fix: skills in readme

[mmilanta]

No description provided.

[qodo-merge-etso]

Review Summary by Qodo

Document skills scanning with --skills flag requirement

📝 Documentation

Walkthroughs

Description

• Clarify skills scanning requires --skills flag
• Add examples showing --skills flag usage
• Document --skills option in CLI options
• Remove skills from default scan description

Diagram

flowchart LR
  A["README.md"] -->|Add --skills flag docs| B["Usage examples"]
  A -->|Update description| C["Default behavior clarity"]
  A -->|Add CLI option| D["Options documentation"]

Loading

File Changes

1. README.md 📝 Documentation +15/-4

Document --skills flag requirement in README

• Updated description to clarify skills require --skills flag
• Added new example showing uvx snyk-agent-scan@latest --skills command
• Updated existing skill scanning examples to include --skills flag
• Added --skills option to CLI options documentation
• Removed "skills" from default scan vulnerabilities list

README.md

---

[qodo-merge-etso]

Code Review by Qodo

Sorry, something went wrong

We weren't able to complete the code review on our side. Please try again

ⓘ The new review experience is currently in Beta. Learn more

[qodo-merge-etso]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: test (macos-latest)

Failed stage: Run tests [❌]

Failed test name: tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/math_config.json-server_names1-binary]

