All tunables are Schemastery Config fields (changeable from cordis.yml). provider/cordis.patch.yml documents each key inline.

Key	Default	Meaning
`language`	`zh`	Edition to publish: the Chinese `skills/` or the English `skills-en/`; ignored when `skillsDir` is set
`watch`	`false`	Watch the packaged skills directory (static content, so disabled)
`skillsDir`	(unset)	Explicit skills root; overrides the `language`-derived default and must hold `/SKILL.md` bundles
`vet.enable`	`true`	Register the `plugin_vet` gate tool
`vet.timeoutMs`	`15000`	Tarball-fetch timeout in ms
`vet.maxFiles`	`800`	Scan file cap
`vet.maxFileBytes`	`262144`	Per-file byte cap
`vet.maxExtractBytes`	`67108864`	Extraction byte cap
`vet.maxDepNodes`	`600`	Dependency-tree node cap
`vet.maxFindingsPerCheck`	`12`	Findings cap per check
`vet.dataResponsibility`	`true`	Run the data-responsibility review (disable per deployment)
`vet.externalScanners`	`true`	Orchestrate `osv-scanner`/`npm audit` when their CLIs are present; `false` forces the built-in self-computed dependency scan
`vet.userAgent`	`dsh-skill-pack-security/2.2.17 (+https://github.com/PerryLink/dsh-skill-pack-security)`	Fetch user-agent
`vet.gate.policy`	`warn`	Install gate: `warn` (non-blocking) or `deny` (block on FAIL)

dsh-skill-pack-security

安装