- Clarified the security scan report generation process in README.md, emphasizing the publication of results.
- Revised `scan_skills.py` documentation to reflect changes in report generation and the removal of the validate_report.py script.
- Updated SECURITY.md to specify the scope of vulnerabilities and improved clarity on the report's purpose and limitations.
- Adjusted the security scan workflow to remove the validation step, streamlining the process while ensuring accurate reporting.
Scans were sequential at ~29s per skill: 72 minutes for 150 skills against a
120-minute workflow timeout. Each scan is blocked on LLM network I/O rather
than local CPU, so the work parallelizes.
- Run skills through a thread pool (SKILL_SCAN_WORKERS, default 8), building
one scanner per worker thread rather than sharing one, since the analyzers
carry mutable per-scan state. Rate-limit retry with backoff already exists
inside cisco-ai-skill-scanner, so concurrency is bounded, not retried here.
- Reuse findings for skills whose package contents are unchanged, keyed on a
SHA-256 over file paths and bytes. Invalidate on scanner version change,
model change, --full, or a 30-day backstop from the last full scan.
- Record per-skill content_hash and last_scanned in the JSON report, and
disclose carried-forward findings in the markdown header, so a reused
finding always shows when it was actually produced.
- Sort report entries by skill name so worker completion order does not churn
the committed JSON.
- Lower the workflow timeout to 60 minutes; add a full_scan dispatch input.
Also fixes skills/genomic-intelligence/SKILL.md, whose unquoted description
contained a colon-space that made its YAML frontmatter invalid. The loader had
been rejecting it silently, so every scan covered 149 of 150 skills.
- Enhanced the README to clarify the publication of security scan results to a dedicated markdown file.
- Modified `scan_skills.py` to generate both a human-readable report and a machine-readable JSON report, ensuring consistency checks before CI publishing.
- Updated the GitHub Actions workflow to validate the scan report and commit the new reports, replacing the previous SECURITY.md approach with separate report files.
This change improves the clarity and accessibility of security information for users and contributors.
