pezhik/SkillTotal AI Component Security Scan
Static security scan for AI components (MCP, agent skills, npm/PyPI, repos) - SARIF, deterministic, offline.
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 9, 2026
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- Apache 2.0
Pinned Snippet
uses: pezhik/skilltotal@7905d363ef9bb525ebb119cbc008e961c4517a5f # v0.38.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| source | What to scan: a path in the repo (default '.'), a git URL, or an npm:/pypi:<name> spec. | no | . |
| version | Pin the skilltotal PyPI version to install. Empty installs the latest release. | no | "" |
| fail-on | Fail the job when a finding is this severity or higher: 'high' or 'none'. | no | high |
| upload-sarif | Upload SARIF to GitHub Code Scanning (job needs 'security-events: write'). | no | true |
| comment-on-pr | Post a summary comment on pull requests (job needs 'pull-requests: write'). | no | false |
| baseline | Optional path to a baseline file to suppress accepted findings. | no | "" |
| sarif-file | Where to write the SARIF report. | no | skilltotal.sarif |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF report. |
| risk-score | Risk score, 0-100. |
| risk-level | Risk level: low / medium / high / critical. |