Skip to content

v0.3.2 — Hardening + Marketplace-Readiness

Choose a tag to compare

View all tags
@maxschottke-spec maxschottke-spec released this 22 May 14:16
· 38 commits to main since this release
v0.3.2
af65676
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is the version to install for the marketplace-ready, externally-reviewed plugin.

/plugin marketplace add maxschottke-spec/seo-survival-kit#v0.3.2
/plugin install seo-rescue@seo-survival-kit

What changed since v0.3.1

12 PRs across two parallel tracks landed in this cycle: a security hardening sprint driven by an external audit, plus a marketplace-readiness pass rewriting positioning and disclaimers. See CHANGELOG.md for the full per-section breakdown.

Highlights — security hardening

  • lib/safe.js gained three new helpers — safeHostname, safeUrl (SSRF + cloud-metadata guard against 169.254.169.254 / RFC1918 / loopback / .local / IPv6 ::1), safeLabel. validateConfigTargets now covers domain + host + label (previously only slug).
  • sanitize() defense against indirect prompt injection via scraped third-party HTML — 12 imperative-pattern matchers, length caps per field, type coercion. Adversarial test passes 17/17 (10 attack strings caught, 7 legitimate marketing phrases preserved).
  • allowed-tools declared per skill — Pure-Markdown framework skills get [Read, Grep, Glob]; script-runners get [Read, Write, Bash(node:*), Bash(curl:*)] plus narrower extensions per skill. Bounds the blast radius of any prompt-injection chain.
  • Routing-safety section in the rescue orchestrator — codifies that sub-skill routing decisions come from the initial user message, never from tool-output content.
  • .gitignore + PSI API-key dual-path closed — user-supplied configs (audit-config.json, psi-config.json, channels.json) + runtime working dirs (data/, psi-history/, *.ndjson) are ignored; psi-fetch.example.js hard-fails if api_key is found in the config file.
  • SSRF + path-traversal fixes in psi-fetch.example.js (URL allowlist), channel-economics.example.js (safeSlug for channel names), competitor-deep-audit.example.js (safeHostname for process.argv[2]).
  • CI workflow hardening — SHA-pinned actions/checkout + actions/setup-node, permissions: contents: read, persist-credentials: false, find -print0 | while read -d '' instead of shell-interpolated for f in \$(find …). js-yaml@4 dependency replaced with an inline regex frontmatter validator. CI runtime supply chain bounded to the two SHA-pinned actions.

Highlights — marketplace-readiness

  • README rewritten for marketplace tone — lead-generation framing replaced with sachliche When to use / When not to use sections + YMYL notice.
  • Public-Beta status prominent at top; single-maintainer / bus-factor-1 / no-SLA disclosure at bottom.
  • Naming clarification table — repository (seo-survival-kit) vs plugin (seo-rescue) vs slash-command-prefix (/seo-rescue:...).
  • claims-vs-observations softening — recovery percentages and AI-citation lead-time claims reframed as observations from a small case-base, not predictions.
  • channel-economics fee-table disclaimer — fees are Q1 2026 starting estimates that vary by category / tier / region / fulfillment; verify against current seller agreements.

Highlights — docs + infra

  • Two-round external security review documented in SECURITY.md (Round 1: external reviewer with gitleaks/trivy/semgrep + 4 parallel domain-subagent analysis; Round 2: maintainer-driven senior-engineering + marketplace-reviewer audit with gitleaks/trufflehog/semgrep + manual senior-eng re-read). Verdict: SAFE TO PUBLISH.
  • For-external-reviewers section in SECURITY.md — anti-hallucination guardrails for LLM-assisted reviewers ([VERIFIED] / [PROBABLE] / [UNVERIFIED] labels, mandatory file:line citations, copy-paste system prompt for free-tier LLMs).
  • Cross-platform env-var reference in ONBOARDING.md — explicit table covering all five env-var overrides (CHROME_PATH, SEO_CACHE_DIR, SEO_PDF_OUTPUT_DIR, SEO_AUDIT_CONFIG, PSI_CONFIG) with per-OS defaults + PowerShell snippet for the Windows chmod 600 equivalent (NTFS ACL).
  • "Already in production use" section in MATURITY.md — explicit about what "in use" means (active pilot-domain recovery since March 2026, real cold-outreach prospects served) vs what it doesn't (no external users, no SLA).
  • Contributors section in README.md crediting the external security reviewer.
  • Dependabot, CODEOWNERS, branch protection all live on main.

Compatibility

No breaking API or skill-frontmatter changes vs v0.3.1. Existing installs continue to work; v0.3.2 makes the same plugin's defaults safer and its positioning cleaner. The plugin remains MIT, zero npm runtime dependencies, no postinstall hooks.

Acknowledgments

External security review by @kamehamea-art (Jeronzo) drove the entire v0.3.x security sprint. See SECURITY.md → External security reviews for the full audit trail.

Assets 2
Loading