fix: normalize multi-skill risk_score before threshold check

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
     outputs:
       docker: ${{ steps.filter.outputs.docker }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
       - id: filter
@@ -61,7 +61,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up uv
         # Pinned to a full commit SHA (third-party action); comment tracks the tag.
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
@@ -77,7 +77,7 @@ jobs:
   test-unit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up uv
         # Pinned to a full commit SHA (third-party action); comment tracks the tag.
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
@@ -95,13 +95,13 @@ jobs:
     if: needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - run: docker version
       - run: docker info
       - run: docker build -t skillspector .
       - run: tests/docker/smoke.sh
       - if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: docker-smoke-reports
           path: |
@@ -114,7 +114,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 

.github/workflows/release.yml

@@ -15,6 +15,12 @@ concurrency:
   group: publish-github-release
   cancel-in-progress: false
 
+env:
+  UV_VERSION: "0.10.10"
+  PYTHON_VERSION: "3.12"
+  UV_CACHE_DIR: .uv-cache
+  UV_LINK_MODE: copy
+
 jobs:
   publish:
     if: >-
@@ -27,13 +33,26 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
-      - uses: actions/setup-python@v5
+      - name: Set up uv
+        # Pinned to a full commit SHA (third-party action); comment tracks the tag.
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
-          python-version: "3.12"
+          version: "${{ env.UV_VERSION }}"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "${{ env.PYTHON_VERSION }}"
+      - name: Install locked build tooling
+        run: uv sync --locked --extra dev --no-install-project
+      - name: Build and validate distribution artifacts
+        run: |
+          uv run --no-sync python -m build --no-isolation
+          uv run --no-sync twine check dist/*
       - name: Create the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           python scripts/release/public/create_github_release.py \
             --repository "$GITHUB_REPOSITORY" \
-            --target "${{ github.event.pull_request.merge_commit_sha }}"
+            --target "${{ github.event.pull_request.merge_commit_sha }}" \
+            --asset dist/*.whl \
+            --asset dist/*.tar.gz

.skillspector-baseline.example.yaml

@@ -7,7 +7,8 @@
 # See docs/SUPPRESSION.md for the full reference. All identifiers below are
 # placeholders — replace them with your own rule ids, paths, and reasons.
 
-version: 1
+version: 2
+scanner_version: "X.Y.Z" # generated automatically; do not edit
 
 # Glob rules — human-authored, drift-tolerant (survive line/wording changes).
 # A finding is suppressed when EVERY field a rule sets glob-matches it.
@@ -31,7 +32,7 @@ rules:
 # Fingerprints — exact, machine-generated suppressions (one per accepted
 # finding). Regenerate with `skillspector baseline` when a skill changes.
 fingerprints:
-  - hash: "sha256:0123456789abcdef"
+  - hash: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
     rule_id: "SDI-2"
     file: "example-skill/SKILL.md"
     reason: "Accepted: reads its own environment ($EXAMPLE_TOKEN) for context"

