charliechenye/SkillGate
Pre-merge and pre-install trust checks for AI-agent skills and MCP configurations. Scan capabilities, detect risky changes, and block unapproved agent behavior in CI.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- MIT
Pinned Snippet
uses: charliechenye/skillgate@14c48ef558e87a9eadd7366c0100b4389bd22767 # v0.1.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Repository path to scan. | no | . |
| policy | Policy file path in the repository being scanned. Required for blocking policy checks. | no | "" |
| baseline | Optional baseline lockfile path for diff checks. | no | "" |
| fail-on-drift | Exit nonzero when baseline drift is detected without requiring a policy file. | no | false |
| provenance | Optional provenance manifest path for policy and baseline checksum verification. | no | "" |
| sarif-output | Optional SARIF output path. | no | "" |
| summary-output | Optional Markdown review summary output path. | no | "" |
| json-output | Optional machine-readable review JSON output path. | no | "" |
| step-summary | Append the Markdown review summary to the GitHub Step Summary. | no | false |
| mcpb-path | Optional committed MCPB artifact path to scan. | no | "" |
| mcpb-fail-on | Optional MCPB severity threshold that exits nonzero when matched. | no | "" |
| mcpb-sarif-output | Optional MCPB SARIF output path for separate code scanning upload. | no | "" |
Outputs
no outputs