babywyrm/skillseraph
Scan agent config files (skills, rules, hooks, instructions) for poisoning and injection.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory to scan. | no | . |
| fail-on | Severity threshold that fails the run (critical|high|medium|low|any|none). | no | high |
| platform | Restrict to a specific platform (cursor, codex, claude, …). Empty = auto-detect. | no | "" |
| include-deps | Scan dependency trees (node_modules, vendor, .venv). | no | true |
| changed-only | Only scan files changed in the PR (fast gate). Ignored on push events. | no | true |
| baseline | Path to a baseline file (suppress known/accepted findings). | no | "" |
| sarif | Path to write SARIF 2.1.0 output. | no | skillseraph.sarif |
| json | Path to write JSON findings. | no | skillseraph.json |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file. |
| json-file | Path to the generated JSON file. |