@yottameta/yotta-intel 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/README.md +30 -42
  3. package/README.zh-CN.md +31 -43
  4. package/SKILL.md +1 -1
  5. package/package.json +1 -1
  6. package/references/defang-rules.md +1 -1
  7. package/references/ioc-spec.md +1 -1
  8. package/references/stix-lite-spec.md +1 -1
  9. package/scripts/test_yotta_intel.py +1 -1
  10. package/scripts/yotta_intel.py +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # 更新日志
2
2
 
3
+ ## v0.1.1 (2026-08-29)
4
+
5
+ - 安装方式统一为四方式（对齐发布规范 §3.3.1）：方式一 `npx -y @yottameta/yotta-intel --agent <name>` / `--dir <dir>`（推荐，走 npm 源）；方式二 `git clone https://github.com/YottaMeta/yotta-intel.git`；方式三 GitHub Download ZIP；方式四 `bash install.sh --agent/--dir/--list`。移除 `npx skills` 与 `-g` 推荐；中英双 README 安装节同步。
6
+ - 版本对齐：package.json / SKILL.md / CHANGELOG / 引擎 VERSION / 测试断言 / README 锚点 = 0.1.1。
7
+ - 无功能变更（仅文档与版本同步）。
8
+
3
9
  ## v0.1.0 (2026-08-27)
4
10
 
5
11
  初始发布：
package/README.md CHANGED
@@ -43,7 +43,7 @@ It is not tied to any single platform: it is an agent-agnostic toolkit that work
43
43
  | **defang friendly** | Recognizes mainstream defanged forms and reverses them; outputs a unified defanged form for safe sharing |
44
44
  | **Explainable** | Each result includes type, count, first-seen line and context; reports candidate indicators only, never verdicts |
45
45
  | **Low noise** | Deterministic rules: TLD whitelist, filename filter, CJK-punctuation trimming |
46
- | **Ecosystem distribution** | GitHub + npm + ClawHub synced; install via npx / install.sh / manual copy |
46
+ | **Ecosystem distribution** | GitHub + npm + ClawHub synced; four install methods (npx / git clone / Download ZIP / install.sh) |
47
47
 
48
48
  ## Commands
49
49
 
@@ -91,7 +91,7 @@ python3 scripts/yotta_intel.py refang --path safe.txt
91
91
  Sample text output:
92
92
 
93
93
  ```
94
- 元情 yotta-intel v0.1.0 —— IOC 提取结果
94
+ 元情 yotta-intel v0.1.1 —— IOC 提取结果
95
95
  共发现 2 个 IOC：
96
96
 
97
97
  ■ IPv4 地址（ipv4）
@@ -102,51 +102,39 @@ Sample text output:
102
102
 
103
103
  ## Installation
104
104
 
105
- Pick any of the three methods; skill files are always fetched from **npm** (GitHub can be slow without a proxy; npm supports mirrors).
105
+ Pick any of the four methods below; the order is the recommended priority. Skill files always come from **npm** (GitHub can be slow without a proxy; npm supports mirrors).
106
106
 
107
- ### Method 1: npm (recommended, one-liner)
108
- ```bash
107
+ ### Method 1: npm one-liner (recommended)
108
+
109
+ ```text
109
110
  # Optional China mirror: npm config set registry https://registry.npmmirror.com
110
- npx -y @yottameta/yotta-intel -g
111
- npx -y @yottameta/yotta-intel --dir <your skills dir> # any agent: install to a custom directory
111
+ npx -y @yottameta/yotta-intel --agent <agent-name> # install to the agent's default user-level skills dir
112
+ npx -y @yottameta/yotta-intel --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)
112
113
  ```
113
- > Agent not in the preset list? Use `--dir` to point at its skills directory, or copy manually (Method 3). `--list` shows the default directory of each agent.
114
114
 
