Skip to content

v0.8.1 — security + hardening

Latest
Latest

Choose a tag to compare

View all tags
@jdrhyne jdrhyne released this 24 Jun 22:35
v0.8.1
This tag was signed with the committer’s verified signature.
jdrhyne Jonathan Rhyne
SSH Key Fingerprint: EBVJLx1VDIYeCZQ6X2EtBUUCW/CHsJmVlEwy6NXDArQ
Verified
Learn about vigilant mode.
8c8636e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security and hardening release from an internal adversarial audit. No detection-behavior changes — the same skills produce the same trust reports (224-sample benchmark byte-identical, F1 0.8425).

Security

  • Fixed a ReDoS vulnerability class — a crafted 2 MB skill took ~104 s to scan (O(n²) catastrophic backtracking). ~90 open-ended regex scans bounded to fixed line windows, the HTML-comment detector rewritten to a linear scan, and a structural guard added against reintroduction. Flagged patterns now <180 ms.
  • Patched the shipped dependency tree — pnpm audit --prod is 0 high / 0 critical.

Added

  • CI pipeline (typecheck + lint + test + action-bundle-diff + pnpm audit --prod) gating every PR, plus a version-matched tag-anchored publish job.
  • 314 tests — direct verdict-path, SSRF (IPv4/hostname/DNS), golden-fixture, and ReDoS regression tests.

Changed

  • Behavior-preserving refactors: shared score-util.ts, data-driven inferCapabilities.

Pin the GitHub Action at agentverus/agentverus-scanner/actions/scan-skill@v0.8.1. The companion agentverus-scanner-mcp@0.1.2 depends on ^0.8.0 and resolves to this release automatically.

Full notes: CHANGELOG.md

Assets 2
Loading