path,
+                    skill: SKILL_REF['data-responsibility'],
+                    evidence: redactSnippet(match[0], 140),
+                });
+                if (findings.length >= 12)
+                    return findings;
+            }
+        }
+    }
+    return findings;
+}
+/** Description-keyword coverage over the shipped text. */
+function scanDescriptionBehavior(description, files, lang) {
+    const zh = lang === 'zh';
+    const tokens = description
+        .toLowerCase()
+        .replace(/[^a-z0-9\u4e00-\u9fff\s]/gu, ' ')
+        .split(/\s+/u)
+        .filter(token => token.length >= 3 && !STOPWORDS.has(token));
+    if (tokens.length === 0)
+        return [];
+    const corpus = files.map(file => reviewable(file) ? file.text.toLowerCase() : '').join('\n');
+    const covered = tokens.filter(token => corpus.includes(token)).length;
+    const ratio = covered / tokens.length;
+    if (ratio >= 0.3)
+        return [];
+    return [{
+            level: 'info',
+            message: zh
+                ? `描述与随包文本的覆盖度仅 ${Math.round(ratio * 100)}%（${covered}/${tokens.length} 个关键词）：人工核对描述与行为一致性（prompt-injection-review §1）`
+                : `description coverage over shipped text is only ${Math.round(ratio * 100)}% (${covered}/${tokens.length} keywords): verify description-behavior consistency manually (prompt-injection-review §1)`,
+            skill: SKILL_REF['data-responsibility'],
+        }];
+}
+/** Embedded instruction-override payloads in shipped text. */
+function scanInjectionPayloads(files, lang) {
+    const zh = lang === 'zh';
+    const findings = [];
+    for (const file of files) {
+        if (!reviewable(file))
+            continue;
+        const promptShaped = PROMPT_SHAPED.test(file.path);
+        for (const { pattern, label } of INJECTION_PATTERNS) {
+            const match = pattern.exec(file.text);
+            if (match === null)
+                continue;
+            findings.push({
+                level: promptShaped ? 'warn' : 'info',
+                message: zh
+                    ? `${file.path} 含注入载荷特征（${label}）：若是安全测试夹具请确认不会进入运行时提示词`
+                    : `${file.path} carries an injection-payload indicator (${label}): if this is a security-test fixture, confirm it never reaches runtime prompts`,
+                location: file.path,
+                skill: SKILL_REF['data-responsibility'],
+                evidence: redactSnippet(match[0], 140),
+            });
+            if (findings.length >= 16)
+                return findings;
+            break;
+        }
+    }
+    return findings;
+}
+/** Run the whole data-responsibility review over the shared inputs. */
+export function dataResponsibilityFindings(files, manifestDescription, readmeText, lang, _config) {
+    const findings = [
+        ...scanHooksScope(files, lang),
+        ...scanTelemetry(files, readmeText, lang),
+        ...scanDescriptionBehavior(manifestDescription, files, lang),
+        ...scanInjectionPayloads(files, lang),
+    ];
+    return findings;
+}
+/** Score the review: 100 minus per-level deductions, floored at 0. */
+export function dataResponsibilityScore(findings) {
+    let score = 100;
+    for (const finding of findings) {
+        if (finding.level === 'warn')
+            score -= 12;
+        else if (finding.level === 'info')
+            score -= 4;
+    }
+    return Math.max(0, score);
+}