115
- ### Method 2: install.sh
116
- After obtaining the skill folder (`npm pack` unpack or `git clone`), enter the folder:
117
- ```bash
118
- bash install.sh -g # user-level; bash install.sh --list shows all directories
119
- bash install.sh --agent codex # a specific agent (see --list)
120
- bash install.sh # project-level: auto-detect existing skills directories
121
- bash install.sh --dir /path/to/skills
115
+ - `--agent <name>` installs to that agent's default user-level directory; `--list` shows each agent's default directory.
116
+ - `--dir <path>` installs to the given directory; for agents not in the preset list, point `--dir` at their skills directory.
117
+ - If the mirror has not synced the new package (404): add `--registry=https://registry.npmjs.org/` (a proxy may be needed in China), or wait for the mirror cache.
118
+
119
+ ### Method 2: git clone (developers / git available)
120
+
121
+ ```text
122
+ git clone https://github.com/YottaMeta/yotta-intel.git <your-skills-dir>/yotta-intel
123
+ ```
124
+
125
+ ### Method 3: GitHub Download ZIP (manual / no git)
126
+
127
+ On the GitHub repository `YottaMeta/yotta-intel`, click **Code → Download ZIP**, unzip it and put the `yotta-intel` folder into the agent's skills directory.
128
+
129
+ ### Method 4: install.sh (multi-agent one-liner script)
130
+
131
+ ```text
132
+ bash install.sh --agent <name> # install to the agent's default user-level directory
133
+ bash install.sh --dir <path> # install to the given directory
134
+ bash install.sh --list # list agents -> default directories
122
135
  ```
123
- > Covers 17 agent families, including Trae / Qwen / Comate / CodeBuddy / Kimi.
124
-
125
- ### Method 3: manual copy
126
- Copy the whole `yotta-intel` folder into the target agent's skills directory. Common user-level locations (`%USERPROFILE%` on Windows, `~` on Linux/macOS):
127
-
128
- | Agent | User-level directory | Project-level directory |
129
- |---|---|---|
130
- | Codex | `%USERPROFILE%\.codex\skills\yotta-intel\` | `.codex\skills\` |
131
- | Claude Code | `%USERPROFILE%\.claude\skills\yotta-intel\` | `.claude\skills\` |
132
- | Cursor | `%USERPROFILE%\.cursor\skills\yotta-intel\` | `.cursor\skills\` |
133
- | Windsurf | `%USERPROFILE%\.codeium\windsurf\skills\yotta-intel\` | `.windsurf\skills\` |
134
- | opencode | `%USERPROFILE%\.config\opencode\skills\yotta-intel\` | `.opencode\skills\` |
135
- | Gemini | `%USERPROFILE%\.gemini\skills\yotta-intel\` | `.gemini\skills\` |
136
- | Goose | `%USERPROFILE%\.config\goose\skills\yotta-intel\` | `.goose\skills\` |
137
- | Amp | `%USERPROFILE%\.config\agents\skills\yotta-intel\` | `.agents\skills\` |
138
- | Kiro | `%USERPROFILE%\.kiro\skills\yotta-intel\` | `.kiro\skills\` |
139
- | WorkBuddy | `%USERPROFILE%\.workbuddy\skills\yotta-intel\` | `.workbuddy\skills\` |
140
- | Trae Code CLI | `%USERPROFILE%\.traecli\skills\yotta-intel\` | `.traecli\skills\` |
141
- | Trae IDE (CN) | `%USERPROFILE%\.trae-cn\skills\yotta-intel\` | `.trae\skills\` |
142
- | Qwen Code | `%USERPROFILE%\.qwen\skills\yotta-intel\` | `.qwen\skills\` |
143
- | Comate | `%USERPROFILE%\.comate\skills\yotta-intel\` | `.comate\skills\` |
144
- | CodeBuddy | `%USERPROFILE%\.codebuddy\skills\yotta-intel\` | `.codebuddy\skills\` |
145
- | Kimi | `%USERPROFILE%\.kimi\skills\yotta-intel\` | `.kimi\skills\` |
146
- | Generic AGENTS.md | `%USERPROFILE%\.agents\skills\yotta-intel\` | `.agents\skills\` |
147
-
148
- > If Codex's `CODEX_HOME` is set, it overrides the default; the same applies to opencode's `XDG_CONFIG_HOME`. `.agents\skills` is not a universal directory — only OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot etc. read it; **Claude Code and Codex do not read it by default**. When unsure, use `--dir` or let the agent install it.
149
136
 
137
+ > Method 1 uses the npm registry (npmmirror / npmjs) and does not depend on GitHub; Methods 2/3 use GitHub and may fail without a proxy in China.
150
138
  ## Output formats
151
139
 
152
140
  - **text** — a readable report grouped by type (defanged form + first-seen context included);
@@ -167,4 +155,4 @@ Spec details live in `references/`: ioc-spec.md (type rules), defang-rules.md (d
167
155
 
168
156
  ## License
169
157
 
170
- MIT © YottaMeta — see [LICENSE](./LICENSE).
158
+ MIT © YottaMeta — see [LICENSE](./LICENSE).
package/README.zh-CN.md CHANGED
@@ -51,7 +51,7 @@
51
51
  | **defang 友好** | 识别主流去活性写法并还原；输出统一 defang 形态，安全共享防误点 |
52
52
  | **可解释** | 每条结果带类型、出现次数、首次行号与上下文；只给「候选指标」，不给定性结论 |
53
53
  | **低误报** | TLD 白名单 + 文件名过滤 + 中文标点截断等确定性规则 |
54
- | **生态分发** | GitHub + npm + ClawHub 三源同步；npx / install.sh / 手动复制三种安装方式 |
54
+ | **生态分发** | GitHub + npm + ClawHub 三源同步；npx / git clone / Download ZIP / install.sh 四种安装方式 |
55
55
 
56
56
  ## 命令
57
57
 
@@ -99,7 +99,7 @@ python3 scripts/yotta_intel.py refang --path safe.txt
99
99
  输出示例（text）：
100
100
 
101
101
  ```
102
- 元情 yotta-intel v0.1.0 —— IOC 提取结果
102
+ 元情 yotta-intel v0.1.1 —— IOC 提取结果
103
103
  共发现 2 个 IOC：
104
104
 
