Check agent changes before merge.
Bring SkillTrust’s free GitHub Action into your workflow. Check supported skills and coding-agent configuration, then review findings alongside your code.
From workflow to review.
Checks in your runner
Add one step to your GitHub workflow. Static checks scan supported files without executing them.
Flags known risk patterns in skills, project instructions, permissions, hooks and MCP configuration.
Findings in your review
Read findings and grades in Job Summary, with a sticky comment on same-repository pull requests.
Optional PR comparison separates new, existing and fixed findings against the current base — not finding history.
Start with a report.
Start in report-only mode. Add this step after checkout in an existing Ubuntu workflow.
- uses: skilltrust/scan-action@v1
with:
report-only: 'true'Public v1 defaults are blocking at the configured threshold. This explicit report-only step lets findings pass; installation, input, integrity and scanner errors still fail.
Static analysis of supported files only — not a guarantee of runtime safety.