nsauditor-ai-agent-skill 0.2.41 → 0.2.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +65 -0
- package/README.md +27 -10
- package/SKILL.md +44 -10
- package/package.json +3 -3
- package/references/plugins.md +10 -4
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,71 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
|
|
|
4
4
|
|
|
5
5
|
---
|
|
6
6
|
|
|
7
|
+
## 0.2.43 (2026-08-20) — post-EE 0.40.0: the EIGHTH framework, and the words the skill must never use
|
|
8
|
+
|
|
9
|
+
**Requires CE >= 0.2.45 — RAISED.** Enterprise 0.40.0 registers `nist-800-171`, and CE 0.2.44 does
|
|
10
|
+
NOT carry the stem: a 0.40.0 Enterprise paired with an older CE rejects the framework name. This is
|
|
11
|
+
the one floor-raising entry in this cycle, and the floor is derived from the version that SHIPS the
|
|
12
|
+
stem, not from whatever the sibling working tree happened to read.
|
|
13
|
+
|
|
14
|
+
Enterprise 0.40.0 adds **NIST SP 800-171 Rev 2** as the eighth compliance framework, scoped as
|
|
15
|
+
**evidence substrate for CMMC Level 2 preparation**. What the skill must teach, and what it must
|
|
16
|
+
refuse to say:
|
|
17
|
+
|
|
18
|
+
- `--compliance nist-800-171` is available alongside the other seven; all eight route from a single
|
|
19
|
+
scan.
|
|
20
|
+
- All 110 Rev 2 requirements are enumerated with a written reason each — no declared subset.
|
|
21
|
+
- Coverage is claimed at the **SP 800-171A determination-statement (objective) level**, which is why
|
|
22
|
+
only two requirements are `covered`: a requirement clears that bar only when EVERY objective is a
|
|
23
|
+
statement of technical state the scan reads directly.
|
|
24
|
+
- **Rev 2 is pinned.** CMMC assesses Rev 2 by rule; Rev 3 is a different 97-requirement universe with
|
|
25
|
+
organization-defined parameters, and answering a Rev 3 question with Rev 2 output is drift.
|
|
26
|
+
- ⚠️ **NEVER tell a user the output is a CMMC certification, a FedRAMP authorization, a MET / NOT MET
|
|
27
|
+
determination, or an SPRS score.** It is none of those. Each is a C3PAO's determination, and a
|
|
28
|
+
misrepresented 800-171 posture is the shape the DOJ Civil Cyber-Fraud Initiative settles — which is
|
|
29
|
+
why this is a refusal rule for the agent, not a style note.
|
|
30
|
+
- CUI scope is the operator's assertion. The scanner cannot see CUI, cannot distinguish FCI from CUI,
|
|
31
|
+
and cannot see an enclave boundary.
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## 0.2.42 (2026-08-19) — post-EE 0.39.0: teach `deferredScope` as a per-PLUGIN boundary, and correct a stale "not yet proven"
|
|
36
|
+
|
|
37
|
+
**Requires CE >= 0.2.43 — UNCHANGED.** Enterprise 0.39.0 raises no floor.
|
|
38
|
+
|
|
39
|
+
Enterprise 0.39.0 gives every GCP and Azure plugin a `details.deferredScope` declaration (1021, 1022,
|
|
40
|
+
1024, 1025, 1220, 1221, 1222), joining the AWS plugins that already had one. The skill teaches four
|
|
41
|
+
things about it, and each is a mis-teaching this package could otherwise ship:
|
|
42
|
+
|
|
43
|
+
- A declaration is a **static capability boundary**, not an evidence gap and not a finding. It routes
|
|
44
|
+
to **zero** compliance controls by design. Report it as "not assessed".
|
|
45
|
+
- It is emitted **even over an empty estate**, because "zero findings" is otherwise indistinguishable
|
|
46
|
+
from "assessed and clean".
|
|
47
|
+
- ⚠️ **An empty or short list is NEVER a claim of full coverage.** Not every plugin declares its
|
|
48
|
+
boundaries, so the list bounds only what the DECLARING plugins state. This is stated as a per-plugin
|
|
49
|
+
invariant rather than a provider roster, deliberately: a roster sentence goes stale on the peer's
|
|
50
|
+
next release, and CE floats over a peer RANGE and cannot derive Enterprise's plugin set.
|
|
51
|
+
- Two AWS declarations (1080, 1130) now emit **once per run** rather than once per region, so the count
|
|
52
|
+
no longer scales with the estate.
|
|
53
|
+
|
|
54
|
+
Also taught: GCP impersonation now **refuses** an impersonated client that yields no Authorization
|
|
55
|
+
header — by name, with the target principal — surfacing as `up:false` plus a warning that fires
|
|
56
|
+
scanner-down synthesis. That refusal is the fail-closed design working and must not be taught as a
|
|
57
|
+
regression; what it replaced was silent anonymous requests producing FALSE evidence gaps.
|
|
58
|
+
|
|
59
|
+
### A correction this package owed, in the underclaim direction
|
|
60
|
+
|
|
61
|
+
0.2.41 taught that pack signing was *"reachable, not yet proven"*. **True when written, false since
|
|
62
|
+
2026-08-17**, when the published-bytes gate ran against the EE 0.38.0 registry bytes and passed. Every
|
|
63
|
+
"not yet proven" clause about pack signing is corrected here. npm freezes this package's prose at
|
|
64
|
+
publish time, so the correction needed its own release. The **scope** bound did not move and is the
|
|
65
|
+
part to keep repeating: one framework's envelope and the artifacts it enumerates, an operator-held
|
|
66
|
+
key, never a vendor attestation, never proof the scan ran.
|
|
67
|
+
|
|
68
|
+
Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
|
|
69
|
+
|
|
70
|
+
---
|
|
71
|
+
|
|
7
72
|
## 0.2.41 (2026-08-17) — post-EE 0.38.0: the evidence pack can be signed
|
|
8
73
|
|
|
9
74
|
**Requires CE >= 0.2.43** — both new verbs are routed from CE.
|
package/README.md
CHANGED
|
@@ -11,17 +11,34 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
|
|
|
11
11
|
|
|
12
12
|
## Current release
|
|
13
13
|
|
|
14
|
-
**0.2.
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
14
|
+
**0.2.43** — paired with **Enterprise 0.40.0 / Community 0.2.45**. The eighth compliance framework:
|
|
15
|
+
**NIST SP 800-171 Rev 2**, taught as **evidence substrate for CMMC Level 2 preparation**. ⚠️ **Requires
|
|
16
|
+
Community >= 0.2.45** — a real floor bump: the framework stem is registered in CE, and an older CE
|
|
17
|
+
rejects the name outright. What the agent must refuse to say is part of the skill, not a footnote:
|
|
18
|
+
**never a CMMC certification, never a FedRAMP authorization, never a MET / NOT MET determination, and
|
|
19
|
+
never an SPRS score** — each is a C3PAO's determination. Rev 2 is pinned because CMMC assesses Rev 2 by
|
|
20
|
+
rule; Rev 3 is a different 97-requirement universe, and answering a Rev 3 question with Rev 2 output is
|
|
21
|
+
drift. CUI scope stays the operator's assertion — the scanner cannot see CUI, cannot tell FCI from CUI,
|
|
22
|
+
and cannot see an enclave boundary.