105
105
  ■ IPv4 地址（ipv4）
@@ -110,51 +110,39 @@ python3 scripts/yotta_intel.py refang --path safe.txt
110
110
 
111
111
  ## 安装
112
112
 
113
- 三种方式任选其一，技能文件统一从 **npm** 获取（GitHub 无代理时较慢，npm 可配国内镜像加速）。
113
+ 以下四种方式任选，顺序即推荐优先级；技能文件一律从 **npm** 获取（GitHub 无代理较慢，npm 支持镜像）。
114
114
 
115
- ### 方式一：npm（推荐，一行安装）
116
- ```bash
117
- # 国内加速（可选）：npm config set registry https://registry.npmmirror.com
118
- npx -y @yottameta/yotta-intel -g
119
- npx -y @yottameta/yotta-intel --dir <你的技能目录> # 任意智能体：指定目录安装
115
+ ### 方式一：npm 一行装（推荐）
116
+
117
+ ```text
118
+ # 可选国内加速：npm config set registry https://registry.npmmirror.com
119
+ npx -y @yottameta/yotta-intel --agent <智能体名称> # 装到指定智能体默认用户级技能目录
120
+ npx -y @yottameta/yotta-intel --dir <智能体的技能目录> # 指到技能目录本身（如 ~/.codex/skills）
120
121
  ```
121
- > 智能体不在预置列表里？用 `--dir` 指定它的 skills 目录，或手动复制（方式三）。`--list` 可查看各智能体对应的默认目录。
122
122
 
123
- ### 方式二：install.sh 一键安装
124
- 获取技能文件夹后（`npm pack` 解包或 `git clone`），进入技能文件夹：
125
- ```bash
126
- bash install.sh -g # 用户级；bash install.sh --list 查看全部目录
127
- bash install.sh --agent codex # 指定智能体（--list 可查看可用项）
128
- bash install.sh # 项目级：自动检测已存在的 skills 目录
129
- bash install.sh --dir /path/to/skills
123
+ - `--agent <name>` 自动装到该智能体默认用户级目录；`--list` 可查看各智能体默认目录。
124
+ - `--dir <路径>` 装到指定的技能目录；未收录的智能体用 `--dir` 指到它的技能目录。
125
+ - npmmirror 未同步新包（404）：加 `--registry=https://registry.npmjs.org/`（国内需代理），或稍等镜像缓存。
126
+
127
+ ### 方式二：git clone（开发者 / 有 git 环境）
128
+
129
+ ```text
130
+ git clone https://github.com/YottaMeta/yotta-intel.git <智能体的技能目录>/yotta-intel
131
+ ```
132
+
133
+ ### 方式三：GitHub 下载压缩包（手动 / 无 git 环境）
134
+
135
+ 在 GitHub 仓库 `YottaMeta/yotta-intel` 点 **Code → Download ZIP**，解压后把 `yotta-intel` 文件夹放进智能体技能目录。
136
+
137
+ ### 方式四：install.sh（多智能体一键脚本）
138
+
139
+ ```text
140
+ bash install.sh --agent <name> # 装到指定智能体默认用户级目录
141
+ bash install.sh --dir <path> # 装到指定目录
142
+ bash install.sh --list # 列出智能体 -> 默认目录
130
143
  ```
131
- > 覆盖 17 类智能体，含国内 Trae / Qwen / Comate / CodeBuddy / Kimi。
132
-
133
- ### 方式三：手动复制
134