CHANGELOG.md

@@ -1,3 +1,97 @@
+### 2.9.4 (Wednesday, August 12, 2026)
+### Features/Bug Fixes
+* fix(mcp): reject local targets over HTTP transport (#196)
+* Add Skill Inspector companion skill (#253)
+* fix(lp3): remediation and docs name allowed-tools for SKILL.md (#316)
+* chore(openssf-scorecard): Add badge (#351)
+* Detect whitespace padding used to hide prompt-injection instructions (P9) (#24)
+* fix(analyzers): HIGH SC8 when skill ships __pycache__ or .pyc (#357)
+* Revert "Scope the locality guard to the namespace"
+* Scope the locality guard to the namespace
+* fix(security): reject symlinks in skill walk + disable git symlinks on clone
+---
+### 2.9.3 (Tuesday, August 11, 2026)
+### Features/Bug Fixes
+* fix(llm): surface invalid responses as degraded (skipped, non-fatal, incomplete)
+---
+### 2.9.2 (Monday, August 10, 2026)
+### Features/Bug Fixes
+* fix(llm): retry malformed structured responses
+---
+### 2.9.1 (Monday, August 10, 2026)
+### Features/Bug Fixes
+* fix(llm): add bounded connection retries
+---
+### 2.9.0 (Monday, August 10, 2026)
+### Features/Bug Fixes
+* fix(e2): allow targeted environment credential reads
+* fix: remediate nSpect High vulnerabilities
+* fix(yara): require local destructive autonomy evidence
+---
+### 2.8.2 (Friday, August 07, 2026)
+### Features/Bug Fixes
+* fix(mcp): retry malformed TP4 responses
+---
+### 2.8.1 (Thursday, August 06, 2026)
+### Features/Bug Fixes
+* fix(llm): isolate malformed structured responses per batch
+---
+### 2.8.0 (Thursday, August 06, 2026)
+### Features/Bug Fixes
+* fix(baseline): exclude selected baseline from scans
+---
+### 2.7.2 (Thursday, August 06, 2026)
+### Features/Bug Fixes
+* fix(pe3): distinguish OAuth access-token nouns from credential access
+---
+### 2.7.0 (Thursday, August 06, 2026)
+### Features/Bug Fixes
+* fix(telemetry): harden inference usage normalization
+---
+### 2.6.0 (Wednesday, August 05, 2026)
+### Features/Bug Fixes
+* feat(release): auto-generate versioned release notes like CHANGELOG
+* feat(telemetry): export provider inference usage
+---
+### 2.5.3 (Tuesday, August 04, 2026)
+### Features/Bug Fixes
+* fix(analyzers): share Python AST parsing for environment-read detection (#332)
+* fix(output-handling): avoid RegExp.exec false positives (#341)
+* docs(skill): allow delegated import MR preparation
+* docs(lifecycle): optimize OSS import queue and cutoff
+---
+### 2.5.2 (Tuesday, August 04, 2026)
+### Features/Bug Fixes
+* test(mp2): lock the layout-span guard against regressions (#342)
+* fix(nv_build): cover reported model metadata (#279)
+* (chore) pin dependencies for workflows and Docker base images (#238)
+* fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)
+* fix(input-handler): bound URL, zip, and git ingest paths (#164)
+* fix: read exact versions from Python lockfiles for OSV (#263)
+* feat(mcp): add registry posture scanning (#280)
+* fix: exclude valid OMS signatures from content analysis (#261)
+* fix(static): markdown table and quote syntax is not an execution signal (#321)
+* fix(agent-cli): Windows temp-cwd cleanup must not fail a successful batch (#317)
+* fix(supply-chain): SC4 must not claim a vulnerability it did not verify (#319)
+* docs: link to the Verified Skills pipeline and hosted docs (#347)
+* test(release): make changelog assertions version-aware
+* fix(release): harden patch publishing and changelog baseline
+---
+### 2.5.1 (Thursday, July 30, 2026)
+### Features/Bug Fixes
+* feat(llm): configurable analyzer fan-out concurrency via SKILLSPECTOR_MAX_LLM_CONCURRENCY (part of #303) (#305)
+* release: prepare package and skill lifecycle
+* fix(analyzer): avoid OH1 false positives for subprocess --output and capture_output
+* docs: clarify 2.5.0 execution accounting
+---
+### 2.5.0 (Friday, July 24, 2026)
+### Features/Bug Fixes
+* feat: Implement canonical inspection ledger reporting
+* fix(security): harden P6, PE3, and baseline fingerprints
+* fix(release): preserve GitHub PR titles in changelog
+* feat: publish GitHub releases from labeled PRs
+* docs: add skill-driven GitHub lifecycle
+---
 ### 2.4.4 (Thursday, July 23, 2026)
 ### Features/Bug Fixes
 * fix(anthropic): re-apply ANTHROPIC_BASE_URL override reverted by 2.4.3 snapshot (#301)

Dockerfile

@@ -1,12 +1,12 @@
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.12-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS builder
 
 WORKDIR /app
 COPY pyproject.toml README.md ./
 COPY src/ src/
 RUN python -m venv .venv
 RUN .venv/bin/pip install --no-cache-dir .
 
-FROM python:3.12-slim-bookworm
+FROM python:3.12-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b
 
 RUN apt-get update \
     && apt-get install --no-install-recommends -y git ca-certificates \