@perrylink/dsh-skill-pack-security-provider 2.1.2 → 2.1.3

package/lib/index.js

@@ -38,7 +38,7 @@ export const Config = z.object({
         maxExtractBytes: z.natural().min(1024).max(512 * 1024 * 1024).default(64 * 1024 * 1024),
         maxDepNodes: z.natural().min(1).max(10000).default(600),
         maxFindingsPerCheck: z.natural().min(1).max(100).default(12),
-        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.1.2 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
+        userAgent: z.string().max(200).default('dsh-skill-pack-security/2.1.3 (+https://github.com/PerryLink/dsh-skill-pack-security)'),
         dataResponsibility: z.boolean().default(true),
         gate: z.object({
             policy: z.union(['warn', 'deny']).default('warn'),

package/lib/vet/config.js

@@ -15,7 +15,7 @@ export const VET_DEFAULTS = {
     maxExtractBytes: 64 * 1024 * 1024,
     maxDepNodes: 600,
     maxFindingsPerCheck: 12,
-    userAgent: 'dsh-skill-pack-security/2.1.2 (+https://github.com/PerryLink/dsh-skill-pack-security)',
+    userAgent: 'dsh-skill-pack-security/2.1.3 (+https://github.com/PerryLink/dsh-skill-pack-security)',
     dataResponsibility: true,
     gate: { policy: 'warn' },
 };

package/pack/skills/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '依赖供应链审计：pnpm/npm audit 输出与退出码解读、
 whenToUse: '用户要求审计或盘点项目依赖安全（漏洞、license、投毒、锁文件漂移）、解读 audit 报告、判断某个依赖能否引入，或写依赖审计结论时使用；单个依赖的普通升级与纯功能开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 依赖审计（dependency-audit）

package/pack/skills/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'agent 环境安全事件响应：分类→控制蔓延→取证留
 whenToUse: 'agent 环境（DSH 会话、插件、MCP、CI）出现疑似安全事件——密钥泄露、被注入执行了未授权操作、依赖投毒、权限异常——需要响应、留证与复盘时使用；没有事件迹象的日常开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 事件响应（incident-response）

package/pack/skills/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: '面向 agent 项目的提示注入面审查：AGENTS.md、技能
 whenToUse: '审查 agent 项目的上下文注入面（AGENTS.md/CLAUDE.md、.agents/skills、工具描述、MCP server 来源、web 抓取链路）、评估间接注入风险或对 agent 项目做安全评审时使用；与模型上下文无关的普通代码评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 提示注入面审查（prompt-injection-review）

package/pack/skills/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: '凭据/密钥暴露审计：gitleaks、trivy 全历史扫描命令
 whenToUse: '用户要求扫描或检查仓库的密钥泄露、排查某提交或某文件中的 token、给扫描告警定真伪、写脱敏泄露报告或规划密钥轮换时使用；纯功能开发与常规代码审查不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 凭据扫描（secret-scan）

package/pack/skills/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '仓库/软件安全审计总览：范围界定→资产清单→
 whenToUse: '用户要求对代码仓库或项目做安全审计、制定审计计划、划分审计阶段、汇总多类发现成报告，或不确定该从哪个专项技能开始时使用；单一主题任务（只查密钥、只查依赖、只评审一个 PR、只查注入面）直接加载对应专项技能，不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 安全审计总览（security-audit）

package/pack/skills/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'PR/新依赖快速供应链评审：危险 install/postinstall 脚
 whenToUse: '评审含新依赖（package.json/锁文件变更）的 PR、审查某包的 install 脚本行为、判断疑似 typosquat 包或验证构建可复现性时使用；纯业务代码、与新增依赖无关的 PR 评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 新增依赖快速评审（supply-chain-review）

package/pack/skills/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: '新功能/新系统的轻量威胁建模：固定对象→划定
 whenToUse: '用户要求对新功能/新系统做威胁建模、设计阶段安全评审、STRIDE 分析、攻击树分析，或要求把安全考虑前置到设计阶段时使用；纯实现细节讨论、与信任边界无关的改动不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 威胁建模（threat-model）

