SkillTotal changelog

version

1.0.0 → 1.1.0

version

0.100.0 → 1.0.0

version

0.99.1 → 0.100.0

version

0.99.0 → 0.99.1

version

0.98.0 → 0.99.0

version

0.97.0 → 0.98.0

version

0.96.0 → 0.97.0

version

0.95.0 → 0.96.0

version

0.94.0 → 0.95.0

version

0.93.0 → 0.94.0

version

0.92.0 → 0.93.0

https://www.skilltotal.ai/llms.txt

− - [Claude Code plugin](https://www.skilltotal.ai/claude-code-plugin): checks each npm, PyPI or MCP package before Claude Code installs it+ - [Claude Code plugin](https://www.skilltotal.ai/claude-code-plugin): checks each npm, PyPI or MCP package before Claude Code installs it, and lists the hooks for other agents with how far each has been tested

version

0.85.1 → 0.92.0

version

0.85.0 → 0.85.1

version

0.84.1 → 0.85.0

version

0.84.0 → 0.84.1

version

0.83.0 → 0.84.0

version

0.82.0 → 0.83.0

version

0.81.0 → 0.82.0

version

0.80.0 → 0.81.0

version

0.79.2 → 0.80.0

file

absent → published

https://www.skilltotal.ai/llms.txt

+ # SkillTotal+ > SkillTotal is a free, open-source static security scanner for what AI coding agents install: MCP servers, agent skills (SKILL.md), npm and PyPI packages, and git repositories. It never executes the code it reads and never calls an LLM, so results are reproducible, and every confirmed finding cites the file and line it came from. It reports malicious indicators, risky constructs and capabilities; it does not certify a component as safe.+ The same engine runs on this website, as a CLI (`pipx install skilltotal`), as a Claude Code plugin that checks packages before the agent installs them, as a GitHub Action, and as an MCP server. The engine is Apache-2.0 and has no runtime dependencies beyond the Python standard library.+ ## Scanners and guides+ - [MCP server security](https://www.skilltotal.ai/mcp-server-security): scan an MCP server, plus a nine-point checklist (version pinning, launch commands, tool poisoning, approvals, secrets in configs, remote servers)+ - [Agent skill security](https://www.skilltotal.ai/agent-skill-security): how to check a Claude Code skill before installing it (frontmatter and allowed-tools, instructions, bundled scripts, hidden text)+ - [npm package security](https://www.skilltotal.ai/npm-package-security): how to check an npm package before npm install (lifecycle scripts, typosquats, obfuscated code, lockfiles)+ - [PyPI package security](https://www.skilltotal.ai/pypi-package-security): how to check a PyPI package before pip install (build hooks, .pth files, import-time code, unsafe deserialization, wheels vs sdists)+ - [GitHub repository scanner](https://www.skilltotal.ai/github-repo-scanner): scan a repository, a subfolder or a commit+ - [Scan your MCP config](https://www.skilltotal.ai/scan-config): paste a client's MCP config and scan the package behind every server+ ## Tools+ - [Claude Code plugin](https://www.skilltotal.ai/claude-code-plugin): checks each npm, PyPI or MCP package before Claude Code installs it+ - [GitHub Action](https://www.skilltotal.ai/github-action): scan on every push and pull request, with SARIF for Code Scanning, a job summary and a PR comment+ - [Docs](https://www.skilltotal.ai/docs): how the analysis works, coverage by component type, CLI commands, CI setup and what is out of scope+ ## Research+ - [Static analysis vs LLM review](https://www.skilltotal.ai/static-vs-llm-scanning): how deterministic rules, LLM-as-judge review and sandbox monitoring compare+ - [What we catch, and what we do not](https://www.skilltotal.ai/what-we-catch): the published scanner bypasses (whitespace inflation, bytecode, archive indirection, prompt injection against an LLM judge) and what the engine does with each+ - [Detection benchmark](https://www.skilltotal.ai/detection-benchmark): recall and precision on a published, labeled corpus+ - [MCP registry survey](https://www.skilltotal.ai/mcp-registry-security-report): a static scan of the official MCP registry, with open aggregate data+ - [Security labs](https://www.skilltotal.ai/labs): interactive lessons on prompt injection, tool poisoning, typosquatting, install scripts and more+ ## Source+ - [GitHub repository](https://github.com/pezhik/skilltotal): engine, rules, tests and the evaluation harness+ - [PyPI package](https://pypi.org/project/skilltotal/)+ - [npm wrapper](https://www.npmjs.com/package/skilltotal)+ - [GitHub Marketplace action](https://github.com/marketplace/actions/skilltotal-ai-component-security-scan)

version

0.79.1 → 0.79.2

version

0.79.0 → 0.79.1

version

0.78.1 → 0.79.0

version

0.77.0 → 0.78.1

version

0.76.0 → 0.77.0

version

0.75.0 → 0.76.0

version

0.74.0 → 0.75.0

version

0.73.0 → 0.74.0

version

0.72.0 → 0.73.0

version

0.70.1 → 0.72.0

version

0.69.0 → 0.70.1

version

0.68.0 → 0.69.0

version

0.66.0 → 0.68.0

version

0.65.0 → 0.66.0

version

0.64.0 → 0.65.0

version

0.63.0 → 0.64.0

version

0.62.0 → 0.63.0

version

0.61.0 → 0.62.0

version

0.58.0 → 0.61.0

version

0.57.0 → 0.58.0

version

0.56.4 → 0.57.0

version

0.56.3 → 0.56.4

version

0.56.2 → 0.56.3

version

0.56.1 → 0.56.2

version

0.56.0 → 0.56.1

version

0.55.0 → 0.56.0

version

0.54.0 → 0.55.0

version

0.53.0 → 0.54.0