Pins ai-plugin-scanner-action to an immutable commit.
Dependabot proposed v1.2.551 to v1.2.618. Checking what the v1 tag actually resolves to showed it had moved twice in three days: the pull request named v1.2.618 from 5 September, and v1 now points at v1.2.651 published on the 8th. Anything tracking the tag silently ran three different bundles across that window.
Now pinned to bb4f519 (v1.2.651). Dependabot keeps SHA pins updated, so this costs nothing in maintenance and removes the window where a tag can be repointed at unreviewed code. The same pin is applied across the seven sibling skill bundles.