tgpski/go-skeptic
Scan for structural trust boundary vulnerabilities that CVE scanners, SAST tools, and secret scanners miss.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Root path to scan | no | . |
| format | Output format: text|json|sarif|markdown | no | sarif |
| mode | Operating mode: developer|ir|deep | no | developer |
| preset | Scan preset: quick|dev|ci|hunt|machine-identity|ai-workload | no | ci |
| fail-on | Severity gate: none|info|low|medium|high|critical | no | high |
| fail-on-score | Risk score gate (0-100, 0 disables) | no | 0 |
| scan-style | Detection style: pattern|behavior|hybrid | no | pattern |
| threat-mode | Focus area: all|machine-identity|ai-workload | no | all |
| config | Path to .skeptic.* config file (empty = auto-discover) | no | "" |
| rules-file | Path to external rule pack JSON | no | "" |
| rules-pubkey | Path to Ed25519 public key for rule pack signature verification | no | "" |
| baseline | Path to prior JSON report for diff-only gating | no | "" |
| waivers | Path to JSON waiver file | no | "" |
| go-version | Go version for building skeptic | no | 1.24 |
| sarif-upload | Auto-upload SARIF to GitHub code scanning (requires format=sarif) | no | true |
| extra-args | Additional CLI flags passed directly to skeptic scan | no | "" |
Outputs
| name | description |
|---|---|
| exit-code | skeptic exit code: 0=pass, 1=error, 2=bad args, 3=policy failure |
| sarif-file | Path to the SARIF results file (when format=sarif) |
| result-file | Path to the results file (any format) |