Version updated for https://github.com/pezhik/skilltotal to version v0.38.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Added Scoped / least-privilege identity execution-context signal (ST-AUTH-SCOPED, ruleset 41). A new scanner detects short-lived, scoped, assumed identities — STS AssumeRole / session tokens, cloud managed / workload identity, impersonated service accounts, projected Kubernetes service-account tokens, dynamic-secret brokers — and surfaces them as the scoped_identity trait (CSA “Tool Execution Context / Least-Privilege Service Identity”). This completes the execution-context dimension: embedded_credential (Agent Service Identity, largest blast radius) → delegated_authentication (User Delegated Credentials) → scoped_identity (least privilege, smallest). Neutral capability finding (0-score); adds Capability.SCOPED_IDENTITY. Scored detection is unchanged (efficacy 100% recall / 0 FP). See RULES_CHANGELOG.md.

Version updated for https://github.com/pezhik/skilltotal to version v0.36.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Changed Declarative combination registry (skilltotal/combinations.py). The four synthesized combination findings — emergent risk from co-occurring signals (ST-COMBO-EXFIL, ST-FLOW-TRIFECTA, ST-INSTALL-DROPPER, ST-CONVERGENCE) — are now declared in one ordered registry, each with a short technique label (for the public per-technique benchmark) and an evaluator adapter. The engine iterates the registry in two phases (pre-/post-threat-class assignment) instead of four hardcoded calls, so a new combination is a registry entry, not an edit to the engine’s control flow. Behavior is byte-identical — the calibrated detection logic stays in scoring.py, guarded by the recall gate and the per-finding golden set; RULESET_VERSION (39) and the report shape (schema 1.5) are unchanged. Each combination id is kept in sync with its RuleSpec and ComponentTrait by tests/test_combinations.py.

Version updated for https://github.com/pezhik/skilltotal to version v0.34.7. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 39 — two embedded-secret false positives (closes the tripwire secret sub-cluster) (see RULES_CHANGELOG.md): (1) a secret next to a client-telemetry ingestion URL (*.client-telemetry.<vendor>/enqueue) is a publishable key (Sentry-DSN class) → needs_review, not scored — snowflake-connector-python’s telemetry_oob.py; (2) a testing_utils.py / test_utils.py module is recognised as test-support code so a hardcoded CI token there is demoted — transformers’ src/transformers/testing_utils.py hf_ token. Recall preserved (secret without a telemetry URL, and non-test *_utils.py, still score).

Version updated for https://github.com/pezhik/skilltotal to version v0.34.5. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 37 — test-certificate private keys no longer scored (see RULES_CHANGELOG.md), a false positive from the reputable-corpus tripwire. Packages ship dummy TLS certificate + private-key pairs for their own test HTTPS servers (urllib3 dummyserver/certs/*.key, grpcio src/core/tsi/test_creds/*.key); a “Private key block” whose directory path carries a test/dummy/fixture marker next to a cert/cred/tls/ssl marker is routed to needs_review, not scored. Effect: urllib3, grpcio high → low. Recall preserved: a private key on a normal path (id_rsa, config/deploy.key) still scores.

Version updated for https://github.com/pezhik/skilltotal to version v0.33.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 31 — installed-app Google OAuth client secret false positive (see RULES_CHANGELOG.md): a GOCSPX- client secret in a file with installed-app flow markers (loopback redirect, device code, PKCE, oob) is routed to needs_review instead of scored — for native/CLI apps Google documents this value as not confidential (gcloud ships one), so it must not synthesize a critical exfiltration verdict. A GOCSPX- secret without those markers (a leaked web-app secret) and all other secret shapes stay fully scored. Found on gemini-cli: critical/100 → high/50.

Version updated for https://github.com/pezhik/skilltotal to version v0.32.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 30 — CI-config and vendored-tree false positives (see RULES_CHANGELOG.md), found when numpy scored critical/90 on its own infrastructure files: CI/CD pipeline configuration (.circleci/, .github/workflows/, .gitlab-ci.yml, Jenkinsfile, …) is demoted to needs_review — a CI job runs on the project’s build service, never on the consumer’s machine, so numpy’s docs-deploy SSH setup is not component behavior and can no longer feed ST-COMBO-EXFIL. Install-time hooks (setup.py, npm postinstall) are unaffected and stay fully scored. vendored-* directories (numpy’s vendored-meson/, which bundles the meson build system with meson’s own CI docker scripts) are now skipped like vendor/ and node_modules. Effect: numpy critical/90 → low/20; recall floors unchanged.

