dsgai_scanner_tool: v0.2 — fix critical defects, add obfuscation modes, CI integrations

[emmanuelgjr]

Summary

v0.1 had two critical defects that prevented documented use:

• Install instructions referenced GenAIDataSecurity.md / /GenAIDataSecurity but the actual file was dsgai_scanner_tool.md (so the literal install commands failed)
• 6 of the 21 promised DSGAI control scans had no pattern blocks defined (DSGAI08, 09, 10, 16, 17, 19)

This PR fixes both, hardens privacy guarantees, narrows noisy patterns, and ships CI integrations.

Highlights

🛡️ Strict-by-default obfuscation

• Two modes: STRICT (filename + line only — default) and INTERNAL (--internal — full paths for team use)
• New VALUE-BEARING SCAN PROTOCOL (V1–V6) — matched secret values never enter the report, the on-disk checkpoint, or any persistent tool call
• Defense-in-depth secret sweep applied even on STRUCTURAL evidence
• DSGAI-scan.json schema pinned to forbid match_text / content fields

✅ All 21 controls now have scan blocks

Added DSGAI08 (Regulatory Compliance), 09 (Multimodal), 10 (Synthetic Data), 16 (IDE Plugin), 17 (Resilience), 19 (Data Labeling).

🏢 VENDOR ATTESTATION REQUIRED status

New finding status for BUY-tagged controls and BUY portions of BOTH. Each generates a callout listing specific vendor attestations to request (SOC 2, DPA, training data retention policy, abuse detection docs).

🔧 Pattern correctness

• Engine-neutral PCRE; documented prerequisite at top of Step 2
• Narrowed: P01.4 (dp libs — escaped dots), P02.7 (vault — was matching everywhere), P04.4 (version operators — ^= wasn't valid), P11.1 (vector queries — was matching every .query()), P20.5 (inference endpoints — last branch was useless)

📡 CVE enrichment fixed

• NVD severity filter corrected (one value per call, not duplicate param)
• GitHub Advisory uses affects=<pkg> filter (was fetching unfiltered feed)
• Go ecosystem added to OSV queries
• MITRE ATLAS split from CVE sources into its own subsection (it's attack techniques, not CVEs)
• Rate-limit handling and API-key support documented

🚀 New distribution surfaces

• GitHub Action (integrations/dsgai-scan.yml) — PR comment with FAIL/WARN/PASS/Vendor/Exploitable CVE counts, artifact upload, optional fail-on-findings. Uses correct Claude Code CLI flags (claude -p + --dangerously-skip-permissions).
• Pre-commit hook (integrations/pre-commit-hook.md + dsgai-secret-scan.sh) — sub-second DSGAI02 secret block before commit. Three install paths (pre-commit framework, plain git hook, Husky) — all delegate to one shared script.
• Plain-prompt variant (dsgai_scanner_prompt.md) — tool-neutral version for Cursor, Copilot Chat, ChatGPT, Gemini.

🆕 New flags

• --internal — full paths for team-internal use
• --no-cve — fully offline / air-gapped mode
• --scope <path> — restrict to a sub-directory (monorepos)
• All combinable: /dsgai_scanner_tool --internal --no-cve --scope services/ai-gateway/

📚 Documentation

• YAML frontmatter (description, argument-hint, allowed-tools)
• TL;DR quick-reference table
• Known Limitations section (honest disclosure of what static scanning can't catch)
• Tier badges explainer (T1/T2/T3 colors and examples)
• Mermaid flow diagram in README
• Badges (OWASP, framework, version, license)
• Fixed "Based On" URL (was pointing to OWASP Top 10 for LLM, now correctly points to DSGAI 2026 resource page)

Files changed

File	Change
dsgai_scanner_tool/dsgai_scanner_tool.md	Rewritten (1296 lines, 81 KB)
dsgai_scanner_tool/DSGAI_README.md	Rewritten (419 lines, 21 KB)
dsgai_scanner_tool/dsgai_scanner_prompt.md	NEW — plain-prompt variant
dsgai_scanner_tool/CHANGES_v0.2.md	NEW — release notes
dsgai_scanner_tool/integrations/dsgai-scan.yml	NEW — GitHub Action
dsgai_scanner_tool/integrations/dsgai-secret-scan.sh	NEW — shared pre-commit script
dsgai_scanner_tool/integrations/pre-commit-hook.md	NEW — install recipes

DSGAI-samplereport.png is intentionally left untouched.

Test plan

• Verified all 21 DSGAI control definitions still present with unchanged risk descriptions
• Verified all 21 scan pattern blocks now defined (was 15 in v0.1)
• Verified VALUE-BEARING protocol documented end-to-end across skill + README + plain prompt
• Verified GitHub Action uses real Claude Code CLI flags (claude -p, --dangerously-skip-permissions)
• Verified pre-commit hook handles paths with spaces (git diff -z + mapfile -d '')
• Verified README Mermaid diagram renders
• Verified all install paths reference dsgai_scanner_tool.md (not the v0.1 phantom filename)
• Manual smoke test: run /dsgai_scanner_tool against a known-good LangChain sample repo after merge
• Manual smoke test: trigger the GitHub Action via workflow_dispatch after merge

See dsgai_scanner_tool/CHANGES_v0.2.md for the full audit trail of fixes.

🤖 Generated with Claude Code