22weltyang/skill-auditor
Scan AI Agent Skills and publish GitHub Code Scanning annotations.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 13, 2026
- License
- MIT
Pinned Snippet
uses: 22weltyang/skill-auditor@898dc8f29159fc08d2c5e8391f62b6daba6d8e84 # v0.8.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Repository-relative directory or Skill path to scan. | — | . |
| recursive | Discover and scan every Skill root below path. | — | true |
| fail-on | Minimum severity that fails the job. | — | critical |
| min-severity | Minimum severity included in rendered reports. | — | info |
| config | Trusted repository-relative config loaded from the base commit. | — | "" |
| baseline | auto, none, or a repository-relative baseline from the base commit. | — | auto |
| upload-sarif | Upload SARIF to GitHub Code Scanning. | — | true |
| upload-report | Upload JSON and SARIF workflow artifacts. | — | true |
Outputs
| name | description |
|---|---|
| verdict | — |
| critical | — |
| warning | — |
| info | — |
| exit-code | — |
| sarif-file | — |
| json-file | — |
| content-hash | — |