|
|
23
|
+
|
|
24
|
+
**Prior: 0.2.42** — paired with Enterprise 0.39.0 / Community 0.2.44. Coverage honesty: every GCP and Azure
|
|
25
|
+
plugin now declares what it does NOT evaluate, so `deferredScope` must be taught as a **per-plugin static
|
|
26
|
+
capability boundary** — not an evidence gap, not a finding, routing to zero compliance controls — and an
|
|
27
|
+
empty or short list is **never** a claim of full coverage.
|
|
28
|
+
|
|
29
|
+
⚠️ **Correcting this section's own prior text.** It called the sign-pack and verify-pack commands
|
|
30
|
+
*"reachable, not yet proven"*, which was true when written and became false on 2026-08-17, when the
|
|
31
|
+
published-bytes gate ran against the EE 0.38.0 registry bytes and passed. So the capability is now
|
|
32
|
+
PROVEN for an operator-held key over one framework's envelope and the artifacts it enumerates, never
|
|
33
|
+
a vendor attestation. That scope bound is permanent and did not move.
|
|
18
34
|
|
|
19
35
|
⚠️ **What the skill must teach accurately about THIS release, because it is the claim most easily
|
|
20
36
|
overstated:** a verified signature proves the holder of a key asserted authorship of **one
|
|
21
37
|
framework's** chain-of-custody envelope at a stated time, **relative to operator key custody**. It
|
|
22
38
|
is never a vendor attestation, never proof the scan ran, and never proof the findings are true. It
|
|
23
39
|
covers that envelope plus the four artifacts it enumerates — **not the directory and not the pack**;
|
|
24
|
-
a
|
|
40
|
+
a multi-framework pack holds ten files per framework plus the scan-level output, and no object in
|
|
41
|
+
it enumerates the set. `verify-pack` also
|
|
25
42
|
recomputes every enumerated artifact hash against disk, so an edited report fails while the
|
|
26
43
|
signature itself still reads VERIFIED. And exit **2** means the run could not measure — an unsigned
|
|
27
44
|
pack, an unsupplied key or a registry member with no key material — which an agent must never
|
|
@@ -52,7 +69,7 @@ nsauditor-ai-agent-skill/
|
|
|
52
69
|
├── references/
|
|
53
70
|
│ ├── workflows.md # Multi-step workflow recipes (full audit, CI/CD, CTEM)
|
|
54
71
|
│ ├── schemas.md # Complete data structures (scan results, CVEs, findings)
|
|
55
|
-
│ └── plugins.md # Full plugin catalog (55 scanners with ports & protocols — 27 Community
|
|
72
|
+
│ └── plugins.md # Full plugin catalog (55 scanners with ports & protocols — 27 Community + 28 Enterprise)
|
|
56
73
|
├── examples/
|
|
57
74
|
│ └── agent-interactions.md # Example agent reasoning chains (9 scenarios)
|
|
58
75
|
├── package.json
|
|
@@ -109,8 +126,8 @@ When an AI agent loads this skill, it gains:
|
|
|
109
126
|
| **Workflow patterns** | Multi-step chains: scan → CVE lookup → remediation report |
|
|
110
127
|
| **Schema knowledge** | Complete data structures for parsing and presenting results |
|
|
111
128
|
| **CPE construction** | How to map detected services to NVD vulnerability lookups |
|
|
112
|
-
| **Plugin awareness** | 55 scanner plugins (27 Community
|
|
113
|
-
| **Compliance frameworks** | **
|
|
129
|
+
| **Plugin awareness** | 55 scanner plugins (27 Community + 28 Enterprise) with protocols, ports, capabilities, and multi-framework (SOC 2 · HIPAA §164.312 · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · GDPR Art. 32 · NIST SP 800-171 Rev 2) substrate-evidence dimensions |
|
|
130
|
+
| **Compliance frameworks** | **Eight frameworks, one scan** — SOC 2 (AICPA TSC 2017) · HIPAA Security Rule §164.312 Technical Safeguards (HHS Required/Addressable discipline per control) · NIST CSF 2.0 (Subcategory-level) · PCI DSS v4.0.1 (QSA RoC sub-requirement-level) · ISO/IEC 27001:2022 (per-Annex-A-code, SoA discipline) · CIS Controls v8 (per-Safeguard; Implementation Group IG1/IG2/IG3 cumulative discipline) · GDPR Article 32 (sub-measure-level; **Art. 32 infrastructure substrate only, NOT GDPR compliance**) · NIST SP 800-171 Rev 2 (requirement-level for the matrix, SP 800-171A determination-statement level for evidence; **examine-method evidence substrate for CMMC Level 2 preparation — never a CMMC certification and never a MET/NOT MET verdict**). All via `--compliance all`, or any CSV subset via `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171`. Zero BAA required for HIPAA — ePHI never leaves customer infrastructure. |
|
|
114
131
|
| **Security rules** | ZDE, SSRF protection, redaction, scan authorization requirements |
|
|
115
132
|
| **Error handling** | License gates, SSRF blocks, timeout resolution, CPE format errors |
|
|
116
133
|
| **Decision routing** | When to use scan_host vs probe_service vs CLI vs get_vulnerabilities |
|
|
@@ -149,8 +166,8 @@ This package provides **knowledge about** NSAuditor AI. To actually **run** scan
|
|
|
149
166
|
| Edition | Price | Highlights |
|
|
150
167
|
|---------|-------|-----------|
|
|
151
168
|
| **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, SARIF, CTEM, scan history |
|
|
152
|
-
| **Pro** | $49/mo | + CVE matching, risk scoring,
|
|
153
|
-
| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass,
|
|
169
|
+
| **Pro** | $49/mo | + CVE matching, risk scoring, and intelligence-enriched AI prompts (CVE + MITRE ATT&CK context injected) |
|
|
170
|
+
| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, multi-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32 / NIST SP 800-171 Rev 2), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, proven 0.36.0, verified per approver holding key material), air-gapped operation (offline licensing + offline CVE matching) |
|
|
154
171
|
|
|
155
172
|
→ [Pricing](https://www.nsauditor.com/ai/pricing/)
|
|
156
173
|
|
package/SKILL.md
CHANGED
|
@@ -16,25 +16,29 @@ description: >
|
|
|
16
16
|
|
|
17
17
|
# NSAuditor AI — Agent Skill
|
|
18
18
|
|
|
19
|
-
> **Version:** 0.2.
|
|
19
|
+
> **Version:** 0.2.43 (post-EE-0.40.0 · **requires CE ≥ 0.2.45 — RAISED**) — the eighth-framework release. **NIST SP 800-171 Rev 2 ships as `--compliance nist-800-171`, and CE registers the stem, so an older CE REJECTS the framework name outright** — that is what makes this floor a real bump rather than a paired bump. Teach the scope as **"NIST SP 800-171 evidence substrate for CMMC Level 2 preparation."** ⚠️ **WITHDRAWN — deliberately not claimed, in these exact words: "CMMC certified", "CMMC compliant", "CMMC ready", "FedRAMP authorized", any MET / NOT MET verdict, and any SPRS score.** Each of those is a C3PAO determination and none is a product output; a misrepresented SP 800-171 posture is the shape the DOJ Civil Cyber-Fraud Initiative settles, which is why this is a refusal rule for the agent and not a wording preference. All 110 Rev 2 requirements are enumerated — **2 covered / 49 partial / 59 out of scope**, each with a written reason — and coverage is claimed at the SP 800-171A **determination-statement (objective)** level, which is why only two clear the bar: a requirement counts as covered only when EVERY objective is technical system state the scan reads directly. ⚠️ **Rev 2 is PINNED**: CMMC assesses Rev 2 by rule, and Rev 3 is a different 97-requirement universe with organization-defined parameters — answering a Rev 3 question with Rev 2 output is drift. **CUI scope is the operator's assertion**: the scanner cannot see CUI, cannot tell FCI from CUI, and cannot see an enclave boundary. Also in this release: a KMS key in an account or project the operator may not control is no longer reported as customer key custody — it becomes an evidence gap, never a violation, because a cross-account CMK is recommended architecture. Plugin catalog UNCHANGED at 28 EE / 55 overall; the seven prior coverage matrices UNCHANGED.
