SkillScan/action.yml at main · NMitchem/SkillScan · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: 'SkillScan Audit'
description: 'Scan SKILL.md agent skill files for security threats'
branding:
  icon: 'shield'
  color: 'red'
inputs:
  path:
    description: 'Path to scan (file or directory)'
    default: '.'
  threshold:
    description: 'Risk score threshold for pass/fail (0.0-10.0)'
    default: '6.0'
  format:
    description: 'Output format (text, json, sarif)'
    default: 'sarif'
  upload-sarif:
    description: 'Upload SARIF results to GitHub Security tab'
    default: 'true'
  fail-on-findings:
    description: 'Fail the workflow if findings exceed threshold'
    default: 'true'
runs:
  using: 'composite'
  steps:
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - name: Install skillscan
      shell: bash
      run: pip install skillscan

    - name: Run skillscan
      id: scan
      shell: bash
      run: |
        set +e
        skillscan audit "${{ inputs.path }}" \
          --dir \
          --threshold "${{ inputs.threshold }}" \
          --format "${{ inputs.format }}" \
          > skillscan-results.sarif
        EXIT_CODE=$?
        echo "exit-code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
        if [ "${{ inputs.fail-on-findings }}" = "false" ]; then
          exit 0
        fi
        exit $EXIT_CODE

    - name: Upload SARIF
      if: always() && inputs.upload-sarif == 'true' && inputs.format == 'sarif'
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: skillscan-results.sarif
        category: skillscan