Jovancoding/Network-AI

v5.12.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent-framework agent-orchestration ai-agents autogen blackboard blackboard-architecture

+14 more

crewai hermes hermes-agent langchain llm mcp multi-agent nemoclaw nodejs openclaw orchestration rlm typescript workflow-engine

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Fixed the root cause of recurring SkillSpector security findings and added a pre‑publish bundle guard to prevent secret leakage.

Full changelog

What's changed

This release fixes the root cause behind the recurring NVIDIA SkillSpector findings on ClawHub and adds an automated guard so the same class of issue is caught before publishing — not after.

Security

Recurring SkillSpector finding fixed at the source. The repeating Description-Behavior Mismatch / Context-Inappropriate Capability findings against McpStreamableServer were caused by comment.txt (a draft GitHub-issue note describing the optional HTTP MCP server and its 22 tools) being bundled into the published ClawHub skill. The v5.12.4 attempt to exclude it added the file to .clawignore, but the ClawHub CLI honours .clawhubignore — not .clawignore, and not .gitignore. The exclusion has been moved to the correct file.
Additional bundle leaks closed, including scripts/*.js, four newer docs, glama.json / Dockerfile / .mcp.json / tsconfig.esm.json, several stray directories, and — most importantly — data/ (audit log, grant tokens, signing key), .env, .env.* and *.log.

Added

scripts/clawhub-check.js + npm run clawhub:check — a bundle-hygiene guard that parses .clawhubignore, replicates the exclusion ClawHub applies, and asserts the surviving file set equals the intended Python-skill allowlist. It hard-fails on secrets/logs and on any unexpected file or directory. On its first run it immediately caught data/ leaking into the bundle.

Changed

SKILL.md — the two McpStreamableServer SkillSpector rows are now marked Resolved with the real root cause and the new guard documented as the durable control.
RELEASING.md — Step 9 now runs npm run clawhub:check and requires a PASS before clawhub publish.
Version bump 5.12.6 → 5.12.7.

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md

Security Fixes

Fixed recurring SkillSpector 'Description-Behavior Mismatch' / 'Context-Inappropriate Capability' findings caused by inclusion of `comment.txt`, `data/`, `.env*`, and log files in the published skill bundle.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Jovancoding/Network-AI

Get notified when new releases ship.

About Jovancoding/Network-AI

Multi-agent orchestration MCP server with race-condition-safe shared blackboard. 20+ MCP tools: blackboard read/write, agent spawn/stop, FSM transitions, budget tracking, token management, and audit log query. `npx network-ai-server --port 3001`.

All releases →