|
|
20
|
+
>
|
|
21
|
+
> **Prior:** 0.2.42 (post-EE-0.39.0 · **requires CE ≥ 0.2.43**) — the coverage-honesty release. ⚠️ **Teach `deferredScope` as a per-PLUGIN declaration, never as a provider or coverage inventory.** Every GCP and Azure plugin now declares what it does NOT evaluate (1021, 1022, 1024, 1025, 1220, 1221, 1222), joining the AWS plugins that already did — 8 to 12 static boundaries each, emitted at `run()` scope on the audited path **including over an empty estate**, because "zero findings" is otherwise indistinguishable from "assessed and clean". A declaration is a **static capability boundary**: it is NOT an evidence gap and NOT a finding, it routes to ZERO compliance controls by design, and it must be reported as "not assessed". ⚠️ **An empty or short `deferredScope` is NEVER a claim of full coverage** — not every plugin declares its boundaries, so the list bounds only what the DECLARING plugins state. Never tell a user that an empty list means everything was assessed. Two AWS declarations (1080 Lambda, 1130 Backup) are now emitted ONCE PER RUN rather than once per region, so a fleet reads nine once-per-run disclosures — a count that no longer scales with the estate. And **GCP impersonation now REFUSES rather than degrading**: an impersonated client that yields no Authorization header fails loudly by name with the target principal, surfacing as `up:false` plus a warning that fires scanner-down synthesis. ⚠️ Teach that refusal as a PASS of the fail-closed design, never as a regression — the alternative it replaced was silent anonymous requests reporting FALSE evidence gaps. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.
|
|
22
|
+
>
|
|
23
|
+
> **Prior:** 0.2.41 (post-EE-0.38.0 · **requires CE ≥ 0.2.43**) — the sign-pack / verify-pack release. ⚠️ **This entry described those commands as "reachable and not yet proven" when written, and that is now STALE in the underclaim direction.** The published-bytes gate RAN against the EE 0.38.0 registry bytes on 2026-08-17 and PASSED, so the capability is PROVEN for an operator-held key over one framework's envelope and the artifacts it enumerates, never a vendor attestation. What has not changed, and never will, is that scope. `compliance sign-pack` signs a chain-of-custody envelope with an operator-held Ed25519 key; `compliance verify-pack` establishes authorship AND recomputes every enumerated artifact hash against disk. A verified signature proves the holder of a key asserted authorship of ONE framework's envelope, relative to operator key custody — never a vendor attestation, never proof the scan ran. It covers that envelope and its four artifacts, not the pack. Exit 2 means the run could not measure and is never a failure.
|
|
20
24
|
>
|
|
21
25
|
> **Prior:** 0.2.40 (post-EE-0.37.0 · **requires CE ≥ 0.2.42**) — the air-gap feed release. `feed bundle` and `feed import` let NVD feed files downloaded on a connected host be merged into one archive, hand-carried, and imported into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. ⚠️ Teach these precisely: **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database"** — the offline store is a lossy derivation of an NVD feed and cannot be turned back into one, so never describe this as a store export or a backup. **No KEV or EPSS data ships with the product**; `--kev` / `--epss` carry the operator's own downloads from CISA and FIRST, and `--extras-dir` places them on import and prints the environment lines to set. **A bundle is integrity-checked, NOT authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers; never describe an imported bundle as trusted or verified-as-genuine. **Import skips about a quarter of a real NVD year file by design** (withdrawn CVEs, entries with no CPE match data) — that is not data loss, while malformed records are a different signal meaning re-download. The air-gap delivery claims are EARNED BACK at this release, every one of them as a **restricted** distribution and **amd64 only** — the offline installation tarball is restricted, the install script is restricted, the feed-import CLI moves the feeds you downloaded, and air-gapped deployment is restricted and amd64 only — because the artifacts exist and the delivery gate passes on the built bytes. Teach them WITH their conditions, which are part of the claim and not footnotes: the bundle is a **restricted** distribution rather than a public `npm install`, and it is **amd64** only. **arm64 images remain WITHDRAWN** — never describe an arm64 enclave as supported.
|
|
22
26
|
>
|
|
23
27
|
> **Prior:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises is **proven as of EE 0.36.0 and verified for approvers whose registry entry carries key material**, its verification gate having run against the published bytes and passed — and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Verification runs for approvers whose registry entry carries key material.
|
|
24
28
|
>
|
|
25
|
-
> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that was not yet proven at that release, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing became REACHABLE at that release and was NOT YET PROVEN then. It was PROVEN at EE 0.36.0** — the verification gate ran against the published bytes and passed. Verification runs for approvers whose registry entry carries key material; for a fingerprint-only entry a report reads `not checked`, which records that no check ran and never that one failed. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall;
|
|
29
|
+
> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that was not yet proven at that release, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing became REACHABLE at that release and was NOT YET PROVEN then. It was PROVEN at EE 0.36.0** — the verification gate ran against the published bytes and passed. Verification runs for approvers whose registry entry carries key material; for a fingerprint-only entry a report reads `not checked`, which records that no check ran and never that one failed. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.
|
|
26
30
|
>
|
|
27
|
-
> **Prior:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall;
|
|
31
|
+
> **Prior:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.
|
|
28
32
|
|
|
29
|
-
> **Prior:** 0.2.36 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — a wording-only patch on top of the wiring release: the RFC 3161 row said the capability was "implemented but not yet wired to a flag", which EE 0.33.0 falsified and the live-TSA smokes then falsified twice over (npm path 2026-08-07, from inside the `:0.33.0` container image 2026-08-08). It is opt-in via `NSAUDITOR_TSA_URL`, proven on both delivery vehicles, and the only surviving caveat is version scope — retained images `:0.32.11` and earlier carry no `openssl`. **Prior:** 0.2.35 — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall;
|
|
33
|
+
> **Prior:** 0.2.36 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — a wording-only patch on top of the wiring release: the RFC 3161 row said the capability was "implemented but not yet wired to a flag", which EE 0.33.0 falsified and the live-TSA smokes then falsified twice over (npm path 2026-08-07, from inside the `:0.33.0` container image 2026-08-08). It is opt-in via `NSAUDITOR_TSA_URL`, proven on both delivery vehicles, and the only surviving caveat is version scope — retained images `:0.32.11` and earlier carry no `openssl`. **Prior:** 0.2.35 — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.
|
|
30
34
|
|
|
31
|
-
> **Prior:** 0.2.34 (post-EE-0.32.11 — **a correction release.** The Verification Engine was WITHDRAWN at EE 0.32.7; this package went on presenting it as a shipped Phase 4, glossing `VERIFIED` as probe-confirmed, and selling "verification probes" in the pricing table. All corrected — the status enum stays, the active-probe gloss goes, and findings are stated to be emitted UNVERIFIED. Upstream: `scan_cloud` summaries now surface the INFO tier and `deferredScope` boundaries; a new `compliance_matrix` MCP tool returns the shipped coverage matrix for any
|
|
35
|
+
> **Prior:** 0.2.34 (post-EE-0.32.11 — **a correction release.** The Verification Engine was WITHDRAWN at EE 0.32.7; this package went on presenting it as a shipped Phase 4, glossing `VERIFIED` as probe-confirmed, and selling "verification probes" in the pricing table. All corrected — the status enum stays, the active-probe gloss goes, and findings are stated to be emitted UNVERIFIED. Upstream: `scan_cloud` summaries now surface the INFO tier and `deferredScope` boundaries; a new `compliance_matrix` MCP tool returns the shipped coverage matrix for any shipped framework, derived at call time; `pdfExport` withdrawn and every capability now ships a description. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.)
