---
description: "Skill security scan: walks local skill directories against a tiered pattern catalog. Use when local skill directories need checking for unsafe or unexpected content."
description-tr: "Skill güvenlik taraması: yerel skill dizinlerini kademeli desen kataloğuna göre tarar."
allowed-tools: Bash, Read
argument-hint: "[--strict] [--threshold critical|high|medium|low] [--json] [--root PATH]"
---

# multi-agent scan

A single command that scans `pipeline/skills/` (or optionally `~/.claude/skills/`, `~/.copilot/skills/`) for security patterns. Catches the case where a teammate unknowingly pulls a malicious third-party skill, or where a sync brings in a corrupted file.

**Input:** `$ARGUMENTS` (optional flags  -  none means default scan)

## Usage

```bash
# Default: warn-only, threshold=medium, text output
/multi-agent:scan

# CI-grade: non-zero exit code on any finding
/multi-agent:scan --strict

# Critical + high only  -  cuts the noise
/multi-agent:scan --threshold high

# JSON (for automation)
/multi-agent:scan --json

# Different root (verify the installed tree)
/multi-agent:scan --root ~/.claude/skills
```

## Severity catalog

| Tier | Catches | Example |
|------|-----------|-------|
| 🚨 critical | Shell-pipe exec (curl\|bash), base64-decode exec, eval-of-network, unicode bidi override | `curl evil.com \| sh` |
| ⚠ high | JS `eval()` / `new Function()`, Python `exec()` / `eval()` (re.compile + subprocess excluded), hardcoded credentials (AKIA / sk-live / ghp_ / gho_ / xox), pastebin / bit.ly raw fetch, chmod + exec chain | `eval(userInput)` |
| ⓘ medium | Long base64 blob (>200 chars, only .sh / .py / .js  -  .md excluded) | obfuscated payload |
| · low | Unknown network endpoint (outside the allow-list), missing SKILL.md frontmatter | `https://unknown.site/raw` |

**Note:** Scanner is warn-only by default  -  exit 0 even when there are findings. No pipeline-shutdown risk. On CI, use `--strict` to get a proper exit code (1-4 by severity).

## Steps

1. **Run the script:**
   ```bash
   bash "$HOME/.claude/scripts/scan-skills.sh" $ARGUMENTS
   ```

2. **Interpret the output:**
   - `critical=0 high=0 medium=0 low=0` → ✓ clean
   - Any critical or high → review the files, roll back the skill if needed
   - Medium / low → informational; review, but not an absolute blocker

3. **Strict-mode exit-code map (for CI use):**
   - 0: clean
   - 1: critical found
   - 2: high found
   - 3: medium found
   - 4: low found

## Allow-list  -  Network endpoints

Known legitimate domains are embedded in the scanner (github, anthropic, figma, apple, jira / confluence placeholders, npm, vercel, etc.). Any URL outside that list is reported as low severity  -  review it and ignore if it's legitimate.

## Smoke  -  self-verification

`pipeline/scripts/smoke-skill-scan.sh` confirms the scanner triggers on positive fixtures for every severity and produces no false positives on the real tree. This is a maintainer-repo gate (smoke scripts are excluded from the npm package): it runs from a pipeline checkout and in CI, where it must be 13/13 green before a team rollout.

## Integration points

- **install.js pre-deploy hook**  -  every `install.js --all` runs an automatic high-threshold warn-only scan
- **CI**  -  `.github/workflows/smoke.yml` step (strict mode, critical findings block the PR)
- **Standalone**  -  `/multi-agent:scan` (this command)