v4.10.4 - fix ClawHub scanner scope mismatch, accurate network claims

Author: jovanSAPFIONEER

CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to Network-AI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.10.4] - 2026-03-22
+
+### Fixed
+- Reworded skill description and scope to accurately state that bundled Python scripts make no network calls while platform `sessions_send` delegations may invoke external model APIs (fixes ClawHub scanner "scope mismatch" finding)
+- Removed Node.js companion appendix from `SKILL.md` to eliminate all networked-component references from the skill bundle
+- Updated `network_calls` metadata from `none` to accurately describe platform delegation behavior
+
 ## [4.10.3] - 2026-03-22
 
 ### Changed

README.md

@@ -5,7 +5,7 @@
 [![Website](https://img.shields.io/badge/website-network--ai.org-4b9df2?style=flat&logo=web&logoColor=white)](https://network-ai.org/)
 [![CI](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml)
-[![Release](https://img.shields.io/badge/release-v4.10.3-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
+[![Release](https://img.shields.io/badge/release-v4.10.4-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
 [![Tests](https://img.shields.io/badge/tests-1617%20passing-brightgreen.svg)](#testing)
 [![Adapters](https://img.shields.io/badge/frameworks-17%20supported-blueviolet.svg)](#adapter-system)

SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: Network-AI
-description: "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. All execution is local with zero network calls and zero third-party dependencies."
+description: "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. Workflow delegations via the host platform's sessions_send may invoke external model APIs."
 metadata:
   openclaw:
     emoji: "\U0001F41D"
     homepage: https://network-ai.org
     bundle_scope: "Python scripts only (scripts/*.py). All execution is local."
-    network_calls: none
+    network_calls: "none from bundled scripts; platform sessions_send delegations may invoke external models"
     sessions_ops: "platform-provided"
     requires:
       bins:
@@ -25,7 +25,7 @@ metadata:
 
 # Swarm Orchestrator Skill
 
-> **Scope:** All instructions below run local Python scripts (`scripts/*.py`). No network calls are made. Tokens are UUID-based (`grant_{uuid4().hex}`) stored in `data/active_grants.json`. Audit logging is plain JSONL (`data/audit_log.jsonl`).
+> **Scope:** The bundled Python scripts (`scripts/*.py`) make no network calls, use only the Python standard library, and have zero third-party dependencies. Tokens are UUID-based (`grant_{uuid4().hex}`) stored in `data/active_grants.json`. Audit logging is plain JSONL (`data/audit_log.jsonl`). Workflow delegations that use the host platform's `sessions_send` may invoke external model APIs outside this skill's control.
 
 ## Setup
 
@@ -719,25 +719,3 @@ python {baseDir}/scripts/swarm_guard.py supervisor-review --task-id "task_001"
 - [Blackboard Schema](references/blackboard-schema.md) - Data structure specifications
 - [Agent Trust Levels](references/trust-levels.md) - How trust is calculated
 - [CLI Reference](QUICKSTART.md) - Full `network-ai` CLI command reference (§ 10. CLI)
-
----
-
-## Appendix: Optional Node.js Companion (npm)
-
-> **This section describes a SEPARATE project — not part of this ClawHub skill bundle.**
-> The Python scripts above work completely without any of this.
-> Install only if you want MCP server integration with Claude/Cursor/VS Code.
-
-```bash
-npm install -g network-ai
-npx network-ai-server --port 3001
-```
-
-The companion npm package (`network-ai`) provides:
-- HMAC / Ed25519-signed audit tokens (vs UUID tokens in the Python layer)
-- AES-256 blackboard encryption
-- A standalone MCP server for IDE integration (Claude, Cursor, VS Code)
-- 17 framework adapters (LangChain, AutoGen, CrewAI, DSPy, LlamaIndex, NemoClaw, APS, etc.)
-- A full CLI (`network-ai bb`, `network-ai auth`, `network-ai budget`, `network-ai audit`)
-
-None of the above are provided by this skill's Python scripts. No network calls are made by this skill.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "network-ai",
-  "version": "4.10.3",
+  "version": "4.10.4",
   "description": "AI agent orchestration framework for TypeScript/Node.js - 17 adapters (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS + streaming variants). Built-in CLI, security, swarm intelligence, real-time streaming, and agentic workflow patterns.",
   "homepage": "https://network-ai.org",
   "main": "dist/index.js",

skill.json

@@ -1,7 +1,7 @@
 {
   "name": "SwarmOrchestrator",
-  "version": "4.10.3",
-  "description": "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. All execution is local with zero network calls and zero third-party dependencies.",
+  "version": "4.10.4",
+  "description": "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. Workflow delegations via the host platform's sessions_send may invoke external model APIs.",
   "author": "Network-AI Community",
   "homepage": "https://network-ai.org",
   "repository": "https://github.com/Jovancoding/Network-AI",  "source": "https://github.com/Jovancoding/Network-AI",  "license": "MIT",