skill-scanner

# Skill scanner ## Contract | Field | Bound contract | |---|---| | Trigger | user asks to scan, audit, or validate a skill for security issues | | Authority | read-only: no file, VCS, credential, paid, published, deployed, or remote mutation | | Side effect | chat-output: runs static analysis and produces a risk assessment | | Done | risk-level assessment with evidence, false positives filtered, and install recommendation | ## Inputs - skill_path (required): path to the skill directory containing `SKILL.md` and any associated files. - risk_threshold (optional): minimum severity to report: one of `low`, `medium`, `high`, `critical`. Defaults to `low`. ## Procedure 1. Validate that `skill_path` exists and contains a `SKILL.md` file. If not, report `blocked` with the missing-path evidence and stop. **Done when:** the path exists and `SKILL.md` is present, or a `blocked` report is returned. 2. Read and parse the `SKILL.md` frontmatter. Extract `name`, `description`, and any invocation flags. If the file is malformed, note the parse failure and continue with remaining files. **Done when:** the frontmatter is parsed or the failure is recorded. 3. Inventory every file under the skill directory. Record path, extension, and size. **Done when:** the inventory is complete. 4. For each file, run the following read-only analysis passes: a. **Command execution**: scan for shell exec patterns, subprocess spawning, `os.system`, `eval`, `exec`, backtick execution, pipe-to-shell, and ...