Function scanSkillFile

layers/foundation-scan.ts:583–664

(
  skill: Skill,
  filePath: string,
  metadataSummary: string,
  llmContext: LlmCallContext,
  logger: LoggerLike,
  options: Required<FoundationScanConfig>,
)

}

async function scanSkillFile(
  skill: Skill,
  filePath: string,
  metadataSummary: string,
  llmContext: LlmCallContext,
  logger: LoggerLike,
  options: Required<FoundationScanConfig>,
): Promise<Warning | null> {
  try {
    const content = fs.readFileSync(filePath, "utf-8");
    const contentHash = calculateContentHash(content);

    if (TRUSTED_FILE_HASHES.has(contentHash)) {
      logger?.info(`[FoundationScan] trusted hash hit: skill=${skill.name ?? "(unknown)"}, file=${filePath}`);
      return null;
    }

    if (options.detectMaliciousSkills.ruleBasedDetection) {
      const ruleDetection = detectByRules(content);
      if (ruleDetection?.blocked) {
        logger?.warn(`[FoundationScan] RuleBased detection blocked: skill=${skill.name ?? "(unknown)"}, file=${filePath}, reason=${ruleDetection.reason}`);
        return createMaliciousWarning(`Skill: ${skill.name}\nFile: ${filePath}\nReason: ${ruleDetection.reason}`);
      }
    }

    if (options.detectMaliciousSkills.semanticDetection) {
      logger?.info(`[FoundationScan] SemanticBased detection: skill=${skill.name ?? "(unknown)"}, file=${filePath}`);
      let semanticDetection: Detection | null = null;
      if (metadataSummary) {
        logger?.info(`[FoundationScan] SemanticBased detection: using API with metadata summary (length=${metadataSummary.length})`);
        const detectionResult = await detectSkillContentRisk(
          skill,
          metadataSummary,
          filePath,
          content,
          llmContext,
          logger,
          options.detectMaliciousSkills.maxContentLength,
        );
        if (detectionResult) {
          logger?.info(`[FoundationScan] SemanticBased detection result - aligned=${detectionResult.aligned}, malicious=${detectionResult.malicious}, reason=${detectionResult.reason.substring(0, 200)}...`);
        } else {
          logger?.warn(`[FoundationScan] SemanticBased detection: API returned null, assuming benign`);
        }
        if (detectionResult?.malicious || detectionResult?.aligned === false) {
          const issueType = detectionResult?.malicious ? "MALICIOUS CONTENT" : "MISALIGNED CONTENT";
          const detailedReason = detectionResult?.reason || "Content judged as potentially harmful or misaligned";
          semanticDetection = {
            blocked: true,
            reason: `[FILE ANALYSIS] ${issueType} detected in skill file.\n` +
              `📋 Skill: ${skill.name}\n` +
              `📄 File: ${filePath}\n` +
              `⚠️  Detection Type: ${detectionResult?.malicious ? 'Malicious Intent' : 'Capability Misalignment'} (Semantic Analysis)\n` +
              `🔍 Specific Reason: ${detailedReason}\n` +
              `💡 Impact: ${detectionResult?.malicious ? 'This file may attempt to perform unauthorized or harmful actions.' : 'This file deviates from the skill\'s intended capability.'}`
          };
        }
      } else {