nsauditor-ai-agent-skill 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -4,9 +4,17 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.7 (2026-06-08) — Paired-release pin for EE 0.19.2 + CE 0.2.7 — Confirmed false-negative tail
+
+Paired no-op bump (knowledge-package version sync). EE 0.19.2 closes six more gauntlet-confirmed Tier-B false-negatives across the Pro/Enterprise cloud auditors (1222 Azure KV legacy access-policy per-verb breadth + 2 anchor-drifts + drift-detector closure · 1021 GCP broad-but-not-full public firewall ranges · 1070 AWS KMS PendingDeletion key-policy audit · 1100 CodePipeline sticky approval-latch · 1024 GCP Storage bucket-enumeration truncation evidence-gap · 1040 CloudTrail data-events read-coverage caveat), each TDD'd + independently adversarially reviewed. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED. No change to the MCP tool/plugin schemas this skill documents.
+
+## 0.2.6 (2026-06-08) — Paired-release pin for EE 0.19.1 + CE 0.2.6 — Confirmed false-negative batch
+
+Paired no-op bump (knowledge-package version sync). EE 0.19.1 closes seven gauntlet-confirmed Tier-B false-negatives across the Pro/Enterprise cloud auditors (1030 AWS IAM prefix-glob privesc + access-key hygiene · 1150 SQS wildcard-Principal queue-policy audit · 1130 air-gapped KMS CreateGrant/GenerateDataKey · 1120 S3 versioned-bucket noncurrent-version disposal · 1080 Lambda deprecated/unknown-runtime currency · 1025 GCP OIDC-impersonation + WIF-provider admin-equivalence · 1160 VPC-endpoint sensitive-action service-namespace matching), each TDD'd + independently adversarially reviewed. Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED. No change to the MCP tool/plugin schemas this skill documents.
+
 ## 0.2.5 (2026-06-07) — Paired-release pin for EE 0.19.0 + CE 0.2.5 — No silent false-clean
 
-Paired no-op bump (SKILL.md version banner only; SKILL.md body + `references/plugins.md` UNCHANGED). EE 0.19.0 is the largest false-clean-class closure since the framework cycles: an un-scanned cloud region, a denied API call, or a logging-but-not-delivering trail can no longer read CLEAN at EITHER the compliance verdict OR the MCP `scan_cloud` transport. The shared `forEachRegion` fan-out (all 16 regional AWS plugins) now emits a per-region `region-scan-evidence-gap` LOW+evidenceGap finding for every errored/access-denied region — pre-fix an errored region was recorded in scanScope but emitted ZERO findings, so the findings-only compliance engine + the MCP summary saw it as CLEAN; class-O routing then fail-closes EXACTLY that source's native attested controls across all six frameworks (208 additive titlePattern anchors; matrices UNCHANGED at the count level). Four per-plugin swallow→gap retrofits: 1150 SQS/SNS region AccessDenied, 1022 Azure storage enumeration-error (SDK-absent soft-degrade vs real failure), 1200 GuardDuty `ListDetectors` AccessDenied no longer mis-classified as a definitive "NOT ENABLED" HIGH, and 1040 CloudTrail now reads `LatestDeliveryError` so a trail that is logging but failing to deliver to S3 is flagged HIGH. Plus two air-gapped/IAM criticals from the Mythos review (offline CVE matcher fails-CLOSED on distro/epoch/build-suffixed versions; plugin 1110 keeps HIGH on the AWS-default root-delegation key policy) and the EE AI-enrichment prompt no longer leaks the scan target (public IP/hostname/MAC/secrets) to the external LLM — every target host is anonymized to a deterministic `[target-N]` label and routed through CE's content-scrubber. No skill-logic change. **Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED** (SOC 2 + HIPAA + NIST CSF 2.0 + PCI DSS v4.0.1 + ISO 27001:2022 + CIS Controls v8). STAGED (pre-publish).
+Paired no-op bump (SKILL.md version banner only; SKILL.md body + `references/plugins.md` UNCHANGED). EE 0.19.0 is the largest false-clean-class closure since the framework cycles: an un-scanned cloud region, a denied API call, or a logging-but-not-delivering trail can no longer read CLEAN at EITHER the compliance verdict OR the MCP `scan_cloud` transport. The shared `forEachRegion` fan-out (all 16 regional AWS plugins) now emits a per-region `region-scan-evidence-gap` LOW+evidenceGap finding for every errored/access-denied region — pre-fix an errored region was recorded in scanScope but emitted ZERO findings, so the findings-only compliance engine + the MCP summary saw it as CLEAN; class-O routing then fail-closes EXACTLY that source's native attested controls across all six frameworks (208 additive titlePattern anchors; matrices UNCHANGED at the count level). Four per-plugin swallow→gap retrofits: 1150 SQS/SNS region AccessDenied, 1022 Azure storage enumeration-error (SDK-absent soft-degrade vs real failure), 1200 GuardDuty `ListDetectors` AccessDenied no longer mis-classified as a definitive "NOT ENABLED" HIGH, and 1040 CloudTrail now reads `LatestDeliveryError` so a trail that is logging but failing to deliver to S3 is flagged HIGH. Plus two air-gapped/IAM criticals from the Mythos review (offline CVE matcher fails-CLOSED on distro/epoch/build-suffixed versions; plugin 1110 keeps HIGH on the AWS-default root-delegation key policy) and the EE AI-enrichment prompt no longer leaks the scan target (public IP/hostname/MAC/secrets) to the external LLM — every target host is anonymized to a deterministic `[target-N]` label and routed through CE's content-scrubber. No skill-logic change. **Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED** (SOC 2 + HIPAA + NIST CSF 2.0 + PCI DSS v4.0.1 + ISO 27001:2022 + CIS Controls v8). Published + live on npm 2026-06-07 (61st trio).
 
 ## 0.2.4 (2026-06-05) — Paired-release pin for EE 0.18.3 + CE 0.2.4 — GCP IAM + Azure Key Vault false-negative hardening III
 

package/SKILL.md

@@ -16,7 +16,7 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.5 (post-EE 0.19.0 — No silent false-clean: per-region evidence-gap + class-O routing + swallow retrofits + air-gapped CVE/KMS criticals + AI-egress redaction) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
+> **Version:** 0.2.7 (post-EE 0.19.2 — Confirmed false-negative tail: 6 more cloud-auditor silent misses closed [1222 Azure KV per-verb breadth + anchor-drifts · 1021 GCP broad-public firewall · 1070 AWS KMS PendingDeletion · 1100 CodePipeline approval-latch · 1024 GCP Storage truncation gap · 1040 CloudTrail data-events read-coverage]) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
 
 NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
 plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",