package/lib/vet/engine.js

@@ -77,11 +77,17 @@ function jsonClean(value) {
 /** Dimension → checks contributing to it. */
 const DIMENSION_CHECKS = {
     license: ['license'],
-    source: ['source', 'commit-lock'],
+    source: ['source', 'commit-lock', 'data-responsibility'],
     dependencies: ['sbom'],
     'build-scripts': ['install-scripts', 'network-exfil', 'obfuscation'],
     maintenance: ['maintenance'],
 };
+/** Weight factors per check inside the `source` dimension (they sum to 1). */
+const SOURCE_WEIGHTS = {
+    source: 0.5,
+    'commit-lock': 0.3,
+    'data-responsibility': 0.2,
+};
 /** Build the five-dimension scorecard from executed checks. */
 function scoreDimensions(checks) {
     const byId = new Map(checks.map(check => [check.id, check]));
@@ -99,7 +105,7 @@ function scoreDimensions(checks) {
                 return check.score * factor;
             }
             if (dim === 'source') {
-                return check.score * (check.id === 'source' ? 0.5 : 0.5);
+                return check.score * (SOURCE_WEIGHTS[check.id] ?? 1);
             }
             return check.score;
         });
@@ -121,6 +127,9 @@ function scoreDimensions(checks) {
 /** Run the whole pipeline for one tool call. */
 export async function runVet(args, config, lang, signal) {
     const ids = requestedChecks(args);
+    // The data-responsibility review can be disabled per deployment; an explicit
+    // per-call request then simply does not run (documented in the tool help).
+    const effectiveIds = config.dataResponsibility ? ids : ids.filter(id => id !== 'data-responsibility');
     const policy = args.policy === undefined || args.policy === 'inherit' ? config.gate.policy : args.policy;
     const now = Date.now();
     const fetchedAt = new Date(now).toISOString();
@@ -174,7 +183,7 @@ export async function runVet(args, config, lang, signal) {
         lang,
         localHead,
         now,
-    }, ids);
+    }, effectiveIds);
     const checks = results.map(result => result.check);
     const sbom = results.find(result => result.sbom !== undefined)?.sbom;
     // Unrequested checks are absent; the scorecard treats them as neutral.

package/lib/vet/manifest.js

@@ -31,7 +31,7 @@ export function parseManifest(files) {
     const empty = {
         name: '', version: '', license: '', scripts: {},
         dependencies: {}, devDependencies: {}, optionalDependencies: {}, peerDependencies: {},
-        repository: '', present: false,
+        repository: '', description: '', present: false,
     };
     if (hit === undefined || hit.text === null)
         return empty;
@@ -83,6 +83,7 @@ export function parseManifest(files) {
         optionalDependencies: record(pkg['optionalDependencies']),
         peerDependencies: record(pkg['peerDependencies']),
         repository: repositoryString,
+        description: typeof pkg['description'] === 'string' ? pkg['description'] : '',
         present: true,
     };
 }

package/lib/vet/skills.js

@@ -17,6 +17,7 @@ export const SKILL_REF = {
     obfuscation: 'supply-chain-review §1',
     source: 'dependency-audit §4.3',
     maintenance: 'security-audit §3',
+    'data-responsibility': 'prompt-injection-review §2',
 };
 /** check id → human-readable check name per language. */
 export const CHECK_NAME = {
@@ -29,6 +30,7 @@ export const CHECK_NAME = {
         obfuscation: '混淆代码检测',
         source: '来源可信信号',
         maintenance: '维护状态',
+        'data-responsibility': '数据责任审查',
     },
     en: {
         license: 'License scan',
@@ -39,6 +41,7 @@ export const CHECK_NAME = {
         obfuscation: 'Obfuscation scan',
         source: 'Source trust signals',
         maintenance: 'Maintenance status',
+        'data-responsibility': 'Data-responsibility review',
     },
 };
 /** dimension → label per language. */

