mirror of
https://github.com/auth0/agent-skills.git
synced 2026-09-19 02:38:28 +08:00
Kailash B
ad84d0a578
* chore: add snyk-agent-scan workflow for skill security scanning * chore: add snyk-agent-scan workflow and resolve scan findings - Add GitHub Actions workflow for scanning skills on PRs and main - Add scan_all_skills.sh for local full scans - Add check_snyk_findings.py with skill-scoped ignore support - Fix auth0-java-mvc-common and auth0-expo credential handling - Fix auth0-cli to use env vars instead of literal secrets - Add ignore entries for first-party Auth0 URLs (W012) * chore: remove auth0-cli changes already merged via PR #85 * chore: add missing skills to snyk-agent-scan ignore entries * chore: split snyk-agent-scan into one job per skill Use a matrix strategy so each skill gets its own CI job, improving failure reporting visibility in the GitHub Actions UI. * chore: use skill path as matrix job name for clarity * Revert "chore: use skill path as matrix job name for clarity" This reverts commit 6dbaa88fb96a3afbc68201190fc8f1a2dd750236. * Revert "chore: split snyk-agent-scan into one job per skill" This reverts commit be9a74de9a87069d613f4a14e63d98c86506a345. * Updates .snyk-agent-scan-ignore.json to allow accessing Auth0 URLs in the skills * Chore/snyk agent scan refactor (#97) * Consolidate GitHub releases API entries using url_pattern * Drop skills field from entries to match any skill * Ignores W012 for HomeBrew install script and CloudFlare MCP access on auth0-custom-domains * Update trigger for snyk-agent-scan * Update malformed link in snyk-agent-scan-ignore * Address review comments --------- Co-authored-by: Frederik Prijck <frederik.prijck@okta.com>
41 lines
1.0 KiB
Bash
Executable File
41 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SNYK_AGENT_SCAN_VERSION="${SNYK_AGENT_SCAN_VERSION:-0.5.1}"
|
|
|
|
SKILL_DIRS=$(find plugins/*/skills -maxdepth 1 -mindepth 1 -type d 2>/dev/null | sort)
|
|
|
|
if [ -z "$SKILL_DIRS" ]; then
|
|
echo "No skills found"
|
|
exit 0
|
|
fi
|
|
|
|
scan_skill() {
|
|
local skill_file="$1"
|
|
local skill_name="$2"
|
|
|
|
uvx "snyk-agent-scan@${SNYK_AGENT_SCAN_VERSION}" "$skill_file" --skills --json 2>/dev/null \
|
|
| tee "snyk-agent-scan-skill-${skill_name}.json" \
|
|
&& return 0
|
|
|
|
echo "Retrying ${skill_name} in 5s..."
|
|
sleep 5
|
|
|
|
uvx "snyk-agent-scan@${SNYK_AGENT_SCAN_VERSION}" "$skill_file" --skills --json 2>/dev/null \
|
|
| tee "snyk-agent-scan-skill-${skill_name}.json"
|
|
}
|
|
|
|
EXIT_CODE=0
|
|
while IFS= read -r skill_dir; do
|
|
skill_file="${skill_dir}/SKILL.md"
|
|
if [ -f "$skill_file" ]; then
|
|
skill_name=$(echo "$skill_dir" | tr '/' '-')
|
|
echo "Scanning ${skill_dir}..."
|
|
scan_skill "$skill_file" "$skill_name" || EXIT_CODE=1
|
|
else
|
|
echo "Skipping (no SKILL.md): ${skill_dir}"
|
|
fi
|
|
done <<< "$SKILL_DIRS"
|
|
|
|
exit $EXIT_CODE
|