feat: package SkillSpector as a Codex skill - #371
Conversation
| @@ -0,0 +1,4 @@ | |||
| interface: | |||
| display_name: "Skill Scanner" | |||
There was a problem hiding this comment.
I would prefer to have it as SkillSpector itself.
| @@ -0,0 +1,90 @@ | |||
| --- | |||
| name: skill-scanner | |||
There was a problem hiding this comment.
We should have it SkillSpector itself IMHO. The description anyways highlights it as a skill scanner
|
@edjshen - Please address the review comments. |
rng1995
left a comment
rng1995
left a comment
There was a problem hiding this comment.
Requesting changes for the recursive workflow bug below. The existing metadata naming threads also remain unresolved (display name, skill name), and the current head still fails the DCO check.
| 5. Report the scan mode, score, severity, recommendation, highest-impact findings with | ||
| file/line evidence, execution completeness, and material limitations. | ||
|
|
||
| Use `--recursive` when the target contains multiple immediate subdirectories that each |
There was a problem hiding this comment.
[P2] Make the recursive workflow produce the JSON that step 4 requires. Adding --recursive to the canonical command without --output does not emit combined JSON: _scan_multi_skill prints human summaries unless an output path is supplied. An agent following these instructions therefore has no execution_successful/completeness fields to inspect. Require --output <path> for recursive scans and instruct the agent to read that file, or change the launcher to honor --format json on stdout.
|
Powered by Codex: PR council review result. This is a triage signal, not a maintainer approval.
|
3 participants
What changed
skill-scannerskillSKILL.md, OpenAI UI metadata, and a portable launcheruv --frozen --no-dev--no-llminspection and preserves scanner exit codesWhy
This makes the existing SkillSpector engine directly usable as an agent skill while keeping target skills untrusted and avoiding execution of their scripts or dependencies.
Validation
quick_validate.py: valid--help: successful against SkillSpector 2.9.4mainat SkillSpector 2.9.4Static
--no-llmmode intentionally reports disabled semantic analyzers as a limitation; the launcher does not hide that completeness signal.