CMIC Skill Scanner (Linux ARM64)v0.11.1

A skill marketplace operator runs the CMIC Skill Scanner wrapper over every submitted skill package before publishing it to users. The wrapper's auto engine attempts a local external scanner and falls back to the native engine when none exists, producing a Markdown report that flags suspicious patterns. This lets the marketplace block risky submissions without building custom scanning infrastructure.

A platform team adds skillscan review to their CI pipeline so every release bundle pulled from Gitee or GitHub is audited before deployment. Because the tool only reads files under the target path and defaults to offline operation, it fits air-gapped runners while still surfacing findings via structured reports.

An enterprise enables --use-llm with a self-hosted endpoint to add semantic analysis on top of static findings for internal agent skills. Redaction of api_key/token/password/secret lines plus bounded packet sizes keep sensitive text from leaking to the trusted local endpoint, supporting compliance review workflows.

A solo developer verifies the bundled Linux ARM64 binary's SHA-256 checksum and runs skillscan review on a downloaded skill before installing it into their agent. The default auto mode performs a fast local check without any network upload, which suits privacy-conscious users on Apple Silicon or ARM servers.

A security researcher uses the external engine option to enforce a Cisco-compatible scanner and feed results into a larger triage pipeline. Passing --engine external guarantees the external tool's verdict, while SKILL_SCANNER_LLM_* variables allow controlled LLM review integration for deeper semantic inspection.

Distribute the open-source (MIT-0) skillscanner binary for free and monetize a hosted LLM endpoint that performs semantic review beyond static pattern matching. Free users rely on the native engine locally, while paying teams get enhanced detection and reporting.

Offer a hosted service that marketplaces and registries call to audit submitted skill packages before publishing. The provider runs skillscan on managed infrastructure, handles checksum verification, and returns structured JSON findings via API.

Sell an enterprise platform that integrates the skillscan wrapper into governance workflows, aggregating scan reports, engine fallback reasons, and LLM semantic results into audit trails. Customers configure their own endpoints, and the vendor provides policy templates and retention tooling.