nsauditor-ai-agent-skill 0.2.26 → 0.2.28

package/CHANGELOG.md

@@ -4,6 +4,16 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.28 (2026-07-18) — paired content bump for EE 0.32.5 (report quality + routing integrity)
+
+- Version line updated to post-EE-0.32.5. Matrix-neutral cycle: API Gateway mapping repair (routing was never broken — the defect was stale auditor-facing prose), HIPAA §164.312(c)(1) WAF mapping removed on doctrine, six rationale rewrites, `renderJSON` no longer shipping raw routing regexes, a CI/CD AccessDenied false-negative closed fail-closed, and three mutation-proven compliance-guard hardenings. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED.
+
+## 0.2.27 (2026-07-13) — Paired content bump for EE 0.32.4 (RDS false-negative depth pass, part 2)
+
+Paired content bump for the EE 0.32.4 trio. SKILL.md reflects the RDS auditor's expanded false-negative coverage on plugin 1140: **RDS Proxy client↔proxy TLS** (`DescribeDBProxies.RequireTLS` — a proxy that does not require TLS accepts cleartext client connections, a transit leg distinct from the DB-engine SSL parameter; fail-closed on false-or-absent → routes == the DB-SSL transit axis), a new **retained / cross-region-replicated automated-backup at-rest surface** (`DescribeDB{Instance,Cluster}AutomatedBackups` — an unencrypted automated backup that survives instance/cluster deletion, invisible to the live-resource and snapshot scans), the **Aurora cluster-member double-audit closure** (provisioned Aurora members defer the cluster-scoped SSL / Multi-AZ dims to the cluster, closing self-contradictory instance-level false positives), and a **cross-framework report-quality leak closure** (a renderer backstop strips foreign framework control-ids out of the violation prose). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.4** + **CE 0.2.29**.
+
+---
+
 ## 0.2.26 (2026-07-12) — Paired content bump for EE 0.32.3 (RDS cluster-level SSL enforcement + CE GRC-push preflight)
 
 Paired content bump for the EE 0.32.3 trio. SKILL.md reflects the RDS auditor's new **cluster-level SSL enforcement** dimension (plugin 1140 now audits the Aurora **cluster** parameter group via `DescribeDBClusterParameters` — closing a cleartext false-negative on instance-less Aurora Serverless v1 clusters that the instance-level SSL check never saw) and the **staged-parameter (`ParameterApplyStatus`) discipline** (a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective). Also notes the CE CLI's new **GRC-push startup preflight** (fail-fast on bad GRC config before the scan; CLI-only, not MCP-reachable). Matrix-neutral: no new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.3** + **CE 0.2.28**.

package/README.md

@@ -75,7 +75,7 @@ When an AI agent loads this skill, it gains:
 | **Schema knowledge** | Complete data structures for parsing and presenting results |
 | **CPE construction** | How to map detected services to NVD vulnerability lookups |
 | **Plugin awareness** | 55 scanner plugins (27 Community incl. 3 Pro + 28 Enterprise) with protocols, ports, capabilities, and seven-framework (SOC 2 · HIPAA §164.312 · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · GDPR Art. 32) substrate-evidence dimensions |
-| **Compliance frameworks** | **Six frameworks, one scan** — SOC 2 (AICPA TSC 2017) · HIPAA Security Rule §164.312 Technical Safeguards (HHS Required/Addressable discipline per control) · NIST CSF 2.0 (Subcategory-level) · PCI DSS v4.0.1 (QSA RoC sub-requirement-level) · ISO/IEC 27001:2022 (per-Annex-A-code, SoA discipline) · CIS Controls v8 (per-Safeguard; Implementation Group IG1/IG2/IG3 cumulative discipline). Any CSV subset via `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8`. Zero BAA required for HIPAA — ePHI never leaves customer infrastructure. |
+| **Compliance frameworks** | **Seven frameworks, one scan** — SOC 2 (AICPA TSC 2017) · HIPAA Security Rule §164.312 Technical Safeguards (HHS Required/Addressable discipline per control) · NIST CSF 2.0 (Subcategory-level) · PCI DSS v4.0.1 (QSA RoC sub-requirement-level) · ISO/IEC 27001:2022 (per-Annex-A-code, SoA discipline) · CIS Controls v8 (per-Safeguard; Implementation Group IG1/IG2/IG3 cumulative discipline) · GDPR Article 32 (sub-measure-level; **Art. 32 infrastructure substrate only, NOT GDPR compliance**). All seven via `--compliance all`, or any CSV subset via `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr`. Zero BAA required for HIPAA — ePHI never leaves customer infrastructure. |
 | **Security rules** | ZDE, SSRF protection, redaction, scan authorization requirements |
 | **Error handling** | License gates, SSRF blocks, timeout resolution, CPE format errors |
 | **Decision routing** | When to use scan_host vs probe_service vs CLI vs get_vulnerabilities |

