skill-safety-scanner

To scan for hardcoded secrets before publishing, run a safety scanner on your local skill directory to detect credentials and generate a safety report. The scanner analyzes JavaScript, Python, and shell files to identify embedded secrets and dangerous code patterns.

Detecting dangerous code patterns in shell scripts requires static analysis that flags unsafe eval and shell command executions. A dedicated safety scanner can parse these files locally and report potentially dangerous code patterns with graded risk scores.

Static analysis identifies required permissions by scanning code for filesystem, network, and subprocess access patterns. It analyzes the skill directory contents to report the specific permissions a skill may request, aiding compliance and safety reviews before publishing.

Yes, you can generate JSON safety reports suitable for CI pipelines. The safety scanner produces deterministic results with graded scores and per-dimension findings, offering both JSON and text output formats to integrate seamlessly into continuous integration workflows.

Yes, the safety scanner works with Python and JavaScript files, alongside shell scripts. It analyzes code across these supported languages to detect secrets, dangerous patterns, and required permissions, producing a comprehensive safety report before publishing.

You need to run a safety scan on local skill directories to identify and report security risks before publishing. This process detects hardcoded secrets, flags dangerous code patterns, and verifies required permissions, ensuring compliance and preventing vulnerable code deployment.