nomarj/Sigil Security Scan
Scan your repository for malicious patterns in AI agent code, MCP servers, and packages
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (relative to repository root) | no | . |
| threshold | Minimum verdict level to fail the action (low/medium/high/critical) | no | medium |
| api-key | Sigil cloud API key for threat intel enrichment (optional) | no | "" |
| fail-on-findings | Whether to fail the action when findings exceed the threshold | no | true |
| phases | Comma-separated list of scan phases to run (all, install-hooks, code-patterns, network, credentials, obfuscation, provenance) | no | all |
| exclude | Glob patterns to exclude from scanning (comma-separated) | no | "" |
Outputs
| name | description |
|---|---|
| verdict | Scan verdict (clean, low, medium, high, critical) |
| risk-score | Numeric risk score from the scan |
| findings-count | Total number of findings detected |