* Add external reference scanner for skill/agent content
- PowerShell scanner (eng/reference-scanner/scan.ps1) checks for:
- http:// URLs (blocked except localhost and XML namespace URIs)
- External <script> tags without SRI integrity attribute
- Pipe-to-shell patterns (except dotnet install scripts)
- URLs referencing domains not in .github/known-domains.txt
- CI workflow runs on PRs and pushes touching skill/agent paths
- CONTRIBUTING.md updated with external references policy
- README.md: fixed http:// to https:// for agentskills.io
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Move known-domains.txt to eng/reference-scanner/, fix comments, add ollama.com
- Moved from .github/ to eng/reference-scanner/ (co-located with scanner)
- Updated header comments: errors not informational notices, removed misleading org-scoping language
- Added ollama.com (pre-existing reference in dotnet-ai skill)
- Updated all references in scan.ps1, CI workflow, CONTRIBUTING.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback
- Add ? and # as valid URL terminators in path-scoped domain matching
- Strip # from host extraction in Test-KnownDomain and Test-HttpNotHttps
- Make script/SRI regex patterns case-insensitive
- Emit error finding on file read failure instead of silent skip
- Fix help comment (two levels up, not three)
- Unify CONTRIBUTING.md error language (all checks are CI-blocking)
- Add eng/reference-scanner/** to workflow path triggers
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add cdn.jsdelivr.net to known-domains (used by dashboard after #331 adds SRI)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove cdn.jsdelivr.net from known-domains
jsdelivr serves arbitrary npm packages -- keeping it off the allowlist
means any use requires both SRI and reviewer approval (two gates).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Skip domain check for scripts with SRI, fix single-line file handling
Scripts with integrity attributes are secured by hash -- the domain
is irrelevant. This means cdn.jsdelivr.net does not need to be in
known-domains.txt as long as SRI is present.
Also wrap Get-Content in @() to handle single-line files correctly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address round-2 review feedback
- Multi-line <script> tag detection: join file content so SRI attributes
spanning lines are correctly detected
- Safe relative path: use GetRelativePath() with fallback instead of
bare Substring that throws for out-of-repo files
- Remove dead notice plumbing: all findings are errors now
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Scan only changed files on PRs, full scan on push to main
PRs scan only changed .md/.html files so pre-existing issues on main
don't block unrelated PRs. Push to main runs the full -All scan.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dan Moseley