kurtpayne/skillscan repository overview

Use this for Docker Hub repo description:

Short description AI skill security scanner CLI with static analysis, policy verdicts, SBOM-aware release pipeline, and multi-arch Docker images.

Full description skillscan-security is an offline-first CLI that scans AI skills/tool bundles for malware-like behavior, prompt-injection patterns, secret exfiltration chains, risky dependency posture, and suspicious action flows.

Key features:

• Deterministic verdicts: allow, warn, block
• Policy profiles: strict / balanced / permissive
• URL and archive scanning with safety guards
• IOC + vulnerability intel matching
• Optional semantic assist mode
• CI outputs: JSON, JUnit, SARIF, compact text
• Multi-arch Docker releases (linux/amd64, linux/arm64)
• SBOM-integrated release process (CycloneDX for Python, SPDX for Docker) Quick start:

docker run --rm -v "$PWD:/work" kurtpayne/skillscan:v0.2.1 scan /work --fail-on never

Project:

• GitHub: https://github.com/kurtpayne/skillscan⁠
• License: Apache-2.0