Home / Security tooling

skill-scan-gate

CI gate for Claude Code skills and plugins.

Python · MIT · latest v0.1.0

What it is

skill-scan-gate scans a skills or plugin repository in CI for instruction-override text, exfiltration patterns, dangerous hook commands, unpinned MCP servers and secret-shaped strings, writes SARIF for code scanning, and fails the build on findings above your threshold.

GitHub Action:

- uses: basitalisandhu/skill-scan-gate@v0.1.0

pip (after the first PyPI release; until then pipx install git+https://github.com/basitalisandhu/skill-scan-gate):

pip install skill-scan-gate

Container image (GitHub Packages):

docker run --rm -v "$PWD:/work:ro" ghcr.io/basitalisandhu/skill-scan-gate:0.1.0 scan .

Install

skill-scan-gate scan .                                   # table, fail on high
skill-scan-gate scan . --fail-on medium --sarif out.sarif
skill-scan-gate scan . --format json --output report.json
skill-scan-gate baseline . --out .skill-scan-gate-baseline.json
skill-scan-gate scan . --baseline .skill-scan-gate-baseline.json --allow .skill-scan-gate-allow
skill-scan-gate rules                                    # list every rule

From the README; see the full README for every option.

Releases

Topics: agent-security, agent-skills, ai-security, ci, claude-code, claude-code-plugins, claude-code-skills, code-scanning, devsecops, github-actions, hacktoberfest, hooks, mcp, prompt-injection, python, sarif, secret-scanning, supply-chain-security