agent-skill-scan-action

# Agent Skill Scanner — GitHub Action > Last updated: 2026-03-31 Scan agent skill files for security vulnerabilities in your CI pipeline. 22 detection rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks. Wraps [agent-skill-scanner](https://pypi.org/project/agent-skill-scanner/) (PyPI) as a GitHub Action. Built for OpenClaw and Model Context Protocol (MCP) skill files — formats that generic SAST tools miss entirely. ## Quick Start Add to your workflow (`.github/workflows/security.yml`): ```yaml name: Agent Security Scan on: [pull_request] jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: rexcoleman/agent-skill-scan-action@v1 with: path: './skills/' ``` That's it. The action installs the scanner, runs it against your skill files, and fails the PR if HIGH or CRITICAL findings are detected. ## Inputs | Input | Default | Description | |-------|---------|-------------| | `path` | `.` | Path to scan (file or directory) | | `min-severity` | `INFO` | Minimum severity to report (CRITICAL, HIGH, MEDIUM, LOW, INFO) | | `fail-on-findings` | `true` | Fail the step if HIGH or CRITICAL findings are detected | | `scanner-version` | `0.1.0` | Version of agent-skill-scanner to install | ## Outputs | Output | Description | |--------|-------------| | `findings-count` | Total number of findings detected | | `exit-code` | Scanner exit code (0=clean, 1=findings) | ## Example: Scan only on PRs that touch skill files ```yaml name: Agent Security Scan on: pull_request: paths: - 'skills/**' - '*.md' jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: rexcoleman/agent-skill-scan-action@v1 with: path: './skills/' min-severity: 'HIGH' ``` ## Example: Warn but don't block PRs ```yaml - uses: rexcoleman/agent-skill-scan-action@v1 with: path: './skills/' fail-on-findings: 'false' ``` Findings still appear in the Actions tab summary, but the step passes regardless. ## What it detects 22 rules across 5 categories: | Category | Examples | |----------|---------| | **Prompt injection** | System prompt override, role hijacking, instruction injection | | **Capability escalation** | Privilege escalation, shell spawning, persistence mechanisms | | **Data exfiltration** | Credential access, environment variable reads, outbound transfer | | **Encoded payloads** | Base64 commands, hex payloads, obfuscated strings | | **Composition risks** | Unrestricted tool chaining, cross-skill data flow, trust violations | ## Trust & Security This action is a thin wrapper that: 1. Installs `agent-skill-scanner` from PyPI (pinned version) 2. Runs the CLI against your specified path 3. Reports findings to the Actions summary tab No network calls beyond PyPI install. No data collection. No telemetry. The action source is fully auditable in this repo. The scanner source is auditable at [github.com/rexcoleman/agent-skill-scanner](https://github.com/rexcoleman/agent-skill-scanner). ## Limitations - Pattern-based detection only — no semantic analysis - Designed for OpenClaw SKILL.md and MCP tool definitions - Rules cover known attack patterns from published research, not zero-days ## Links - **Scanner (PyPI):** [agent-skill-scanner](https://pypi.org/project/agent-skill-scanner/) - **Scanner (GitHub):** [rexcoleman/agent-skill-scanner](https://github.com/rexcoleman/agent-skill-scanner) - **Research:** [rexcoleman.dev](https://rexcoleman.dev) ## License [MIT](LICENSE)