Wuyun v0.3.0

Wuyun v0.3.0

Productization release for security-focused skill workflows.

Added

• New wuyun-skill-security-audit companion for passive third-party Skill/MCP/plugin/agent-instruction security review.
• New wuyun-supply-chain-audit companion for CI/CD, dependency, scanner-output, and language-pack triage.
• Machine-readable skill catalog.json / index.json plus wuyun catalog --check.
• Normalized finding schema and export-findings for JSON, SARIF 2.1.0, Markdown, and HTML.
• Diff-aware pr-review helper and GitHub Actions artifact workflow.
• External scanner adapter for Semgrep, Gitleaks, Trivy, npm audit, pip-audit, and generic JSON.
• Language-pack mapper for Node/Next.js, Python, Java/Spring, Go, Rust, C/C++, mobile, and smart contracts.
• Synthetic benchmark suite covering skill security, supply chain, language packs, PR review, finding export, and catalog validation.
• Codex and Claude plugin manifests with a skills/ symlink compatibility layout.

Validation

• validate_skill.py .: PASS
• run_eval.py .: PASS 21 / FAIL 0
• benchmark_suite.py --suite all: PASS 6 / FAIL 0
• quality_gate.py . --skip-preflight: PASS
• Codex installed-skill eval: PASS 21 / FAIL 0

Wuyun v0.2.2

Wuyun v0.2.2

Focused usability release for installation and release visibility.

• Added wuyun_cli.py version / version --json to show package version, install source, install metadata path, bundled skill count, and skill list.
• The command works in both local checkout mode and installed Codex/Claude skill directories by reading VERSION or .wuyun-install.json.
• Added offline regression coverage for version/source/skill-list visibility.
• Updated README fixed-release install examples and useful CLI commands.

Install fixed release:

curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash -s -- --version v0.2.2

Wuyun v0.2.1

Wuyun v0.2.1

Focused usability release for wuyun-redteam-ops.

• Added purple_team_mapper.py / wuyun_cli.py purple-map to convert local red-team plans, attack matrices, and artifacts into purple-team detection/remediation workstreams.
• Added references/purple-team-detection.md with safe telemetry, detection objective, emulation, remediation, and retest mapping guidance.
• Expanded offline regression eval so red-team coverage now verifies plan generation, attack-path matrixing, and purple-team coverage mapping.
• Updated README fixed-release install examples and package VERSION to 0.2.1.

Install fixed release:

curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash -s -- --version v0.2.1

Wuyun v0.2.0

Wuyun v0.2.0

• Added wuyun-redteam-ops for authorized red-team / purple-team planning, rules-of-engagement tracking, attack-path matrices, safe validation steps, detection opportunities, and remediation/retest loops.
• Added redteam-plan and attack-matrix helper CLIs plus unified wuyun_cli.py routing.
• Added release version recording via VERSION and installer package_version metadata.
• Expanded offline regression eval to cover red-team helpers and fast --help smoke tests for all Wuyun helper CLIs.
• Fixed slow/hanging --help behavior in runtime/protocol helpers by lazy-loading asyncio only for execution paths.

Install fixed release:

curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash -s -- --version v0.2.0

Wuyun v0.1.0

Wuyun v0.1.0

First public release of Wuyun: a vulnerability research Skill suite for AI coding agents.

Wuyun helps security researchers and defensive teams route AI-assisted audit work across source-code review, Web/API testing, cloud security analysis, frontend JavaScript reverse engineering, protocol analysis, authentication review, LLM/RAG/Agent security, recon planning, and CTF/lab research.

Highlights

• Skill Router entrypoint: call $wuyun and describe the task, then route to the relevant companion workflow.
• Multi-platform installation flow for Codex and Claude-style skill environments.
• Web/API audit workflow for authorized application security review.
• JavaScript reverse engineering and deobfuscation workflows for API discovery, signing logic, WASM, and browser runtime analysis.
• Authentication review workflow for JWT, OAuth, SAML, sessions, and tenant authorization risks.
• AI security workflow for LLM, RAG, Agent, and prompt-injection assessment.
• Recon, protocol, cloud, and CTF/lab workflows for structured defensive research.

Install

curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash

Install for one platform only:

curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash -s -- --target codex
curl -fsSL https://raw.githubusercontent.com/Aimer-zero/wuyun/main/install.sh | bash -s -- --target claude

Notes

Wuyun is intended for lawful security research, authorized code auditing, CTF/lab work, and defensive security activities. Do not use it for illegal, abusive, or out-of-scope testing.