- 把整个 `yotta-intel` 文件夹复制到目标智能体的 skills 目录。常见位置（用户级；Windows 用 `%USERPROFILE%`，Linux/macOS 用 `~`）：
135
-
136
- | 智能体 | 用户级目录 | 项目级目录 |
137
- |---|---|---|
138
- | Codex | `%USERPROFILE%\.codex\skills\yotta-intel\` | `.codex\skills\` |
139
- | Claude Code | `%USERPROFILE%\.claude\skills\yotta-intel\` | `.claude\skills\` |
140
- | Cursor | `%USERPROFILE%\.cursor\skills\yotta-intel\` | `.cursor\skills\` |
141
- | Windsurf | `%USERPROFILE%\.codeium\windsurf\skills\yotta-intel\` | `.windsurf\skills\` |
142
- | opencode | `%USERPROFILE%\.config\opencode\skills\yotta-intel\` | `.opencode\skills\` |
143
- | Gemini | `%USERPROFILE%\.gemini\skills\yotta-intel\` | `.gemini\skills\` |
144
- | Goose | `%USERPROFILE%\.config\goose\skills\yotta-intel\` | `.goose\skills\` |
145
- | Amp | `%USERPROFILE%\.config\agents\skills\yotta-intel\` | `.agents\skills\` |
146
- | Kiro | `%USERPROFILE%\.kiro\skills\yotta-intel\` | `.kiro\skills\` |
147
- | WorkBuddy | `%USERPROFILE%\.workbuddy\skills\yotta-intel\` | `.workbuddy\skills\` |
148
- | Trae Code CLI | `%USERPROFILE%\.traecli\skills\yotta-intel\` | `.traecli\skills\` |
149
- | Trae IDE（国内） | `%USERPROFILE%\.trae-cn\skills\yotta-intel\` | `.trae\skills\` |
150
- | Qwen Code | `%USERPROFILE%\.qwen\skills\yotta-intel\` | `.qwen\skills\` |
151
- | Comate | `%USERPROFILE%\.comate\skills\yotta-intel\` | `.comate\skills\` |
152
- | CodeBuddy | `%USERPROFILE%\.codebuddy\skills\yotta-intel\` | `.codebuddy\skills\` |
153
- | Kimi | `%USERPROFILE%\.kimi\skills\yotta-intel\` | `.kimi\skills\` |
154
- | 通用 AGENTS.md | `%USERPROFILE%\.agents\skills\yotta-intel\` | `.agents\skills\` |
155
-
156
- > Codex 默认目录若设置了环境变量 `CODEX_HOME`，以该变量为准；opencode 若设置 `XDG_CONFIG_HOME` 同理。`.agents\skills` 并非通用目录，仅 OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot 等会读取，**Claude Code 与 Codex 默认不读**。不确定时用 `--dir` 指定，或让该智能体自行安装。
157
144
 
145
+ > 方式一走 npm 源（npmmirror / npmjs），不依赖 GitHub；方式二 / 三走 GitHub，国内无代理可能失败。
158
146
  ## 输出格式
159
147
 
160
148
  - **text**：按类型分组的可读报告（含 defang 形态与首次出现的上下文）；
@@ -178,4 +166,4 @@ stix-lite-spec.md（STIX 映射）。
178
166
 
