v0.3.0

Several of these widen what a scan reads. A skill or repo that graded A on v0.2.1 can grade lower now, so check your --fail-on gate after you upgrade. Did a grade move in a way that looks wrong? Please open an issue.

• A folder scan reads the files that sit outside every skill and plugin in it and reports them under (repo root). That covers a repo's install script, its README and its .claude/settings.json. This changes grades for the action's default path: ..
• A lone file other than a SKILL.md, like an install script or a plugin.json, is scanned on its own. It used to read nothing and grade A. A scan that reads no text files at all says so on stderr.
• dist/ and build/ folders are read. A compiled MCP server runs from there, and a credential stealer in dist/index.js used to go unread. node_modules and virtualenvs are still skipped, with an SX-SUP info finding that names them.
• Hook commands and MCP server launch lines in plugin.json, hooks.json, .mcp.json and the settings files get the SX-CMD patterns. Hooks on any event name are reported, not only the nine it knew before.
• Zip bundles (.zip, .skill, .mcpb, .dxt) are opened in memory and every member is scanned. Whatever stops a full read is an SX-SUP medium: an encrypted member, a nested archive or a zip that inflates far past its size.
• A symlink that points out of a skill is reported at medium and never followed. FIFOs and device files are skipped.
• A skill folder symlinked into a folder of skills is scanned. It used to be skipped, so the folder graded A. A linked folder that leaves a skill, or a --git clone, is reported at medium like a linked file.
• A text file cut at the 2 MB read limit is an SX-SUP medium instead of a hygiene note, so a medium gate fails on it. Images and other binaries are not reported.
• SX-INJ also reads data files and scripts. A script's hits are one severity lower, since scripts embed prompt text for honest reasons too.
• A run of hidden tag characters is one finding that says what it decodes to. The report prints invisible characters as markers like <U+202E>.
• Frontmatter block scalars (|, >) and wrapped values parse the way YAML reads them.
• Matched secrets are redacted in every rule's snippet and detail, not only SX-SEC's.
• Discord and Telegram bot tokens are detected.
• s3-transfer.sh and profile.io no longer match as collector endpoints.
• --select and --ignore run or skip rules by id.
• --git takes several URLs and gates them under one --fail-on.
• --ref without --git, and --git together with a local path, exit 2 instead of being ignored.
• SARIF locations resolve from the directory you ran in. A finding inside a bundle points at the bundle. Every result has a location, which code scanning needs to accept the upload.
• The action's result output is error when skillxray could not run, instead of fail. A new upload-sarif input turns the upload off.
• CI runs the packaged action and tests Python 3.10 and 3.14 too. The release workflow stops when the tag doesn't match the package version.
• Relicensed from MIT to GPL-3.0-or-later.

v0.2.0

First PyPI release that makes pipx install skillxray real.

• Added a terminal demo, a runnable (fake, inert) malicious example skill in examples/, MCP-bundle positioning, and a "where it fits" section against Semgrep, TruffleHog, and Lakera.
• Closed eval/exec, a ReDoS, terminal-escape, oversized-file, and secret/injection gaps.
• Added a rules reference kept honest by a drift test.
• Added the noslop code-mode gate to CI.
• Hardened the workflows: pinned actions to commit SHAs, stopped persisting checkout credentials.

v0.1.1 — scanner hardening

Fixes five fail-open gaps found in a cross-model security review, so a hostile skill can't slip past the scanner:

• git clone arg injection: a repo URL starting with - (e.g. --upload-pack=…) could be read as a git option and run a command. Now separated with --.
• Oversized files scanned, not skipped: a payload hidden behind 2MB of padding used to be invisible. The first 2MB is now scanned and the file flagged.
• Unterminated / ...-closed frontmatter is parsed: a tolerant parser in the agent would still read those keys, so the scanner does too instead of seeing nothing.
• Arbitrary MCP launch command is HIGH, not MEDIUM (the severity was returned on both branches of a ternary).
• Destructive-delete regex: lookaheads instead of overlapping stars — removes quadratic backtracking and now catches -fr as well as -rf.
• Temp clone directory is cleaned up instead of leaking.

49 tests, labeled corpus floors green.