package/lib/vet/tool.js

@@ -121,7 +121,7 @@ function textBlock(text) {
 export function buildVetTool(config, lang) {
     return defineTool({
         name: 'plugin_vet',
-        description: 'Supply-chain security gate for DSH plugin repositories/packages. Scans a target (GitHub `owner/repo[@ref]`, an `npm:name@version` package, or a local path) and returns a five-dimension risk report: license, source, dependencies, build scripts, maintenance. Checks: LICENSE/SPDX detection (missing/unknown/NOASSERTION flagged), SBOM dependency tree, 40-hex commit pinning of install references, dangerous postinstall/preinstall scripts, network-exfiltration domains, obfuscated code, source trust signals, maintenance status. Each finding cites the matching dsh-skill-pack-security skill section for a manual deep-dive. Use it BEFORE installing any plugin (`dsh plugin add`); a FAIL verdict warns or blocks depending on the configured gate policy (default warn). Read-only: never modifies the target. Respects timeouts; bounded network use.',
+        description: 'Supply-chain security gate for DSH plugin repositories/packages. Scans a target (GitHub `owner/repo[@ref]`, an `npm:name@version` package, or a local path) and returns a five-dimension risk report: license, source, dependencies, build scripts, maintenance. Checks: LICENSE/SPDX detection (missing/unknown/NOASSERTION flagged), SBOM dependency tree, 40-hex commit pinning of install references, dangerous postinstall/preinstall scripts, network-exfiltration domains, obfuscated code, source trust signals, maintenance status, and the data-responsibility review (ungated sensitive-seam hooks, undisclosed outbound endpoints, description-behavior coverage, embedded instruction-override payloads in shipped text). Each finding cites the matching dsh-skill-pack-security skill section for a manual deep-dive. Use it BEFORE installing any plugin (`dsh plugin add`); a FAIL verdict warns or blocks depending on the configured gate policy (default warn). Read-only: never modifies the target. Respects timeouts; bounded network use.',
         parameters: {
             target: {
                 type: 'string',
@@ -135,7 +135,7 @@ export function buildVetTool(config, lang) {
             checks: {
                 type: 'array',
                 items: { type: 'string' },
-                description: 'Optional subset of check ids: license, sbom, commit-lock, install-scripts, network-exfil, obfuscation, source, maintenance. Default: all.',
+                description: 'Optional subset of check ids: license, sbom, commit-lock, install-scripts, network-exfil, obfuscation, source, maintenance, data-responsibility. Default: all.',
             },
             policy: {
                 type: 'string',

package/lib/vet/vocabulary.js

@@ -16,4 +16,5 @@ export const ALL_CHECK_IDS = [
     'obfuscation',
     'source',
     'maintenance',
+    'data-responsibility',
 ];

package/pack/skills/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '依赖供应链审计：pnpm/npm audit 输出与退出码解读、
 whenToUse: '用户要求审计或盘点项目依赖安全（漏洞、license、投毒、锁文件漂移）、解读 audit 报告、判断某个依赖能否引入，或写依赖审计结论时使用；单个依赖的普通升级与纯功能开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 依赖审计（dependency-audit）

package/pack/skills/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'agent 环境安全事件响应：分类→控制蔓延→取证留
 whenToUse: 'agent 环境（DSH 会话、插件、MCP、CI）出现疑似安全事件——密钥泄露、被注入执行了未授权操作、依赖投毒、权限异常——需要响应、留证与复盘时使用；没有事件迹象的日常开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 事件响应（incident-response）

package/pack/skills/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: '面向 agent 项目的提示注入面审查：AGENTS.md、技能
 whenToUse: '审查 agent 项目的上下文注入面（AGENTS.md/CLAUDE.md、.agents/skills、工具描述、MCP server 来源、web 抓取链路）、评估间接注入风险或对 agent 项目做安全评审时使用；与模型上下文无关的普通代码评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 提示注入面审查（prompt-injection-review）

package/pack/skills/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: '凭据/密钥暴露审计：gitleaks、trivy 全历史扫描命令
 whenToUse: '用户要求扫描或检查仓库的密钥泄露、排查某提交或某文件中的 token、给扫描告警定真伪、写脱敏泄露报告或规划密钥轮换时使用；纯功能开发与常规代码审查不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 凭据扫描（secret-scan）

package/pack/skills/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '仓库/软件安全审计总览：范围界定→资产清单→
 whenToUse: '用户要求对代码仓库或项目做安全审计、制定审计计划、划分审计阶段、汇总多类发现成报告，或不确定该从哪个专项技能开始时使用；单一主题任务（只查密钥、只查依赖、只评审一个 PR、只查注入面）直接加载对应专项技能，不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 安全审计总览（security-audit）

package/pack/skills/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'PR/新依赖快速供应链评审：危险 install/postinstall 脚
 whenToUse: '评审含新依赖（package.json/锁文件变更）的 PR、审查某包的 install 脚本行为、判断疑似 typosquat 包或验证构建可复现性时使用；纯业务代码、与新增依赖无关的 PR 评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 新增依赖快速评审（supply-chain-review）

