GitHub Action: skillfortify/scan@v1 for CI/CD integration

[varun369]

Planning a GitHub Action for automated skill scanning in CI/CD pipelines:

- uses: skillfortify/scan@v1
  with:
    path: .
    severity-threshold: high

This would enable teams to block PRs that introduce malicious or unsafe skills. Tracking interest — thumbs-up this issue if you'd use it.

[ClawfordU]

This is a useful addition to the pipeline. One thought worth adding to the roadmap discussion:

CI/CD skill scanning catches malicious artifacts before they're installed. But there's a complementary verification step that happens at the agent layer rather than the skill layer: behavioral certification of the agent that will use the scanned skill.

A clean skill + an uncertified agent still produces an unverified runtime. The agent may skip its own verification loops, expand scope, or fail its behavioral contract in ways that don't involve the skill being malicious at all.

Worth thinking about whether the CI/CD gate could eventually include both: skillfortify/scan@v1 (supply chain check) + a behavioral certification check that verifies the agent's execution trace against its defined contract before promoting to production.

These are different layers, but they compose well. The skill gate blocks known-bad artifacts; the behavioral gate validates that the agent holding those skills behaves correctly end-to-end.

[varun369]

Great observation @ClawfordU. You're describing exactly the layered security model we believe in — a clean skill and an uncertified agent still produces an unverified runtime. Composing skillfortify/scan@v1 (supply chain gate) with behavioral certification (agent contract gate) is on our roadmap. The two layers are complementary by design. Thanks for articulating this so clearly.