179
167
  ## 许可证
180
168
 
181
- MIT © YottaMeta —— 详见 [LICENSE](./LICENSE)。
169
+ MIT © YottaMeta —— 详见 [LICENSE](./LICENSE)。
package/SKILL.md CHANGED
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: yotta-intel
3
- version: 0.1.0
3
+ version: 0.1.1
4
4
  description: 元情 —— 跨智能体的威胁情报 IOC 提取与规范化技能：零依赖自研从文本 / 日志 / 报告中提取 IP（IPv4/IPv6）、域名、URL、邮箱、哈希（MD5/SHA1/SHA256/SHA512）与 CVE 编号，识别并还原 defang 写法，去重、归一化后输出 CSV / JSON / STIX-lite。触发：用户给出含可疑 IP / 域名 / URL / 哈希的威胁情报文本、恶意样本分析报告、钓鱼邮件或日志，要提取 IOC、规范化、去重、转格式、共享情报时。边界：纯本地离线提取与规范化；不联网查证、不下载样本、不主动扫描任何系统；仅用于已获授权 / 自有资产 / 教学环境的安全分析。
5
5
  license: MIT
6
6
  ---
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@yottameta/yotta-intel",
3
- "version": "0.1.0",
3
+ "version": "0.1.1",
4
4
  "description": "Yuanqing — a zero-dependency threat-intel IOC extraction & normalization engine for AI agents: extracts IP (IPv4/IPv6), domains, URLs, emails, hashes (MD5/SHA1/SHA256/SHA512) and CVE IDs from threat reports, phishing emails and logs; recognizes and reverses defanged forms (hxxp / [.] / (.) / [dot] / [:] / [@]); deduplicates, normalizes (IDN punycode, default-port stripping) and outputs CSV / JSON / STIX-lite (STIX 2.1 Bundle) with the pure Python 3.8+ standard library. Triggers when the user provides text containing suspicious IPs / domains / URLs / hashes and needs IOC extraction, normalization, dedup, format conversion, or safe sharing. Boundaries: fully local and offline; no reputation lookups, no sample downloads, no proactive scanning; authorized / own-asset / educational use only.",
5
5
  "license": "MIT",
6
6
  "keywords": [
package/references/defang-rules.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # defang / refang 规则与共享建议
2
2
 
3
- > 元情 yotta-intel v0.1.0：去活性（defang）写法识别、还原与安全共享指引。
3
+ > 元情 yotta-intel v0.1.1：去活性（defang）写法识别、还原与安全共享指引。
4
4
 
5
5
  ## 1. 为什么要 defang
6
6
 
package/references/ioc-spec.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # IOC 类型与判定规则（ioc-spec）
2
2
 
3
- > 元情 yotta-intel v0.1.0 内部规范：七类 IOC 的提取 / 归一 / 误报控制规则。
3
+ > 元情 yotta-intel v0.1.1 内部规范：七类 IOC 的提取 / 归一 / 误报控制规则。
4
4
  > 本文件是引擎行为的权威说明；SKILL.md 只放入口，细节在这里。
5
5
 
6
6
  ## 1. 支持的类型
package/references/stix-lite-spec.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # STIX-lite 输出规范
2
2
 
3
- > 元情 yotta-intel v0.1.0：`extract --format stix` 的产物说明。
3
+ > 元情 yotta-intel v0.1.1：`extract --format stix` 的产物说明。
4
4
  > 「lite」= 只生成 STIX 2.1 的 Indicator 对象 + 自定义扩展属性，不实现完整 STIX 库。
5
5
 
6
6
  ## 1. 为什么叫 lite
package/scripts/test_yotta_intel.py CHANGED
@@ -488,7 +488,7 @@ class TestCLI(unittest.TestCase):
488
488
  def test_cli_version(self):
489
489
  r = run_cli("--version")
490
490
  self.assertEqual(r.returncode, 0)
491
- self.assertIn("0.1.0", r.stdout)
491
+ self.assertIn("0.1.1", r.stdout)
492
492
 
493
493
  def test_cli_unknown_type_exit4(self):
494
494
  r = run_cli("extract", "--stdin", "--types", "bogus", stdin="1.2.3.4")
package/scripts/yotta_intel.py CHANGED
@@ -52,7 +52,7 @@ try:
52
52
  except Exception:
53
53
  pass
54
54
 
55
- VERSION = "0.1.0"
55
+ VERSION = "0.1.1"
56
56
  TOOL = "yotta-intel"
57
57
  TOOL_CN = "元情"
58
58