scan

skillhub scan runs the security scanner over a skill directory. It's the same engine the server runs on publish, checking for secrets, prompt-injection, exfiltration, and dangerous shell. It reports an overall status and a list of findings. Runs against the current directory if you don't pass one.

A blocking finding exits with code 4 — the same gate skillhub publish applies before any network call.

Synopsis

skillhub scan [dir]

Examples

skillhub scan
skillhub scan ./my-skill

JSON output

With --json, the data object contains:

• status (pass | warn | fail).
• findings[] — each { ruleId, severity: info | low | medium | high | critical, message, path (string|null), line (int|null), snippet (string|null) }.
• engine — { name, version }.
• scannedAt.