mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
Daniel Avila
6c5b5ff1f1
Integrate NVIDIA's SkillSpector static analyzer (Apache-2.0) to scan AI agent skills under cli-tool/components/skills/ for security issues (prompt injection, data exfiltration, supply chain, dangerous code, etc.). - scripts/skillspector_scan.py: batch orchestrator that discovers skill dirs (by SKILL.md), runs `skillspector scan --no-llm --format json` on each, and aggregates results into a Markdown PR report + SARIF log. Tolerates per-skill scan failures and the CLI's non-zero exit on high scores without aborting the batch. - skill-security-scan.yml (PR): scans only changed skills, posts an idempotent report comment, and blocks on HIGH/CRITICAL (score > 50). - skill-security-scan-all.yml (weekly + manual): scans all skills, reports to run summary and SARIF, never blocks. - CLAUDE.md: document the scanning workflow. Co-authored-by: Claude <noreply@anthropic.com>
65 lines
1.7 KiB
YAML
65 lines
1.7 KiB
YAML
name: Skill Security Scan (Full)
|
|
|
|
# Scans EVERY skill component with SkillSpector (NVIDIA, Apache-2.0) static
|
|
# analysis. Runs weekly and on demand. Reports only — never blocks. Uploads
|
|
# an aggregated SARIF to code scanning and a Markdown summary to the run.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '0 6 * * 1' # Mondays 06:00 UTC
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
skill-scan-all:
|
|
name: SkillSpector (all skills)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install SkillSpector
|
|
run: pip install "git+https://github.com/NVIDIA/skillspector.git@main"
|
|
|
|
- name: Run SkillSpector on all skills
|
|
id: scan
|
|
continue-on-error: true
|
|
run: |
|
|
python scripts/skillspector_scan.py \
|
|
--all \
|
|
--threshold 50 \
|
|
--output-md skillspector-report.md \
|
|
--output-sarif skillspector.sarif
|
|
|
|
- name: Publish summary
|
|
if: always()
|
|
run: cat skillspector-report.md >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Upload report artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: skillspector-full-report
|
|
path: |
|
|
skillspector-report.md
|
|
skillspector.sarif
|
|
retention-days: 90
|
|
|
|
- name: Upload SARIF to code scanning
|
|
if: always()
|
|
continue-on-error: true
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: skillspector.sarif
|
|
category: skillspector-full
|