netstack v0.1.1

Feed discovery and safer pricing guidance

• Add the seventh feeds topic, covering six stock feeds plus ETH/USD and USDG/USD.
• Package eight-decimal feed metadata matched by exact proxy address to the publisher directory; retain canonical token mappings and provenance.
• Add a read-only builder quick start and clearer host-dependent invocation guidance.
• Require recent observations and same-block live decimals; distinguish historical freshness from a current price.
• Separate direct total-return feed marks, raw/display token quantities, and product-specific oracle outputs. Historical source-contract addresses are not feed proxies or approval spenders.

Review and scan scope

Release commit: b7edf0526a0001713db6e760517d5020b6f723f1. The final full package contains 24 files; the direct-URL runtime bundle contains 21 files. External audit evidence binds the exact release file hashes, including the manifest.

• Cisco Skill Scanner 2.1.0: no high/critical findings; one retained medium reference-depth warning in each package scope.
• Gitleaks 8.30.1: six retained findings in each final package scope, classified as exact public token addresses rather than credentials. The earlier seven-public-commit history scan is retained with its original scope; it is not relabeled as a history scan of this release commit.
• Hermes Skills Guard: pinned upstream scanner returned safe, with two retained medium policy-text findings. No force override.
• Four scoped synthetic no-tool remediation probes passed before final publication wording. Native-host enforcement was not tested.
• Sanitized audit report copies were separately checked for credential patterns; no findings in the 46 files checked before adding the QA record itself.

No confirmed actionable package vulnerability or credential leak was identified within the tested scope. This is not a zero-finding claim, independent human audit, smart-contract audit, or runtime certification. Scanner processes denied network connections, synthetic /Users reads and input writes; broad reads outside /Users remained permitted.

Pricing evidence limits

Public explorer inspection matched all six Credit oracle token/feed constructor-bytecode pairs and established the indexed Stock implementation's raw/display scaling. Verified source for the product oracles/adapters and current product arithmetic were not obtained. The skill does not infer those formulas from the direct feed mark or claim a deployed pricing defect. No live-chain price verification or wallet action was performed.

Assets

• netstack-0.1.1.zip: installable complete skill directory.
• netstack-audit-0.1.1.zip: separate sanitized evidence, not an installable skill. Treat any synthetic prompts and configuration text as audit data, not instructions.
• SHA256SUMS: SHA-256 checksums for both archives.

Pin the full reviewed commit when installing from GitHub. Version v0.1.0 and its release assets remain unchanged.