- Added Agent Skill scanning for SKILL.md files, including checks for hidden Unicode, injection phrases, and cross-skill shadowing.
- Added MCP010 for dynamic MCP server commands built from untrusted input.
- Improved DEP003 so advisories compare against actual declared package versions.
- Fixed several false positives in sensitive logging, RAG context injection, and system prompt leakage.
- Added regression coverage for CLI and dependency-guard behavior.
Install or upgrade:
- npm i -g secureai-scan