|
|
32
36
|
|
|
33
37
|
> **Prior:** 0.2.33 (post-EE-0.32.10 — no knowledge change.)
|
|
34
38
|
|
|
35
39
|
> **Prior:** 0.2.32 (post-EE-0.32.9 — the skill package's own provenance sweep.)
|
|
36
40
|
|
|
37
|
-
> **Prior:** 0.2.30 (post-EE-0.32.7 — a **matrix-neutral** release that does two things. (1) **Cross-framework routing:** the network-scan analysis agents' findings now route in **
|
|
41
|
+
> **Prior:** 0.2.30 (post-EE-0.32.7 — a **matrix-neutral** release that does two things. (1) **Cross-framework routing:** the network-scan analysis agents' findings now route in **every shipped compliance framework**, not just SOC 2 — a host serving cleartext or exposing SMB previously failed the SOC 2 report and read clean in every other framework off the same scan; that gap is closed (mutation-proven guard; every `coverageSummary` block byte-identical). (2) **Capability-claim honesty pass:** several Pro/Enterprise capabilities advertised without a shipping implementation — verification engine, branded reports, usage metering, Docker per-scan isolation, and the ZDE "policy engine" / Enterprise-CTEM datastore framings — are **withdrawn**; the real cores (the code-enforced ZDE read-only guarantee, Pro-tier CTEM retention) ship and are described honestly, and the `verifiers/` stub files no longer ship. Plugin count UNCHANGED at 28; every coverage matrix UNCHANGED.)
|
|
38
42
|
|
|
39
43
|
NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
|
|
40
44
|
plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This
|
|
@@ -176,7 +180,7 @@ These tools return a license upgrade prompt on CE installations:
|
|
|
176
180
|
| `scan_cloud` | Enterprise | Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the server-configured credentials. No network host needed. Input: `{ providers?: ("aws"\|"gcp"\|"azure")[], regions?: string[] }` — **pass only the cloud(s) the user names** (`providers:["aws"]` for "audit my AWS account"); omit `providers` only when the user asks to audit ALL clouds. Use this (not `scan_host`) when the user asks to "audit my AWS account", "audit my AWS and Azure accounts", or "check my cloud compliance". CE/Pro callers get an upgrade message. **`regions` (AWS only)** — AWS region codes (e.g. `["us-east-1","eu-west-1"]`) or `["all"]`. **Default — single region (MOST requests):** a plain "audit my AWS account", a "quick check", or any request that names no region AND does not explicitly ask for all/every/whole-account/complete/full coverage → **OMIT `regions`** (audits ONLY the server-configured `AWS_REGION`, one region; do NOT fan out or batch). Omitting does NOT scan all regions. **Specific regions:** when the user names region(s), pass exactly those. **All regions — ONLY on an explicit "all regions / every region / whole account / full coverage" request:** use the discover-then-batch approach in the region-scope note below — do NOT pass a single `["all"]` call and rely on it (it fans every regional plugin across all enabled regions and usually EXCEEDS the host's MCP tool-call timeout, e.g. Claude Desktop's, returning nothing). Unknown region codes are rejected before the scan runs (the WHOLE call fails — fix the region and re-call; never silently drop it). |
|
|
177
181
|
| `get_findings` | Enterprise | Drill into the findings of the MOST RECENT `scan_cloud` scan — a per-provider, **per-session** cache (NOT live state; cleared when the MCP server restarts). Input: `{ scanId?, provider?, plugin?, severity?, category?, cursor?, limit? }`. Use it AFTER `scan_cloud` when the summary's **category rollup** shows a category you want to expand to specific resources, or when you need the FULL untruncated text of a finding. Pass the **`scanId` from the `scan_cloud` summary footer** + the `provider`; filter by `category`/`severity`/`plugin`; paginate with `cursor`/`limit` (server-capped at 20 — follow `nextCursor`). If you get a **"re-run scan_cloud"** error the cache was cleared or superseded — **re-run `scan_cloud`, do NOT retry `get_findings`**. CE/Pro callers get the same upgrade message as `scan_cloud`. |
|
|
178
182
|
|
|
179
|
-
> **Interpreting `scan_cloud` results — never report a false clean:** read **`findingsSummary`** for the findings — it maps each provider to `counts` (per-severity totals) and a `findings` list of the CRITICAL/HIGH items (`{severity, plugin, title}`); report those. A cloud was effectively audited only if it appears in `auditedProviders`. If the result has `audited: false`, any `notes` entries, or `pluginsRan: 0`, the cloud was **NOT** audited (no plugins, missing credentials, or skipped) — report the gap explicitly; an empty result is **not** a clean pass. Do not infer "clean" from an empty `findingsSummary` when the cloud is not in `auditedProviders`. **Beyond CRITICAL/HIGH, `findingsSummary[provider].rollup`
|
|
183
|
+
> **Interpreting `scan_cloud` results — never report a false clean:** read **`findingsSummary`** for the findings — it maps each provider to `counts` (per-severity totals) and a `findings` list of the CRITICAL/HIGH items (`{severity, plugin, title}`); report those. A cloud was effectively audited only if it appears in `auditedProviders`. If the result has `audited: false`, any `notes` entries, or `pluginsRan: 0`, the cloud was **NOT** audited (no plugins, missing credentials, or skipped) — report the gap explicitly; an empty result is **not** a clean pass. Do not infer "clean" from an empty `findingsSummary` when the cloud is not in `auditedProviders`. **Beyond CRITICAL/HIGH, `findingsSummary[provider].rollup` groups the remaining findings by `category` with counts (count-descending) across **MEDIUM, LOW *and* INFO** — and the INFO tier is not optional reading, because that is where the evidence gaps and the deferred-scope boundaries live. ⚠️ This sentence said "MEDIUM + LOW" until EE 0.39.0, which was FALSE against the summariser's own three rollup buckets, and false in the direction that hides the tier a reader most needs. Report every tier that occurs; these are actionable too: a category like `sqs-age-alarm-missing` or `*-public` is a real gap, not noise, and reporting only CRITICAL/HIGH while the rollup is non-empty is itself a false clean. To enumerate the specific resources behind a rollup category, or to read a finding's full untruncated text, call `get_findings` with the `scanId` from the summary footer + the `category`.**
|
|
180
184
|
|
|
181
185
|
> **Reporting `scan_cloud` region scope — never overstate coverage:** Report the regions you ACTUALLY scanned, derived from the `regions` you **passed** — NOT from the findings. If you OMITTED `regions`, only the single server-default region (`AWS_REGION`) was scanned — say exactly that and add that the account's OTHER enabled regions were NOT covered (offer to re-run for all regions). **Never escalate a single-region or "quick" request into a multi-region scan.** Do NOT claim "all regions" / "every region" / "across N regions" just because GuardDuty or Inspector list per-region findings: those plugins enumerate every enabled region INTERNALLY regardless of scope, so their per-region findings are NOT evidence the other plugins ran outside the region(s) you passed.
