AgentScan-cli

Version updated for https://github.com/thesfb/agentscan-action to version v1.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The AgentScan Action automates the security scanning of AI agent skills before they are run in GitHub Actions workflows. It uses a deterministic local scanner to identify and report potential security issues such as shell commands, network calls, secrets, licenses, and obfuscation. The action helps prevent risky skills from being deployed by failing the build when it detects findings at or above a specified severity threshold, while still printing all findings in the log for review.

What’s Changed

AgentScan is a local scanner for AI agent skills. Point it at any Claude Code, Codex, or OpenCode skill directory before you install. It shows what the skill does: permissions, network calls, secrets, license. A scan takes seconds and returns file:line evidence for every finding, so the verdict is yours. It never runs the skill. It never sends data.

• Thesfb
• GitHub Actions