package/pack/skills/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: '漏洞情报检索与判定：NVD/CISA-KEV/GHSA/OSV 四处权威
 whenToUse: '用户给出 CVE/GHSA 编号要求查详情与影响、判断漏洞是否被在野利用（KEV）、评估漏洞对当前项目/依赖的适用性或汇总漏洞情报简报时使用；没有具体编号的通用安全学习、与特定漏洞无关的讨论不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # 漏洞情报（vuln-intel）

package/pack/skills-en/dependency-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Dependency supply-chain audit: reading pnpm/npm audit output and e
 whenToUse: 'Use when the user asks to audit or inventory project dependency security (vulnerabilities, licenses, poisoning, lockfile drift), to interpret an audit report, to judge whether a dependency may be introduced, or to write a dependency-audit conclusion. Upgrading a single dependency and plain feature development do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 # Dependency audit (dependency-audit)
 

package/pack/skills-en/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'Security incident response for agent environments: a staged flow o
 whenToUse: 'Use when an agent environment (DSH sessions, plugins, MCP, CI) shows a suspected security incident — secret leak, injected execution of unauthorized actions, dependency poisoning, permission anomalies — and it needs response, evidence, and a postmortem. Day-to-day development without incident indicators does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # Incident response (incident-response)

package/pack/skills-en/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Injection-surface review for agent projects: a checklist covering
 whenToUse: 'Use when reviewing the context injection surfaces of an agent project (AGENTS.md/CLAUDE.md, .agents/skills, tool descriptions, MCP server sources, web-fetch chains), assessing indirect-injection risk, or doing a security review of an agent project. Ordinary code review unrelated to model context does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 # Prompt-injection surface review (prompt-injection-review)
 

package/pack/skills-en/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: 'Credential/secret exposure audit: gitleaks and trivy full-history
 whenToUse: 'Use when the user asks to scan or inspect a repository for secret leaks, to hunt tokens in a commit or file, to tier scan alerts as real or false, to write a redacted leak report, or to plan secret rotation. Plain feature development and ordinary code review do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 # Secret scanning (secret-scan)
 

package/pack/skills-en/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: 'Repository/software security audit overview: a staged flow of scop
 whenToUse: 'Use when the user asks for a security audit of a code repository or project, an audit plan, staged audit steps, a consolidated findings report, or is unsure which specialist skill to start with. Single-topic tasks (only secrets, only dependencies, only one PR, only injection surfaces) load the matching specialist skill directly and do not trigger this overview.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 # Security audit overview (security-audit)
 

package/pack/skills-en/supply-chain-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Quick PR/new-dependency supply-chain review: dangerous install/pos
 whenToUse: 'Use when reviewing a PR that adds new dependencies (package.json/lockfile changes), inspecting a package install-script behavior, judging a suspected typosquat package, or verifying build reproducibility. Plain business-code PR reviews unrelated to new dependencies do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 # New-dependency quick review (supply-chain-review)
 

package/pack/skills-en/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: 'Lightweight threat modeling for new features/systems: fix the targ
 whenToUse: 'Use when the user asks for threat modeling of a new feature/system, design-stage security review, STRIDE analysis, attack-tree analysis, or wants security considered up front at design time. Pure implementation detail discussions and changes unrelated to trust boundaries do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # Threat modeling (threat-model)

package/pack/skills-en/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: 'Vulnerability intelligence lookup and triage: query commands for t
 whenToUse: 'Use when the user gives a CVE/GHSA id and asks for details and impact, whether a vulnerability is actively exploited (KEV), its applicability to the current project/dependencies, or a vulnerability intelligence brief. General security learning without a specific id, and discussions unrelated to a specific vulnerability, do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '2.1.2'
+  version: '2.1.3'
 ---
 
 # Vulnerability intelligence (vuln-intel)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@perrylink/dsh-skill-pack-security-provider",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.",
   "type": "module",
   "main": "lib/index.js",
@@ -45,7 +45,7 @@
     ],
     "compatibility": {
       "dshVersions": [
-        "0.1.0-rc.8"
+        "0.1.1-rc.2"
       ]
     },
     "capability": {
@@ -80,9 +80,9 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.8",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.8",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-skill-filesystem": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "^3.18.1",
     "@types/node": "^26.2.0",
     "typescript": "^7.0.2"