package/SKILL.md

@@ -16,7 +16,7 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.26 (post-EE-0.32.3 — a **matrix-neutral** RDS false-negative depth pass: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** Plugin 1140 now audits Aurora **cluster-level SSL enforcement** (`DescribeDBClusterParameters`), closing a cleartext false-negative on **instance-less Aurora Serverless v1** clusters the instance-level SSL check never saw (a cluster whose cluster parameter group set `rds.force_ssl=0` / `require_secure_transport=OFF` produced zero transit-encryption findings → now CRITICAL), and applies **staged-parameter (`ParameterApplyStatus`) discipline** so a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective. The CE CLI adds a **GRC-push startup preflight** — fail-fast on a bad GRC token / control-map / provider at scan startup before the full scan (CLI-only, not MCP-reachable). The new cluster findings route to the existing transit-encryption controls (titlePattern-only anchor edit). Prior context — EE 0.32.2 completed the **Vanta · Drata · Secureframe** GRC connector trio (records model, opt-in early-access, outbound single-workspace, live-tenant validation deferred to partner intake) + closed the cross-framework foreign-token leak in the "Why this violates" rationales; EE 0.32.1 cleaned internal engineering markers out of the rationales. Honest status: the three connectors are shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.28 + EE 0.32.3) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
+> **Version:** 0.2.28 (post-EE-0.32.5 — a **matrix-neutral** report-quality and routing-integrity release: nine API Gateway mapping rules that matched zero findings repaired (routing was never broken; the defect was a **stale** auditor-facing rationale rendering in place of the accurate one), the HIPAA §164.312(c)(1) WAF mapping removed on doctrine rather than repaired, six rationales rewritten out of internal development narration, `renderJSON` no longer shipping raw routing regexes, a CI/CD AccessDenied false-negative closed fail-closed, and three mutation-proven compliance-guard hardenings. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED.)
 
 NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
 plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This
@@ -495,7 +495,7 @@ Add to your MCP configuration with the same command/args pattern.
 |---------|-------|-------------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, CTEM, SARIF, scan history |
 | **Pro** | $49/mo | + CVE matching, verification probes, risk scoring, Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 26 cloud-substrate auditor plugins (1020-1222 range) covering AWS / GCP / Azure against SOC 2 (10 covered + 4 partial controls); Zero Trust; SOC 2 evidence-pack generation; RFC 3161 timestamps; chain-of-custody attestations; air-gapped deployment |
+| **Enterprise** | $2k+/yr | + 28 cloud-substrate auditor plugins (1020-1222 range) covering AWS / GCP / Azure against seven frameworks (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate); Zero Trust; SOC 2 evidence-pack generation; RFC 3161 timestamps; chain-of-custody attestations; air-gapped deployment |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.26",
-  "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
+  "version": "0.2.28",
+  "description": "AI Agent Skill for NSAuditor AI \u2014 gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",
     "ai-agent",