v3.1.3 — Security Hardening + ClawHub Verified

[Jovancoding]

Security

• Path traversal fix in scripts/blackboard.py — change_id validated with regex whitelist (^[a-zA-Z0-9_\-\.]+$) and resolved path boundary checks
• Blocks both Unix (../../etc/passwd) and Windows (..\windows\system32) traversal attacks
• Applied to propose_change, validate_change, commit_change, abort_change, and archive paths
• Found by VirusTotal during ClawHub security scan

ClawHub Compliance

• Removed node from requires.bins — bundle ships only Python scripts
• Added validate_token.py documentation to SKILL.md (was shipped but undocumented)
• Sanitized capability terms in Security Considerations section
• ClawHub scan: Benign (VirusTotal 0/64)

Distribution

Channel	Version	Status
npm	npm install network-ai@3.1.3	✅ Live
ClawHub	clawhub install network-ai	✅ Live (Benign)
GitHub	v3.1.3	✅ Tagged

Tests

• 251 tests passing (139 adapter + 79 standalone + 33 security)
• Zero regressions

Full Changelog: v3.1.0...v3.1.3

---

This discussion was created from the release v3.1.3 — Security Hardening + ClawHub Verified.