keshavp
7ced4fba57
skillspector is an AI agent skill security scanner that combines static, semantic, and behavioral analysis to detect risks in agent skills and MCP servers. This release establishes the LangGraph-based scanning pipeline, analyzer registry, CLI, and test suite. Analyzers: - MCP: least-privilege checks, tool poisoning, rug-pull detection - Static patterns: prompt injection, data exfiltration, excessive agency, privilege escalation, memory poisoning, harmful content, output handling - Semantic (LLM-backed): developer intent, security discovery, quality policy - Behavioral: AST analysis and taint tracking - Supply chain: live OSV vulnerability lookups Infrastructure: - LangGraph scan graph with shared LLM analyzer base - Provider/model registry (model_registry.yaml) and model info utilities - SARIF report output and CLI entrypoint - Pre-commit hooks, Makefile, pyproject + uv.lock - Docs: development guide, analyzer base guide, MCP threat docs, plans - Tests: unit + integration coverage across analyzers, CLI, providers, patterns, OSV client, and graph scanner Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
9 lines
153 B
JSON
9 lines
153 B
JSON
{
|
|
"dependencies": ["."],
|
|
"graphs": {
|
|
"skillspector_scan": "./src/skillspector/graph.py:graph"
|
|
},
|
|
"env": ".env",
|
|
"python_version": "3.12"
|
|
}
|