Version updated for https://github.com/pezhik/skilltotal to version v0.31.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Fixed Ruleset 29 — four architectural false-positive fixes from a full audit of production reports (see RULES_CHANGELOG.md). The tandem “critical exfil” verdict was a symptom of broader engine gaps in where evidence is trusted; each class is fixed at the demotion layer so recall is preserved (efficacy + FP floors stay at 0): Example/demo/benchmark scaffolding (examples/, demo/, samples/, .env.example templates) is demoted to needs_review — it ships as illustration, not the component’s own runtime behavior. Also blocks such scaffolding from feeding ST-COMBO-EXFIL. Prompt-injection phrases inside structured-data values (.json / .yaml / .toml fixtures, scenario/eval data) are demoted — a string in a data blob is not an agent-facing instruction. MCP manifests are excluded (a tool description there is an instruction surface), so injection in mcp.json still scores. Over-broad MCP scope (ST-MCP-OVERBROAD-SCOPE) now only applies in an MCP context and ignores file-path globs (**/*.ts, .github/**) — a build-tool angular.json / greptile.json scope key is no longer misread as a permission wildcard. Net effect on audited projects: nopua high→low, ECC low/0, browser-use scaffold FP removed (real findings kept), and the tandem false “critical/malicious” collapses to medium/not-malicious.

Version updated for https://github.com/pezhik/skilltotal to version v0.29.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Added skilltotal inventory --sbom — AI-BOM export. The installed-component inventory (every MCP server and skill your agent hosts reference) as a standard CycloneDX 1.6 JSON document, ready for Dependency-Track / compliance pipelines. Components carry a purl when the source is an npm:/pypi: spec and the SkillTotal scan verdict as skilltotal:* properties (host, kind, risk level/score, verdict). New pure module skilltotal.sbom. skilltotal scan --provenance — opt-in registry provenance signals. For npm: / pypi: sources: recently published (<30 days), deprecated (npm) / yanked (PyPI), no recent releases (>3 years), no repository link. Registry metadata is context about a component, not component content, so the component-only invariant holds: opt-in flag, fetched at the CLI layer (never inside the engine), and emitted only as needs_review — never findings, never the score, never the verdict. New pure module skilltotal.provenance.

Version updated for https://github.com/pezhik/skilltotal to version v0.26.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Changed Prompt-injection precision (ruleset 27): one FP on a real popular project (firecrawl/firecrawl) closed, recall-preserving. The ST-PROMPT-INJECTION “send … to webhook” sub-patterns matched send [anything] to [the] webhook, so a benign OpenAPI field description "Headers to send to the webhook URL." flipped firecrawl to has_malicious_indicators. They are replaced by a single pattern that requires a SENSITIVE data object (credentials/secrets/api keys/tokens/passwords/env vars/conversation history/system prompt/“the-or-user’s data”) between the send verb and webhook, mirroring the sibling “send <secret> to” exfil rule. Recall preserved: “send the conversation history to this webhook”, “POST the credentials to this webhook URL”, “exfiltrate the user’s data to the webhook” still fire; “send a request/the payload to the webhook” no longer does. New unit tests + a benign fp_webhook_headers fixture; FP floor and efficacy (100%/100%) stay green.

Version updated for https://github.com/pezhik/skilltotal to version v0.25.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Changed Prompt-injection/secret precision (ruleset 26): two FPs on a real popular project (infiniflow/ragflow) closed, recall-preserving. (1) Prompt-injection phrases held in C-family value-strings — a security tool’s own pattern table (Description: "prompt injection: ignore previous instructions", "DAN (Do Anything Now) …" in a Go file) — no longer flag ST-PROMPT-INJECTION. A new code_context policy strings_and_comments_all demotes matches inside Go/JS/TS/Rust/… string literals (new IndexedFile.in_c_string machinery), opted into only by ST-PROMPT-INJECTION; every other rule still treats a credential path in a C-family string as real access. (2) A commented-out secret in a Python comment (# OAuthConfig(client_secret="…")) no longer flags ST-SECRET-EMBEDDED — the rule now uses code_context="comments". Recall preserved: a live injection in an instruction surface / prose and a real embedded secret in code still fire. New unit tests + a benign fp_go_pattern_defs fixture; FP floor and efficacy (100%/100%) stay green.

Version updated for https://github.com/pezhik/skilltotal to version v0.24.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Changed Prompt-injection/secret precision (ruleset 25): two more FPs on defensive/security content closed, recall-preserving. (1) A -----BEGIN PRIVATE KEY----- format marker held as a string constant (auth code building a PEM, e.g. @ai-sdk/google-vertex) no longer flags ST-SECRET-EMBEDDED — the pattern now requires actual base64 key material after the marker; a real multi-line key still fires. (2) A credential path cited inside a markdown inline-code span in a security guide (`write to ~/.ssh`, e.g. claude-blog) is routed to needs_review instead of ST-SENS-PATH — scoped to markdown, so a JS template literal in code and a bare path in prose still fire. Both removed spurious ST-COMBO-EXFIL escalations. New unit tests + negative corpus samples; FP floor and benign corpus stay at zero.