Enable the tool to scan subagents

[pggolub]

The tool allows scaning skills and mcp servers but there are more artifact types in the agentic development space. One of the most popular is subagent which is supported by most of the tools/agents such as claude code, github copilot and codex.

Subagent structure is similar to skill definition and might have security issues similar to skills. So it would be very beneficial to add support for subagents (custom agents) as well. Scanning a specific folder(s) with subagents would be a great start.

[benrrr56-wq]

Adding subagents (custom agents) as a scannable artifact type is a natural extension - they are structured similarly to skills and load into tool harnesses, so the same injection / over-permission issues apply. What I'd keep in mind is that a subagent matters not just as a static config to scan but as something that executes tools with side effects, so the scan verdict (skill-like or sub-agent-like) becomes more valuable when paired with a decision record of what that subagent is permitted to call, recomputable over time. Would scanning subagent folders that also record their permitted tool surface fit the roadmap?