|
|
182
186
|
|
|
@@ -185,7 +189,7 @@ These tools return a license upgrade prompt on CE installations:
|
|
|
185
189
|
>
|
|
186
190
|
> The framework detail below is accurate and worth keeping — it was attached to a tool name that does not exist:
|
|
187
191
|
>
|
|
188
|
-
> SOC 2 (AICPA TSC 2017) + HIPAA (§164.312 Technical Safeguards) + NIST CSF 2.0 Core + PCI DSS v4.0.1 (sub-requirement-level for QSA RoC; PCI SSC June 2024 errata) + ISO/IEC 27001:2022 (per-Annex-A-code-level for ISO/IEC 17021-1 certification body assessors; ISO + IEC October 2022; 2013 edition retired October 31, 2025) + **CIS Critical Security Controls v8** (per-Safeguard-level; Center for Internet Security May 2021, v8.1 errata June 2024) + **GDPR Article 32 (Security of Processing)** (sub-measure-level; Regulation (EU) 2016/679; **Art. 32 infrastructure substrate only, NOT GDPR compliance**) gap analysis — all seven shipped (SOC 2 EE 0.3.x; HIPAA EE 0.9.0; NIST CSF 2.0 EE 0.10.0; PCI DSS v4.0.1 EE 0.11.0; ISO/IEC 27001:2022 EE 0.12.0; CIS Controls v8 EE 0.13.0; **GDPR Article 32 EE 0.20.0**). Multi-framework via `--compliance all` (shorthand for
|
|
192
|
+
> SOC 2 (AICPA TSC 2017) + HIPAA (§164.312 Technical Safeguards) + NIST CSF 2.0 Core + PCI DSS v4.0.1 (sub-requirement-level for QSA RoC; PCI SSC June 2024 errata) + ISO/IEC 27001:2022 (per-Annex-A-code-level for ISO/IEC 17021-1 certification body assessors; ISO + IEC October 2022; 2013 edition retired October 31, 2025) + **CIS Critical Security Controls v8** (per-Safeguard-level; Center for Internet Security May 2021, v8.1 errata June 2024) + **GDPR Article 32 (Security of Processing)** (sub-measure-level; Regulation (EU) 2016/679; **Art. 32 infrastructure substrate only, NOT GDPR compliance**) gap analysis — all seven shipped (SOC 2 EE 0.3.x; HIPAA EE 0.9.0; NIST CSF 2.0 EE 0.10.0; PCI DSS v4.0.1 EE 0.11.0; ISO/IEC 27001:2022 EE 0.12.0; CIS Controls v8 EE 0.13.0; **GDPR Article 32 EE 0.20.0**). Multi-framework via `--compliance all` (shorthand for every shipped framework; EE 0.31.4) or `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` (any CSV subset; aliases `nist`/`pci`/`iso`/`cis`, and `800-171` or `cmmc` for `nist-800-171` — ⚠️ `nist` stays NIST CSF, because two NIST publications now ship and the bare vendor name is ambiguous); an unknown token **fails fast** (no "Framework load failed" stub). One scan produces one complete auditor-ready evidence pack per framework requested. **NIST SP 800-171 Rev 2** (requirement-level `3.x.y` for the matrix, SP 800-171A determination-statement level `3.x.y[a]` for evidence; EE F2 cycle) is the eighth. ⚠️ **TEACH ITS SCOPING DOCTRINE VERBATIM AND NEVER PARAPHRASE IT: "NIST SP 800-171 evidence substrate for CMMC Level 2 preparation."** WITHDRAWN — deliberately not claimed, in these exact words: "CMMC certified / compliant / ready", "FedRAMP authorized", never a MET / NOT MET verdict, and never an SPRS score — a Level 2 certificate is issued to a CONTRACTOR by a C3PAO under the CMMC rule, and FedRAMP authorizes cloud service offerings, which this product is not. Only **2 of the 110** Rev 2 requirements are `covered`, and that is the design rather than a shortfall: one objective scored NOT MET fails its whole requirement, so a requirement is covered only when EVERY one of its determination statements is a statement of technical state the scan reads directly. Each mapped requirement carries `assessmentObjectives` and `objectivesEvidenced`; `partialBasis` names which of three shortfalls applies. CUI scope is the OPERATOR's assertion — the scanner cannot see CUI, cannot tell FCI from CUI, and cannot see an enclave boundary. The SSP (3.12.4) and POA&M (3.12.2) are operator artifacts this engine informs and never produces. ⚠️ Its requirement ids collide EXACTLY with PCI DSS sub-requirement ids (`3.5.1` is real in both), so ALWAYS qualify a citation. **CIS Controls v8**: 17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls. **Implementation Group cumulative discipline** — IG1=56 (cyber-insurance baseline; ~50-70% of mid-market policies require IG1 attestation), IG2 cumulative=130, IG3 cumulative=153; smallest-IG-membership tagging (NEVER report IG2 as 74-of-74 in isolation). **No-certification-body attestation discipline** — engine output is INPUT to CSAT / CIS-CAT Pro self-attestation OR a SOC 2 auditor cross-validating CIS scope, never "CIS certified." Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (Safeguards 4.1/4.2/4.6) + 5 Security Functions (NOT 6 — no Govern) + 6 Asset Types + MS-ISAC/EI-ISAC/H-ISAC sector baselines + v7.1-to-v8 cross-reference. CIS Safeguard examples: `3.3` Data Access Control Lists, `5.4` Restrict Administrator Privileges, `6.3` MFA for Externally-Exposed Applications, `8.2` Collect Audit Logs, `11.4` Isolated Recovery Data Instance. ISO 27001 Annex A code examples: `A.5.15` Access control, `A.5.23` NEW 2022 Cloud services, `A.8.5` Secure authentication, `A.8.9` NEW 2022 Configuration management, `A.8.16` NEW 2022 Monitoring activities, `A.8.24` Use of cryptography. Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design framing (7 Major Nonconformity classes — absence of internal audit per Clause 9.2 or management review per Clause 9.3 = auto-fail Stage 2) + 5-attribute taxonomy NEW in 2022 (controlType / informationSecurityProperties / cybersecurityConcepts [5 categories, NOT 6 like NIST CSF 2.0] / operationalCapabilities / securityDomains) + 2013-to-2022 transition discipline. Pair with ISO-aware GRC (Drata ISO 27001 / Vanta ISO 27001 / AuditBoard / OneTrust ISMS / Secureframe ISO 27001) for SoA workflow + internal audit + management review. PCI DSS sub-requirement examples: `Req 1.2.1` NSC config standards, `Req 8.4.1` MFA on non-console admin, `Req 10.2.1` audit logs enabled, `Req 11.3.1` quarterly internal vuln scans. Defined-vs-Customized Approach discipline per Appendix E (15 Defined-only sub-requirements enforced at schema layer; CHD Scope operator-attested via CDE DFD per Req 1.2.4; card-brand AOC enforcement view — Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **NIST SP 800-171 Rev 2** (evidence substrate for **CMMC Level 2 preparation** — all 110 Rev 2 requirements enumerated, claimed at the SP 800-171A determination-statement level; Rev 2 is pinned because CMMC assesses Rev 2 by rule and Rev 3 is a different 97-requirement universe). ⚠️ **Never tell a user this produces a CMMC certification, FedRAMP authorization, MET/NOT MET verdict or SPRS score — it produces none of those, and each is a C3PAO determination.** **GRC push (Enterprise, opt-in):** set `COMPLIANCE_GRC_PROVIDER=vanta` (or `drata` / `secureframe`) + `COMPLIANCE_GRC_TOKEN` to map the findings to the platform's evidence/test records and push them at scan time (ZDE-redacted egress; token never serialized; the Vanta·Drata·Secureframe connector trio is complete — Secureframe records model, live tenant validation in progress).
