v0.6.0 — Evasion-resistant skill scanning + pre-install scanning + root-cause bug fixes

Highlights

Evasion-resistant Agent Skill scanning. Closes the scanner-evasion techniques published in Cloak and Detonate (arXiv:2607.02357) — zero-width/homoglyph obfuscation, self-extracting payloads staged in .git/, and payloads hidden in *.test.ts files that every scanner in that study missed. Two new rules (SKL004, SKL005) plus a deobfuscation layer that matches content across normalized text variants. Validated against anthropics/skills (18 real bundles, 0 findings) and cisco-ai-defense/skill-scanner's labeled eval corpus (6/6 malicious fixtures correctly flagged, 0 false positives).

Scan before you install. New secureai-scan skill <target> / secureai-scan mcp <target> commands fetch and scan a skill or MCP server before you trust it — no clone, no config, and nothing fetched is ever executed (npm pack/git clone --depth 1 only). Same capability now exposed to Claude itself via a new scan_untrusted_target MCP tool.

Found and fixed 5 real bugs by scanning a 5,511-file production repo. Triaging every finding from a full scan of vercel/ai turned up three root-cause false-positive bugs in shared rule logic (an LLM-call resolver that ignored method names, a "query" naming collision between two unrelated rules, and an overly broad request-taint pattern duplicated across three rules) and two Windows-only infrastructure bugs (the bundled MCP server couldn't start on Windows at all; npm/tar needed platform-specific handling). All fixed at the root cause and locked in as permanent regression fixtures — a full re-scan of vercel/ai now reports zero findings.

Scoped a path to AST-based Python detection. A non-shipped proof-of-concept (spike/python-ast-poc/) confirms tree-sitter-python works as a pure-WASM (no native compilation) replacement for today's regex-based Python scanner, demonstrated against a real, previously-invisible gap: user input flowing through a class attribute (self.x = request.json[...]) into an LLM call. See ROADMAP.md for the full assessment.

Full details in CHANGELOG.md.

Full Changelog: v0.5.0...v0.6.0