package/pack/skills/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: '新功能/新系统的轻量威胁建模：固定对象→划定
 whenToUse: '用户要求对新功能/新系统做威胁建模、设计阶段安全评审、STRIDE 分析、攻击树分析，或要求把安全考虑前置到设计阶段时使用；纯实现细节讨论、与信任边界无关的改动不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 威胁建模（threat-model）

package/pack/skills/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: '漏洞情报检索与判定：NVD/CISA-KEV/GHSA/OSV 四处权威
 whenToUse: '用户给出 CVE/GHSA 编号要求查详情与影响、判断漏洞是否被在野利用（KEV）、评估漏洞对当前项目/依赖的适用性或汇总漏洞情报简报时使用；没有具体编号的通用安全学习、与特定漏洞无关的讨论不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # 漏洞情报（vuln-intel）

package/pack/skills-en/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Dependency supply-chain audit: reading pnpm/npm audit output and e
 whenToUse: 'Use when the user asks to audit or inventory project dependency security (vulnerabilities, licenses, poisoning, lockfile drift), to interpret an audit report, to judge whether a dependency may be introduced, or to write a dependency-audit conclusion. Upgrading a single dependency and plain feature development do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 # Dependency audit (dependency-audit)
 

package/pack/skills-en/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'Security incident response for agent environments: a staged flow o
 whenToUse: 'Use when an agent environment (DSH sessions, plugins, MCP, CI) shows a suspected security incident — secret leak, injected execution of unauthorized actions, dependency poisoning, permission anomalies — and it needs response, evidence, and a postmortem. Day-to-day development without incident indicators does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # Incident response (incident-response)

package/pack/skills-en/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Injection-surface review for agent projects: a checklist covering
 whenToUse: 'Use when reviewing the context injection surfaces of an agent project (AGENTS.md/CLAUDE.md, .agents/skills, tool descriptions, MCP server sources, web-fetch chains), assessing indirect-injection risk, or doing a security review of an agent project. Ordinary code review unrelated to model context does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 # Prompt-injection surface review (prompt-injection-review)
 

package/pack/skills-en/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: 'Credential/secret exposure audit: gitleaks and trivy full-history
 whenToUse: 'Use when the user asks to scan or inspect a repository for secret leaks, to hunt tokens in a commit or file, to tier scan alerts as real or false, to write a redacted leak report, or to plan secret rotation. Plain feature development and ordinary code review do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 # Secret scanning (secret-scan)
 

package/pack/skills-en/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Repository/software security audit overview: a staged flow of scop
 whenToUse: 'Use when the user asks for a security audit of a code repository or project, an audit plan, staged audit steps, a consolidated findings report, or is unsure which specialist skill to start with. Single-topic tasks (only secrets, only dependencies, only one PR, only injection surfaces) load the matching specialist skill directly and do not trigger this overview.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 # Security audit overview (security-audit)
 

package/pack/skills-en/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Quick PR/new-dependency supply-chain review: dangerous install/pos
 whenToUse: 'Use when reviewing a PR that adds new dependencies (package.json/lockfile changes), inspecting a package install-script behavior, judging a suspected typosquat package, or verifying build reproducibility. Plain business-code PR reviews unrelated to new dependencies do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 # New-dependency quick review (supply-chain-review)
 

package/pack/skills-en/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: 'Lightweight threat modeling for new features/systems: fix the targ
 whenToUse: 'Use when the user asks for threat modeling of a new feature/system, design-stage security review, STRIDE analysis, attack-tree analysis, or wants security considered up front at design time. Pure implementation detail discussions and changes unrelated to trust boundaries do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # Threat modeling (threat-model)

package/pack/skills-en/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: 'Vulnerability intelligence lookup and triage: query commands for t
 whenToUse: 'Use when the user gives a CVE/GHSA id and asks for details and impact, whether a vulnerability is actively exploited (KEV), its applicability to the current project/dependencies, or a vulnerability intelligence brief. General security learning without a specific id, and discussions unrelated to a specific vulnerability, do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.0.1'
+  version: '2.1.0'
 ---
 
 # Vulnerability intelligence (vuln-intel)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@perrylink/dsh-skill-pack-security-provider",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.",
   "type": "module",
   "main": "lib/index.js",