Integrate NVIDIA's SkillSpector static analyzer (Apache-2.0) to scan
AI agent skills under cli-tool/components/skills/ for security issues
(prompt injection, data exfiltration, supply chain, dangerous code, etc.).
- scripts/skillspector_scan.py: batch orchestrator that discovers skill
dirs (by SKILL.md), runs `skillspector scan --no-llm --format json` on
each, and aggregates results into a Markdown PR report + SARIF log.
Tolerates per-skill scan failures and the CLI's non-zero exit on high
scores without aborting the batch.
- skill-security-scan.yml (PR): scans only changed skills, posts an
idempotent report comment, and blocks on HIGH/CRITICAL (score > 50).
- skill-security-scan-all.yml (weekly + manual): scans all skills,
reports to run summary and SARIF, never blocks.
- CLAUDE.md: document the scanning workflow.
Co-authored-by: Claude <noreply@anthropic.com>
Daniel Avila