release: SkillSpector 2.9.4

CHANGELOG.md

@@ -1,3 +1,15 @@
+### 2.9.4 (Wednesday, August 12, 2026)
+### Features/Bug Fixes
+* fix(mcp): reject local targets over HTTP transport (#196)
+* Add Skill Inspector companion skill (#253)
+* fix(lp3): remediation and docs name allowed-tools for SKILL.md (#316)
+* chore(openssf-scorecard): Add badge (#351)
+* Detect whitespace padding used to hide prompt-injection instructions (P9) (#24)
+* fix(analyzers): HIGH SC8 when skill ships __pycache__ or .pyc (#357)
+* Revert "Scope the locality guard to the namespace"
+* Scope the locality guard to the namespace
+* fix(security): reject symlinks in skill walk + disable git symlinks on clone
+---
 ### 2.9.3 (Tuesday, August 11, 2026)
 ### Features/Bug Fixes
 * fix(llm): surface invalid responses as degraded (skipped, non-fatal, incomplete)

docs/release/skillspector-2.9.4.md

@@ -0,0 +1,54 @@
+# SkillSpector v2.9.4
+
+Released: 2026-08-12
+
+## Summary
+
+This patch strengthens SkillSpector’s safe handling of MCP requests and untrusted skill content, while adding broader prompt-injection and supply-chain detection coverage. It also improves permission guidance, ships a companion Skill Inspector guide, and refreshes project documentation.
+
+## Highlights
+
+- HTTP-exposed MCP servers now reject caller-controlled local scan targets and local YARA-rule directories while preserving local scanning for trusted stdio use.
+- Detect whitespace-padding prompt-injection attempts and shipped Python bytecode, with improved minimum risk scoring for high-impact findings.
+
+## Added
+
+- Add detection for whitespace padding used to hide prompt-injection instructions.
+- Add a HIGH SC8 finding when a skill ships Python bytecode or `__pycache__` content.
+- Add the Skill Inspector companion skill guide.
+
+## Changed
+
+- Treat `allowed-tools` as valid least-privilege permission guidance in remediations and documentation.
+- Add an OpenSSF Scorecard badge to the project documentation.
+
+## Fixed
+
+- Reject local filesystem scan targets and local YARA-rule directories for HTTP MCP transport, preventing remote callers from selecting scanner-host paths.
+- Reject symlinked skill content during discovery and disable Git symlink materialization when cloning input repositories.
+- Ensure high-impact findings receive an appropriate minimum risk score.
+
+## Security
+
+- Harden HTTP MCP transport against local-path access and strengthen skill-content handling against symlink traversal.
+
+## Breaking Changes and Migration
+
+- HTTP MCP clients can no longer scan local filesystem paths or provide local YARA-rule directories. Use a remote repository or URL for HTTP requests; use trusted stdio transport for local scans.
+
+## Deprecations
+
+- None.
+
+## Validation
+
+- Internal GitLab merge-request CI passed lint, unit, integration, Docker smoke, and Sonar analysis for the six imported public changes.
+- `uv run --locked --extra dev pytest -q tests/unit/test_mcp_server.py` — 26 passed for the HTTP MCP transport remediation.
+
+## Known Limitations
+
+- HTTP MCP transport intentionally rejects local filesystem inputs; this is a security boundary rather than an unsupported scanner capability.
+
+## References
+
+- `CHANGELOG.md`

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "skillspector"
-version = "2.9.3"
+version = "2.9.4"
 description = "SkillSpector: Security scanner for AI agent skills (Claude Code, Cursor, and similar). Scans skills for vulnerabilities, malicious patterns, and security risks before installation. Supports Git repos, URLs, zips, and local directories; runs static pattern checks and optional LLM semantic analysis; outputs terminal, JSON, and Markdown reports with risk scoring."
 readme = "README.md"
 license = "Apache-2.0"

src/skillspector/cli.py

@@ -36,6 +36,7 @@
 from skillspector.cleanup import cleanup_result
 from skillspector.constants import RISK_THRESHOLD
 from skillspector.graph import graph
+from skillspector.input_handler import validate_local_input_path
 from skillspector.logging_config import get_logger, set_level
 from skillspector.mcp_registry import scan_registry
 from skillspector.multi_skill import MultiSkillDetectionResult, detect_skills
@@ -323,7 +324,13 @@ def scan(
     if verbose:
         set_level("DEBUG")
 
-    resolved_path = Path(input_path).resolve()
+    resolved_path = Path(input_path)
+    if not input_path.startswith(("http://", "https://", "git@")):
+        try:
+            resolved_path = validate_local_input_path(resolved_path)
+        except ValueError as e:
+            console.print(f"[red]Error:[/red] {e}")
+            raise typer.Exit(code=2) from e
     if recursive and resolved_path.is_dir():
         detection = detect_skills(resolved_path)
         if detection.is_multi_skill: