Jovancoding/Network-AI

v5.12.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

agent-framework agent-orchestration ai-agents autogen blackboard blackboard-architecture

+14 more

crewai hermes hermes-agent langchain llm mcp multi-agent nemoclaw nodejs openclaw orchestration rlm typescript workflow-engine

Affected surfaces

auth rbac

Summary

AI summary

SkillSpector findings resolved and SKILL.md trigger hardening close security gaps.

Full changelog

v5.12.4 — SkillSpector triage, SKILL.md trigger hardening, Socket.dev scan gap

A hardening and triage release targeting ClawHub SkillSpector findings from v5.12.3 and a Socket.dev scan gap in the dual CJS+ESM build. No breaking changes; all 3,269 tests across 33 suites pass.

Security

SkillSpector findings resolved. Added .clawignore to exclude comment.txt from ClawHub packages — the file (an in-progress draft note) was inadvertently included in 5.12.3 via clawhub publish . and its McpStreamableServer bridge-pattern description triggered Description-Behavior Mismatch (High, 93%) and Context-Inappropriate Capability (Medium, 88%) findings.
SKILL.md trigger hardening. Replaced the broad "When to Use This Skill" bullet list with explicit Use/Do-NOT-Use sections, resolving Vague Triggers (Medium, 81%). Shell execution, agent spawning, and MCP server startup are now explicitly called out as out-of-scope for the Python skill bundle.

Changed

Socket.dev triage gap closed. Added 9 missing entries from the 5.12.3 scan: declaration-file false positives (dist/adapters/a2a-adapter.d.ts, dist/lib/approval-inbox.d.ts), three ESM adapter mirrors (aps-adapter.js, hermes-adapter.js, rlm-adapter.js), and four shell-access entries for example and bootstrap scripts. networkAccess 59 → 64, shellAccess 6 → 10.

Install

npm install [email protected]

Security Fixes

.clawignore added to exclude comment.txt, resolving Description-Behavior Mismatch (High) and Context-Inappropriate Capability (Medium).
SKILL.md trigger hardening replaced vague bullet list with explicit Use/Do‑NOT‑Use sections, fixing Vague Triggers (Medium) and clarifying out‑of‑scope operations.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Jovancoding/Network-AI

Get notified when new releases ship.

About Jovancoding/Network-AI

Multi-agent orchestration MCP server with race-condition-safe shared blackboard. 20+ MCP tools: blackboard read/write, agent spawn/stop, FSM transitions, budget tracking, token management, and audit log query. `npx network-ai-server --port 3001`.

All releases →