|
|
189
193
|
|
|
190
194
|
### Evidence gaps — never read one as a pass (post EE 0.32.9)
|
|
191
195
|
|
|
@@ -204,6 +208,36 @@ If a scan predates EE 0.32.9, its gap findings lead with a retired prefix that n
|
|
|
204
208
|
anchor matches, so they route to no control — the engine detects this and warns. Advise a
|
|
205
209
|
re-scan rather than reusing the old artifact.
|
|
206
210
|
|
|
211
|
+
### Deferred scope — a declared boundary is neither a gap nor a finding (post EE 0.39.0)
|
|
212
|
+
|
|
213
|
+
`findingsSummary[provider].deferredScope` lists surface this release does **not evaluate at all**.
|
|
214
|
+
It is a **static capability boundary**, and all three of the following are load-bearing:
|
|
215
|
+
|
|
216
|
+
- **It is NOT an evidence gap.** A gap means the scanner tried to read something and could not
|
|
217
|
+
(AccessDenied, truncated enumeration) — fixable with permissions. A deferred-scope entry means no
|
|
218
|
+
code was ever written to look. Never merge the two lists, and never suggest granting permissions
|
|
219
|
+
to close one.
|
|
220
|
+
- **It is NOT a finding.** It routes to **ZERO** compliance controls by design, carries no severity
|
|
221
|
+
judgement about the estate, and must never be reported under "issues found" or counted as a
|
|
222
|
+
failure. Report it as **"not assessed"**.
|
|
223
|
+
- **It is emitted even over an EMPTY estate**, deliberately: an account with no resources yields
|
|
224
|
+
zero findings whether or not anything was examined, so the declaration is the only thing that
|
|
225
|
+
tells those two apart.
|
|
226
|
+
|
|
227
|
+
⚠️ **AN EMPTY OR SHORT `deferredScope` IS NEVER A CLAIM OF FULL COVERAGE.** Not every plugin
|
|
228
|
+
declares its boundaries, so the list bounds only what the **declaring** plugins state — it is not a
|
|
229
|
+
coverage inventory. Where the list is empty or short, say plainly that boundaries are declared
|
|
230
|
+
per-plugin and this is not an inventory. **Never tell a user that an empty list means everything was
|
|
231
|
+
assessed.** State this as a per-plugin invariant, never as a provider roster: a roster sentence goes
|
|
232
|
+
stale on the next Enterprise release, which is exactly why the CE tool description stopped carrying
|
|
233
|
+
one at CE 0.2.44.
|
|
234
|
+
|
|
235
|
+
Since EE 0.39.0 all three clouds declare: AWS through nine emitters, Azure through four (1022, 1220,
|
|
236
|
+
1221, 1222) and GCP through three (1021, 1024, 1025). Before that release only AWS declared, and the
|
|
237
|
+
asymmetry was itself the hazard — **one provider disclosing is what makes another's silence read as
|
|
238
|
+
completeness.** The AWS declarations are also now emitted once per RUN rather than once per region,
|
|
239
|
+
so the count no longer scales with the estate and no entry is region-stamped.
|
|
240
|
+
|
|
207
241
|
### Cross-framework routing — cite the engine, do NOT freehand-map (post EE 0.32.7)
|
|
208
242
|
|
|
209
243
|
When a user asks which controls a finding maps to, **read it from the engine's compliance
|
|
@@ -223,7 +257,7 @@ dispositions to know:
|
|
|
223
257
|
variants also route to **SOC 2 only** — each is a breadth heuristic or a self-declared
|
|
224
258
|
*unverifiable* observation, not a per-transmission determination.
|
|
225
259
|
- Otherwise, network-scan analysis-agent findings (`crypto_agent` / `exposure_agent`) now
|
|
226
|
-
route across **
|
|
260
|
+
route across **every shipped** framework where the control subject matches (EE 0.32.7): a
|
|
227
261
|
**confirmed** cleartext channel fails HIPAA §164.312(e)(1), ISO A.8.24, NIST PR.DS-02,
|
|
228
262
|
CIS 3.10, PCI 4.2.1 and GDPR Art. 32(1)(a) as well as SOC 2 CC6.7.
|
|
229
263
|
|
|
@@ -452,7 +486,7 @@ Add to your MCP configuration with the same command/args pattern.
|
|
|
452
486
|
|---------|-------|-------------|
|
|
453
487
|
| **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, CTEM, SARIF, scan history |
|
|
454
488
|
| **Pro** | $49/mo | + CVE matching, risk scoring, analysis agents, Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
|
|
455
|
-
| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against
|
|
489
|
+
| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against every shipped framework (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate; NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
|
|
456
490
|
|
|
457
491
|
→ [Pricing](https://www.nsauditor.com/ai/pricing/)
|
|
458
492
|
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nsauditor-ai-agent-skill",
|
|
3
|
-
"version": "0.2.
|
|
4
|
-
"description": "AI Agent Skill for NSAuditor AI
|
|
3
|
+
"version": "0.2.43",
|
|
4
|
+
"description": "AI Agent Skill for NSAuditor AI \u2014 gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"nsauditor",
|
|
7
7
|
"ai-agent",
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
"examples/"
|
|
49
49
|
],
|
|
50
50
|
"peerDependencies": {
|
|
51
|
-
"nsauditor-ai": ">=0.
|
|
51
|
+
"nsauditor-ai": ">=0.2.45"
|
|
52
52
|
},
|
|
53
53
|
"peerDependenciesMeta": {
|
|
54
54
|
"nsauditor-ai": {
|
package/references/plugins.md
CHANGED
|
@@ -126,7 +126,13 @@ LLMNR poisoning risk).
|
|
|
126
126
|
|
|
127
127
|
---
|
|
128
128
|
|
|
129
|
-
##
|
|
129
|
+
## Local-Surface Plugins (1)
|
|
130
|
+
|
|
131
|
+
| ID | Name | Protocol | Purpose |
|
|
132
|
+
|----|------|----------|---------|
|
|
133
|
+
| 070 | MCP Scanner | local | Detects Model Context Protocol servers reachable from the host and audits their exposure. Community tier; requires host: up. |
|
|
134
|
+
|
|
135
|
+
## Deep-Audit Plugins (3) — Community tier
|
|
130
136
|
|
|
131
137
|
| ID | Name | Ports | Purpose |
|
|
132
138
|
|----|------|-------|---------|
|
|
@@ -134,7 +140,7 @@ LLMNR poisoning risk).
|
|
|
134
140
|
| 050 | TRIBE v2 Probe | 80, 443 | Detect debug info leaks, stack traces, verbose errors, CORS misconfig |
|
|
135
141
|
| 060 | DNS Security Auditor | 53 | SPF/DKIM/DMARC validation, DNSSEC, zone transfer, MX security, CAA |
|
|
136
142
|
|
|
137
|
-
###
|
|
143
|
+
### Deep-Audit Plugin Details
|
|
138
144
|
|
|
139
145
|
**040 — TLS Certificate & Cipher Auditor:** Goes beyond the basic TLS Scanner (011)
|
|
140
146
|
with full certificate chain validation, expiration warnings, and a comprehensive weak
|
|
@@ -161,7 +167,7 @@ listings, and default pages.
