nsauditor-ai-agent-skill 0.2.25 → 0.2.27

package/CHANGELOG.md

@@ -4,6 +4,18 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.27 (2026-07-13) — Paired content bump for EE 0.32.4 (RDS false-negative depth pass, part 2)
+
+Paired content bump for the EE 0.32.4 trio. SKILL.md reflects the RDS auditor's expanded false-negative coverage on plugin 1140: **RDS Proxy client↔proxy TLS** (`DescribeDBProxies.RequireTLS` — a proxy that does not require TLS accepts cleartext client connections, a transit leg distinct from the DB-engine SSL parameter; fail-closed on false-or-absent → routes == the DB-SSL transit axis), a new **retained / cross-region-replicated automated-backup at-rest surface** (`DescribeDB{Instance,Cluster}AutomatedBackups` — an unencrypted automated backup that survives instance/cluster deletion, invisible to the live-resource and snapshot scans), the **Aurora cluster-member double-audit closure** (provisioned Aurora members defer the cluster-scoped SSL / Multi-AZ dims to the cluster, closing self-contradictory instance-level false positives), and a **cross-framework report-quality leak closure** (a renderer backstop strips foreign framework control-ids out of the violation prose). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.4** + **CE 0.2.29**.
+
+---
+
+## 0.2.26 (2026-07-12) — Paired content bump for EE 0.32.3 (RDS cluster-level SSL enforcement + CE GRC-push preflight)
+
+Paired content bump for the EE 0.32.3 trio. SKILL.md reflects the RDS auditor's new **cluster-level SSL enforcement** dimension (plugin 1140 now audits the Aurora **cluster** parameter group via `DescribeDBClusterParameters` — closing a cleartext false-negative on instance-less Aurora Serverless v1 clusters that the instance-level SSL check never saw) and the **staged-parameter (`ParameterApplyStatus`) discipline** (a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective). Also notes the CE CLI's new **GRC-push startup preflight** (fail-fast on bad GRC config before the scan; CLI-only, not MCP-reachable). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.3** + **CE 0.2.28**.
+
+---
+
 ## 0.2.25 (2026-07-10) — Paired content bump for EE 0.32.2 (GRC connector trio complete — Secureframe + cross-framework report-quality leak closure)
 
 Paired content bump for the EE 0.32.2 trio. SKILL.md now teaches the completed **Vanta · Drata · Secureframe** GRC connector trio (enable Secureframe with `COMPLIANCE_GRC_PROVIDER=secureframe` — records model, your Secureframe rules evaluate the pushed control records; outbound, single-workspace, opt-in early-access; API shape published-assumed, live-tenant validation deferred) and reflects the closed **cross-framework foreign-token leak** in the "Why this violates" rationales (no internal `Inherits from soc2.json` note, bare foreign control-ids, cross-framework routing-maps, or `real-engine verified ==` QA-note leaks a foreign framework's name into a customer's Report on Compliance). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.2** + **CE 0.2.27**.

package/SKILL.md

@@ -16,7 +16,7 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.25 (post-EE-0.32.2 — a **matrix-neutral** release: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** Two legs: (1) a new **Secureframe** GRC push connector completes the **Vanta · Drata · Secureframe** trio at the same early-access opt-in shape — set `COMPLIANCE_GRC_PROVIDER=secureframe` + `COMPLIANCE_GRC_TOKEN` and the compliance phase pushes structured control records to your Secureframe workspace evidence collection (records model like Drata — your Secureframe rules evaluate them; the connector carries the control `status` verbatim, it does NOT compute pass/fail; outbound, single-workspace, opt-in early-access; API shape published-assumed, live-tenant validation deferred to partner intake); and (2) the **cross-framework foreign-token leak** in the "Why this violates" rationales is closed — an internal `Inherits from soc2.json CC6.1` note, bare foreign control-ids, cross-framework routing-maps, and a `real-engine verified ==` QA-note no longer leak a **foreign** framework's name into a HIPAA / PCI / ISO / NIST / CIS / GDPR Report on Compliance (~300 rationales across all seven frameworks; pure-deletion, subsequence-invariant-proven, with a class-level guard; routing byte-neutral). Prior context — EE 0.32.1 cleaned internal engineering markers (`[[wiki-links]]`, `EE-RT` work-codes, reviewer-codes, `Rn-SEVERITY` review-round IDs) out of the rationales + deeper Azure/AWS positive-substrate + a Vanta/Drata push-loop DRY refactor; EE 0.32.0 wired scan-time GRC push (Vanta) + shipped the Drata connector. Honest status: the three connectors are shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.27 + EE 0.32.2) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
+> **Version:** 0.2.27 (post-EE-0.32.4 — a **matrix-neutral** RDS false-negative-and-report-quality depth pass on plugin 1140: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** The RDS auditor gains **RDS Proxy client↔proxy TLS** (`DescribeDBProxies.RequireTLS` — a proxy that does not require TLS accepts cleartext client connections, a transit leg distinct from the DB-engine SSL parameter; fail-closed on false-or-absent → routes == the DB-SSL transit axis), a new **retained / cross-region-replicated automated-backup at-rest surface** (`DescribeDB{Instance,Cluster}AutomatedBackups` — an unencrypted automated backup that survives instance/cluster deletion is invisible to the live-resource and snapshot scans), and the **Aurora cluster-member double-audit closure** (a provisioned Aurora cluster's members defer the cluster-scoped SSL / Multi-AZ dims to the cluster, closing self-contradictory instance-level false positives + a headless-Aurora availability false-clean, keyed on `EngineMode`). A renderer backstop also closes a **cross-framework report-quality leak** (foreign framework control-ids stripped out of the violation prose that renders into every framework report — all channels). Prior context — EE 0.32.3 added Aurora **cluster-level SSL enforcement** (`DescribeDBClusterParameters`, closing an instance-less Aurora Serverless v1 cleartext false-negative) + **staged-parameter (`ParameterApplyStatus`) discipline** + the CE **GRC-push startup preflight** (CLI-only, not MCP-reachable); EE 0.32.2 completed the **Vanta · Drata · Secureframe** GRC connector trio (records model, opt-in early-access, outbound single-workspace, live-tenant validation deferred to partner intake) + closed the cross-framework foreign-token leak in the "Why this violates" rationales; EE 0.32.1 cleaned internal engineering markers out of the rationales. Honest status: the three connectors are shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.29 + EE 0.32.4) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
 
 NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
 plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.25",
+  "version": "0.2.27",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",