Daniel Avila 6c5b5ff1f1 feat: Add SkillSpector security scanning for skill components (#623) ...

Integrate NVIDIA's SkillSpector static analyzer (Apache-2.0) to scan
AI agent skills under cli-tool/components/skills/ for security issues
(prompt injection, data exfiltration, supply chain, dangerous code, etc.).

- scripts/skillspector_scan.py: batch orchestrator that discovers skill
  dirs (by SKILL.md), runs `skillspector scan --no-llm --format json` on
  each, and aggregates results into a Markdown PR report + SARIF log.
  Tolerates per-skill scan failures and the CLI's non-zero exit on high
  scores without aborting the batch.
- skill-security-scan.yml (PR): scans only changed skills, posts an
  idempotent report comment, and blocks on HIGH/CRITICAL (score > 50).
- skill-security-scan-all.yml (weekly + manual): scans all skills,
  reports to run summary and SARIF, never blocks.
- CLAUDE.md: document the scanning workflow.

Co-authored-by: Claude <noreply@anthropic.com>

2026-06-05 23:12:26 -04:00

..

workflows

feat: Add SkillSpector security scanning for skill components (#623)

2026-06-05 23:12:26 -04:00

CODEOWNERS

security: Harden CI/CD and repo for open-source safety (#458)

2026-03-26 19:19:39 -04:00

dependabot.yml

security: Harden CI/CD and repo for open-source safety (#458)

2026-03-26 19:19:39 -04:00

WORKFLOWS_REFERENCE.md

cleanup: remove all GitHub workflow-based tracking systems

2025-08-19 18:15:53 -04:00