|
|
|
161
167
|
|
|
162
168
|
## Enterprise Plugins (28)
|
|
163
169
|
|
|
164
|
-
> **EE plugin ID range.** As of EE 0.3.9 (2026-05-12), all EE plugins use the disjoint **1000+ ID range** to avoid CE collision. The earlier 020/021/022/023/030/040/050/060 IDs were renumbered to 1020/1021/1022/1023/1030/1040/1050/1060. CE reserves 001-099. EE plugins audit AWS / GCP / Azure cloud substrate end-to-end against **
|
|
170
|
+
> **EE plugin ID range.** As of EE 0.3.9 (2026-05-12), all EE plugins use the disjoint **1000+ ID range** to avoid CE collision. The earlier 020/021/022/023/030/040/050/060 IDs were renumbered to 1020/1021/1022/1023/1030/1040/1050/1060. CE reserves 001-099. EE plugins audit AWS / GCP / Azure cloud substrate end-to-end against **every shipped compliance framework** — SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Art. 32 infrastructure substrate only, NOT GDPR compliance) and NIST SP 800-171 Rev 2 (examine-method evidence substrate for CMMC Level 2 preparation, never a certification). **The authoritative enumeration, with each framework's citation level and ship version, is in `SKILL.md` — it is not repeated here.** Each plugin's findings route to every one of them via the framework-agnostic engine plus a per-framework control-citation map, so a report cites only its own framework's ids (SOC 2 `CC6.1`, HIPAA `§164.312(a)(1)`, NIST `PR.AA-01`, PCI `Req 1.2.1`, ISO `A.8.24`, CIS `4.4`, GDPR `Art.32(1)(b)`, 800-171 `3.13.16`) — closing cross-framework citation leak across every ordered pair. ⚠️ 800-171 and PCI DSS ids COLLIDE exactly (`3.5.1` is real in both), so an 800-171 citation always carries its qualifier. Every plugin is enterprise-gated by the `cloudScanners` capability and runs against customer-supplied cloud credentials. Multi-framework workflow: `--compliance all` (every shipped framework), or any CSV subset such as `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` — one scan produces a separate, complete auditor-ready evidence pack per framework requested. **Zero BAA required** for HIPAA — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure (and CHD never leaves for PCI DSS CDE-isolation threat models). **NIST CSF 2.0 Implementation Tiers 1-4** (Partial / Risk-Informed / Repeatable / Adaptive) are organizational-maturity claims explicitly OOS for infrastructure scanning — surfaced in renderer as cover-page Tiers OOS disclaimer section (markdown + HTML parity); pair with NIST-aware GRC platforms (Tugboat Logic, Drata NIST CSF, Vanta NIST CSF, AuditBoard). **PCI DSS v4.0.1 specifics**: sub-requirement-level mapping for QSA Report on Compliance workflow (MVP-67 density: 67 of ~250 sub-requirements. **For the current covered/partial/OOS triple, call `compliance_matrix` with `framework: "pci-dss"`** — it derives from the shipped framework map at call time. A figure typed here goes stale: this sentence carried `20 + 8 + 39` against a shipped `19 / 9 / 39`, the same stale triple that had already propagated to a public page once). **Req 12 Information Security Program OOS-by-design entirely** (Targeted Risk Analysis Req 12.3.1 + Customized Approach Documentation Req 12.3.2 + TPSP Responsibility Matrix Req 12.8.5 + IR personnel training Req 12.10.4 all Defined-only per Appendix E). **Req 5 anti-malware + Req 9 physical OOS-entirely** (endpoint EDR + facility-tier). **Req 3 stored CHD OOS-by-design at technical-control layer** pending operator CDE attestation via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. CAO text MVP-deferred to EE 0.11.1 patch. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC — the actual penalty mechanism). Pair with PCI-aware GRC platforms (Drata PCI, Vanta PCI, AuditBoard PCI module, OneTrust GRC).
|
|
165
171
|
|
|
166
172
|
| ID | Name | Tier | Purpose | SOC 2 Controls |
|
|
167
173
|
|----|------|------|---------|----------------|
|
|
@@ -192,7 +198,7 @@ listings, and default pages.
|
|
|
192
198
|
| 1210 | AWS EC2 Instance Auditor (**NEW EE 0.13.1** — first new plugin since 1200; plugin count 24 → 25; the AWS producer for CIS-Hardened-Image detection + EC2 instance-level + EBS-encryption coverage) | Enterprise | Audits EC2 instances (orthogonal to plugin 1170 which audits the SG perimeter policy). **Multi-region** via ec2:DescribeRegions (single-region fallback emits an evidence-gap). Dimensions: **IMDSv1 enabled** (CC6.1 — MEDIUM when an IAM instance profile is attached / LOW without; **IMDSv2 hop-limit > 1** re-opens container credential theft) + **EBS volume unencrypted** (C1.1 + CIS 3.11 — HIGH; resolves every attached BlockDeviceMappings volume via DescribeVolumes) + **account default-EBS-encryption disabled** (C1.1 preventive — GetEbsEncryptionByDefault) + **public-IP exposure** incl. secondary-ENI/EIP + IPv6 GUA (CC6.6 substrate, INFO) + **instance-store (ephemeral) volume** evidence-gap. **DIM 4 — AMI inventory** → result.cisImageInventory (the producer feed that makes CIS-Hardened-Image detection LIVE on Safeguards 4.1/4.2/4.6; Azure 1022 + GCP 1021 feed the same contract). Conservative classifier: LOW + evidenceGap on indeterminate metadata; AccessDenied → INFO + evidenceGap (never silent-PASS); terminated/shutting-down instances skipped. Survived 3 review rounds / 5 adversarial skill lenses (network-security-audit + CIS + IAM-effective-permissions + soc2-evidence + cloud-plugin-false-negatives). `@aws-sdk/client-ec2` reused. | CC6.1 / C1.1 / CC6.6 |
|
|
193
199
|
| 1220 | Azure Storage Account Data-Protection Auditor (**NEW EE 0.13.2** — Move C-2; **+2 dims EE 0.13.3** — Move C-2.1; plugin count 25 → 26; first dedicated Azure auditor beyond the multi-purpose 1022 scanner) | Enterprise | Audits the Azure Storage Account data-protection surface across **7 dims** — **orthogonal to plugin 1022** which owns the network-exposure dims (no double-emission; mirrors the AWS 1020 S3-scanner + 1120 S3-lifecycle two-plugin split). (1) **HTTPS-only transit** (`enableHttpsTrafficOnly` — HIGH on plaintext HTTP; CC6.7) + (2) **minimum TLS version** (< TLS1_2 → MEDIUM; CC6.7) + (3) **Shared Key authorization** (`allowSharedKeyAccess` — bypasses Azure AD identity; CC6.1; Azure field-default discipline: absent = ENABLED, never silent-PASS) + (4) **infrastructure (double) encryption** (`requireInfrastructureEncryption`; C1.1) + (5) **encryption key source incl. CMK reachability + rotation** (`encryption.keyVaultProperties` — keySource=Microsoft.Keyvault PASS only when the key is currently resolvable + auto-rotating; a disabled/revoked/version-pinned CMK degrades, not silent-PASS; C1.1) + (6) **blob recoverability** (soft-delete + versioning via the secondary `blobServices.getServiceProperties` path — A1.2; EE 0.13.3) + (7) **per-container anonymous public access** (account-toggle-aware via `blobContainers.list` — `publicAccess=Blob/Container` + allowBlobPublicAccess=true → HIGH effective exposure; C1.1; EE 0.13.3). Conservative classifier: indeterminate field / AccessDenied / secondary-path failure → evidence-gap (never silent-PASS); `for await` pagination. Single-subscription scope surfaced explicitly. Built + reviewed through the cloud-plugin-false-negatives lens. `@azure/arm-storage` + `@azure/identity`. | CC6.7 / CC6.1 / C1.1 / A1.2 |
