This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryFixed display name mislabeling in ClawHub and clarified audit‑log privacy note.
Full changelog
## What's changed
Fixed
- SkillSpector YARA
agent_skill_mcp_tool_poisoning_metadata— Reworded the audit-log privacy note inSKILL.mdthat was triggering the exfiltration sub-rule. No functional change; VirusTotal 64/64 clean. - CodeQL
js/redundant-operation(alert #178) — Split an&&-chained double-call toRetryBudget.tryConsume()intest-phase15.tsinto two explicit assertions. - ClawHub display name — Corrected to "Network-AI" (a temp staging directory name leaked as the display name in the first patch publish).
Added
npm run clawhub:publish— New publish script (scripts/clawhub-publish.js) that automates the ClawHub staging workaround required since CLI v0.23+. Reads version fromskill.json, pulls git provenance automatically, always publishes with--name "Network-AI", and cleans up after itself.npm run clawhub:publish npm run clawhub:publish -- --changelog "what changed" npm run clawhub:publish -- --dry-run
Patch release — no API or behaviour changes. All 3,373 tests pass.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Jovancoding/Network-AI
Multi-agent orchestration MCP server with race-condition-safe shared blackboard. 20+ MCP tools: blackboard read/write, agent spawn/stop, FSM transitions, budget tracking, token management, and audit log query. `npx network-ai-server --port 3001`.
Related context
Beta — feedback welcome: [email protected]