nsauditor-ai-agent-skill 0.2.25 → 0.2.26

package/CHANGELOG.md

@@ -4,6 +4,12 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.26 (2026-07-12) — Paired content bump for EE 0.32.3 (RDS cluster-level SSL enforcement + CE GRC-push preflight)
+
+Paired content bump for the EE 0.32.3 trio. SKILL.md reflects the RDS auditor's new **cluster-level SSL enforcement** dimension (plugin 1140 now audits the Aurora **cluster** parameter group via `DescribeDBClusterParameters` — closing a cleartext false-negative on instance-less Aurora Serverless v1 clusters that the instance-level SSL check never saw) and the **staged-parameter (`ParameterApplyStatus`) discipline** (a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective). Also notes the CE CLI's new **GRC-push startup preflight** (fail-fast on bad GRC config before the scan; CLI-only, not MCP-reachable). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.3** + **CE 0.2.28**.
+
+---
+
 ## 0.2.25 (2026-07-10) — Paired content bump for EE 0.32.2 (GRC connector trio complete — Secureframe + cross-framework report-quality leak closure)
 
 Paired content bump for the EE 0.32.2 trio. SKILL.md now teaches the completed **Vanta · Drata · Secureframe** GRC connector trio (enable Secureframe with `COMPLIANCE_GRC_PROVIDER=secureframe` — records model, your Secureframe rules evaluate the pushed control records; outbound, single-workspace, opt-in early-access; API shape published-assumed, live-tenant validation deferred) and reflects the closed **cross-framework foreign-token leak** in the "Why this violates" rationales (no internal `Inherits from soc2.json` note, bare foreign control-ids, cross-framework routing-maps, or `real-engine verified ==` QA-note leaks a foreign framework's name into a customer's Report on Compliance). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.2** + **CE 0.2.27**.

package/SKILL.md

@@ -16,7 +16,7 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.25 (post-EE-0.32.2 — a **matrix-neutral** release: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** Two legs: (1) a new **Secureframe** GRC push connector completes the **Vanta · Drata · Secureframe** trio at the same early-access opt-in shape — set `COMPLIANCE_GRC_PROVIDER=secureframe` + `COMPLIANCE_GRC_TOKEN` and the compliance phase pushes structured control records to your Secureframe workspace evidence collection (records model like Drata — your Secureframe rules evaluate them; the connector carries the control `status` verbatim, it does NOT compute pass/fail; outbound, single-workspace, opt-in early-access; API shape published-assumed, live-tenant validation deferred to partner intake); and (2) the **cross-framework foreign-token leak** in the "Why this violates" rationales is closed — an internal `Inherits from soc2.json CC6.1` note, bare foreign control-ids, cross-framework routing-maps, and a `real-engine verified ==` QA-note no longer leak a **foreign** framework's name into a HIPAA / PCI / ISO / NIST / CIS / GDPR Report on Compliance (~300 rationales across all seven frameworks; pure-deletion, subsequence-invariant-proven, with a class-level guard; routing byte-neutral). Prior context — EE 0.32.1 cleaned internal engineering markers (`[[wiki-links]]`, `EE-RT` work-codes, reviewer-codes, `Rn-SEVERITY` review-round IDs) out of the rationales + deeper Azure/AWS positive-substrate + a Vanta/Drata push-loop DRY refactor; EE 0.32.0 wired scan-time GRC push (Vanta) + shipped the Drata connector. Honest status: the three connectors are shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.27 + EE 0.32.2) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
+> **Version:** 0.2.26 (post-EE-0.32.3 — a **matrix-neutral** RDS false-negative depth pass: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** Plugin 1140 now audits Aurora **cluster-level SSL enforcement** (`DescribeDBClusterParameters`), closing a cleartext false-negative on **instance-less Aurora Serverless v1** clusters the instance-level SSL check never saw (a cluster whose cluster parameter group set `rds.force_ssl=0` / `require_secure_transport=OFF` produced zero transit-encryption findings → now CRITICAL), and applies **staged-parameter (`ParameterApplyStatus`) discipline** so a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective. The CE CLI adds a **GRC-push startup preflight** — fail-fast on a bad GRC token / control-map / provider at scan startup before the full scan (CLI-only, not MCP-reachable). The new cluster findings route to the existing transit-encryption controls (titlePattern-only anchor edit). Prior context — EE 0.32.2 completed the **Vanta · Drata · Secureframe** GRC connector trio (records model, opt-in early-access, outbound single-workspace, live-tenant validation deferred to partner intake) + closed the cross-framework foreign-token leak in the "Why this violates" rationales; EE 0.32.1 cleaned internal engineering markers out of the rationales. Honest status: the three connectors are shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.28 + EE 0.32.3) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
 
 NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
 plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.25",
+  "version": "0.2.26",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",