|
|
194
200
|
| 1221 | Azure NSG Perimeter Auditor (**NEW EE 0.14.0** — Move C-2.2; **UDP lane EE 0.14.1**; plugin count 26 → 27; the Azure analog of AWS plugin 1170) | Enterprise | A CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups — **non-overlapping-by-depth with plugin 1022's flat per-rule NSG lint** (no double-emission of a verdict; mirrors the AWS 1023-observed / 1170-declared two-plugin precedent). Evaluates each NSG's inbound rules in **Azure priority order** (first match wins; DenyAllInbound default): (1) **all-protocol (`*`) public Allow** — every port reachable from the public internet + (2) **public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted TCP port** (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Memcached/MongoDB/Elasticsearch/CouchDB/SMB/WinRM/Oracle/Docker/Kubelet) + (3) **`::/0` IPv6-wildcard to a restricted port** (the dimension 1022's flat lint misses) + **(2u/3u) public-source / `::/0` to a restricted UDP service** (DNS/TFTP/rpcbind/NTP/NetBIOS/SNMP/CLDAP/IKE/Syslog/IPMI/OpenVPN/MSSQL-Monitor/SSDP/IPsec-NAT-T/Memcached — closes the public-UDP false negative, **EE 0.14.1**) + (4) **public→non-restricted port** INFO substrate + (5) **PASS substrate** when no public restricted exposure. **Attachment-aware severity** via the read-only `nsg.subnets[]`/`networkInterfaces[]` back-references — attached → CRITICAL (effective exposure); orphaned → MEDIUM (latent). Per-transport effective priority/deny-override resolution + port-range expansion + `0.0.0.0/1` split-range coverage + service-tag/ASG-source normalization (VirtualNetwork/AzureLoadBalancer/ASG = not public). Conservative classifier: denied/indeterminate listAll → evidence-gap; one malformed NSG degrades per-resource (never aborts the scan); `for await` pagination; single-subscription scope explicit. Built + reviewed through the cloud-plugin-false-negatives lens (EE 0.14.0 SHIP-WITH-FOLDS 2 LOW; EE 0.14.1 UDP lane SHIP-WITH-FOLDS 2 MED + 1 LOW, all folded). `@azure/arm-network` + `@azure/identity`. | CC6.6 |
|
|
195
|
-
| 1222 | Azure Key Vault Deep Auditor (**NEW EE 0.15.0** — Move C-2.3; plugin count 27 → 28; the third dedicated Azure auditor after 1220 storage + 1221 NSG; **hotfixed EE 0.15.1** — Dim-3 SDK-shape + Dim-4 inherited-admin severity re-tune) | Enterprise | The deep Key Vault auditor — the KV analog of how 1221 deepens 1022's flat NSG dim; **orthogonal to plugin 1022's vault-property dims** (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission of a verdict. Enumerates each vault's **keys, role assignments, and diagnostic settings** across 4 dims: (1) key **auto-rotation policy** — keys with no `rotationPolicy` / no rotate-action → finding + (2) key **expiry** — keys with no `expires` (or already-expired), with epoch-s/ms/Date/string coercion (closes the ms-overflow false-clean) + (3) **diagnostic logging → Log Analytics** — vaults with no `AuditEvent`→workspace diagnostic setting; reads `@azure/arm-monitor`'s `diagnosticSettings.list()` correctly as an `await`-ed `{value:[]}` collection object (NOT a paged async-iterator — the EE 0.15.1 H-1 fix; pre-fix the dim always threw and degraded to a non-functional evidence-gap), soft-degrades to an evidence-gap if the SDK is absent + (4) **privileged-access depth** — RBAC `roleAssignments` (admin/data-plane/**scope-aware severity**: vault-scoped control-plane god roles + Key Vault Administrator at any scope → HIGH; inherited subscription/management-group-scope Owner/User-Access-Administrator → MEDIUM, inherited Contributor → LOW — the EE 0.15.1 H-2 re-tune that stops flagging the ubiquitous inherited-admin reality as HIGH on every RBAC vault) + legacy `accessPolicies` breadth (export + wide-crypto permissions). **Secret/cert expiry is a deliberate data-plane scope boundary** (explicit caveat — the control-plane mgmt API does not expose data-plane object expiry). Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource (never aborts the scan); single-subscription scope explicit. Findings route across
|
|
201
|
+
| 1222 | Azure Key Vault Deep Auditor (**NEW EE 0.15.0** — Move C-2.3; plugin count 27 → 28; the third dedicated Azure auditor after 1220 storage + 1221 NSG; **hotfixed EE 0.15.1** — Dim-3 SDK-shape + Dim-4 inherited-admin severity re-tune) | Enterprise | The deep Key Vault auditor — the KV analog of how 1221 deepens 1022's flat NSG dim; **orthogonal to plugin 1022's vault-property dims** (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission of a verdict. Enumerates each vault's **keys, role assignments, and diagnostic settings** across 4 dims: (1) key **auto-rotation policy** — keys with no `rotationPolicy` / no rotate-action → finding + (2) key **expiry** — keys with no `expires` (or already-expired), with epoch-s/ms/Date/string coercion (closes the ms-overflow false-clean) + (3) **diagnostic logging → Log Analytics** — vaults with no `AuditEvent`→workspace diagnostic setting; reads `@azure/arm-monitor`'s `diagnosticSettings.list()` correctly as an `await`-ed `{value:[]}` collection object (NOT a paged async-iterator — the EE 0.15.1 H-1 fix; pre-fix the dim always threw and degraded to a non-functional evidence-gap), soft-degrades to an evidence-gap if the SDK is absent + (4) **privileged-access depth** — RBAC `roleAssignments` (admin/data-plane/**scope-aware severity**: vault-scoped control-plane god roles + Key Vault Administrator at any scope → HIGH; inherited subscription/management-group-scope Owner/User-Access-Administrator → MEDIUM, inherited Contributor → LOW — the EE 0.15.1 H-2 re-tune that stops flagging the ubiquitous inherited-admin reality as HIGH on every RBAC vault) + legacy `accessPolicies` breadth (export + wide-crypto permissions). **Secret/cert expiry is a deliberate data-plane scope boundary** (explicit caveat — the control-plane mgmt API does not expose data-plane object expiry). Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource (never aborts the scan); single-subscription scope explicit. Findings route across every shipped framework (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 · HIPAA §164.312(a)(2)(iv)/(b)/(a)(1) · NIST CSF PR.DS-01/DE.CM-09/PR.AA-05 · PCI DSS 3.5.1/10.2.1/7.2.1 · ISO 27001 A.8.24/A.8.15/A.5.15+A.8.2 · CIS v8 3.11/8.2/5.4 · GDPR Art.32(1)(b)-confidentiality + Art.32(1)(b)-integrity) — every coverage matrix UNCHANGED at that release. Built + reviewed through the cloud-plugin-false-negatives lens (SHIP-WITH-FOLDS 0C/3H/2M/4L; 4 folded). `@azure/arm-keyvault` + `@azure/arm-monitor` + `@azure/arm-authorization` + `@azure/identity`. | CC6.3 / C1.1 / CC6.1 / CC7.2 |
|
|
196
202
|
|
|
197
203
|
---
|
|
198
204
|
|