Failure summary: The action failed because two E2E pytest assertions failed in tests/e2e/test_scan.py:127 (TestFullScanFlow.test_scan) when validating the set of issue codes returned by the scan --json command. - For tests/mcp_servers/configs_files/math_config.json and tests/mcp_servers/configs_files/all_config.json, the scan output produced issue_set = {'W001'}. - The tests expected issue_set to match one of the predefined allowed_issue_sets, all of which include W003 (and sometimes TF001/TF002), so {'W001'} did not match and the assertion failed. - Result: pytest reported 2 failed tests, make ci exited with error, and the GitHub Action ended with a non-zero exit code.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 424: tests/e2e/test_inspect.py::TestInspect::test_direct_scan[sse-binary] PASSED [ 6%] 425: tests/e2e/test_inspect.py::TestInspect::test_direct_scan_stdio_servers[npm_latest-binary] PASSED [ 6%] 426: tests/e2e/test_inspect.py::TestInspect::test_direct_scan_stdio_servers[npm_versioned-binary] PASSED [ 7%] 427: tests/e2e/test_inspect.py::TestInspect::test_direct_scan_stdio_servers[pypi_latest-binary] PASSED [ 7%] 428: tests/e2e/test_inspect.py::TestInspect::test_direct_scan_stdio_servers[pypi_versioned-binary] PASSED [ 8%] 429: tests/e2e/test_inspect.py::TestInspect::test_direct_scan_stdio_servers[oci-binary] PASSED [ 8%] 430: tests/e2e/test_inspect.py::TestInspect::test_vscode_settings_no_mcp[binary] PASSED [ 9%] 431: tests/e2e/test_scan.py::TestFullScanFlow::test_basic[claudestyle_config_file-binary] PASSED [ 9%] 432: tests/e2e/test_scan.py::TestFullScanFlow::test_basic[vscode_mcp_config_file-binary] PASSED [ 10%] 433: tests/e2e/test_scan.py::TestFullScanFlow::test_basic[vscode_config_file-binary] PASSED [ 10%] 434: tests/e2e/test_scan.py::TestFullScanFlow::test_basic[streamable_http_transport_config_file-binary] PASSED [ 11%] 435: tests/e2e/test_scan.py::TestFullScanFlow::test_basic[sse_transport_config_file-binary] PASSED [ 11%] 436: tests/e2e/test_scan.py::TestFullScanFlow::test_scan_sse_http[streamable_http_transport_config_file-binary] PASSED [ 12%] 437: tests/e2e/test_scan.py::TestFullScanFlow::test_scan_sse_http[sse_transport_config_file-binary] PASSED [ 12%] 438: tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/weather_config.json-server_names0-binary] PASSED [ 13%] 439: tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/math_config.json-server_names1-binary] FAILED [ 13%] 440: tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/all_config.json-server_names2-binary] FAILED [ 13%] 441: tests/e2e/test_scan.py::TestFullScanFlow::test_scan_skills_without_flag[skills_parent_dir-binary] PASSED [ 14%] ... 446: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[options_before_first_server_ignored] PASSED [ 16%] 447: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[no_control_servers] PASSED [ 17%] 448: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[control_server_without_url] PASSED [ 17%] 449: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[url_starts_with_dash] PASSED [ 18%] 450: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[with_other_cli_args] PASSED [ 18%] 451: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers[single_server_with_multiple_headers] PASSED [ 19%] 452: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers_missing_identifier[single_server_no_identifier] PASSED [ 19%] 453: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers_missing_identifier[single_server_headers_only_no_identifier] PASSED [ 20%] 454: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers_missing_identifier[multiple_servers_one_missing_identifier] PASSED [ 20%] 455: tests/unit/test_cli_parsing.py::TestControlServerParsing::test_parse_control_servers_missing_identifier[options_only_apply_to_preceding_server] PASSED [ 20%] 456: tests/unit/test_cli_parsing.py::TestCLIArgumentParsing::test_scan_with_multiple_control_servers_parses_correctly PASSED [ 21%] 457: tests/unit/test_cli_parsing.py::TestControlServerHeaderParsing::test_parse_headers_single_header PASSED [ 21%] 458: tests/unit/test_cli_parsing.py::TestControlServerHeaderParsing::test_parse_headers_multiple_headers PASSED [ 22%] 459: tests/unit/test_cli_parsing.py::TestControlServerHeaderParsing::test_parse_headers_none_input PASSED [ 22%] 460: tests/unit/test_cli_parsing.py::TestControlServerHeaderParsing::test_parse_headers_empty_list PASSED [ 23%] 461: tests/unit/test_cli_parsing.py::TestControlServerHeaderParsing::test_parse_headers_invalid_format_raises_error PASSED [ 23%] 462: tests/unit/test_cli_parsing.py::TestControlServerUploadIntegration::test_control_servers_passed_to_pipeline PASSED [ 24%] ... 464: tests/unit/test_cli_parsing.py::TestControlServerUploadIntegration::test_skip_ssl_verify_passed_to_pipeline PASSED [ 25%] 465: tests/unit/test_cli_parsing.py::TestJSONOutput::test_json_output_suppresses_stdout_during_scan PASSED [ 25%] 466: tests/unit/test_cli_parsing.py::TestJSONOutput::test_json_output_only_contains_json PASSED [ 26%] 467: tests/unit/test_config_scan.py::test_scan_mcp_config[claudestyle_config_file] PASSED [ 26%] 468: tests/unit/test_config_scan.py::test_scan_mcp_config[vscode_mcp_config_file] PASSED [ 26%] 469: tests/unit/test_config_scan.py::test_scan_mcp_config[vscode_config_file] PASSED [ 27%] 470: tests/unit/test_config_scan.py::test_scan_mcp_config[vscode_settings_file_with_empty_mcp] PASSED [ 27%] 471: tests/unit/test_config_scan.py::test_scan_mcp_config[vscode_settings_file_without_mcp] PASSED [ 28%] 472: tests/unit/test_config_scan.py::test_check_server_mocked PASSED [ 28%] 473: tests/unit/test_config_scan.py::test_math_server PASSED [ 29%] 474: tests/unit/test_config_scan.py::test_all_server PASSED [ 29%] 475: tests/unit/test_config_scan.py::test_weather_server PASSED [ 30%] 476: tests/unit/test_config_scan.py::test_vscode_settings_file_without_mcp PASSED [ 30%] 477: tests/unit/test_config_scan.py::test_vscode_settings_file_with_empty_mcp PASSED [ 31%] 478: tests/unit/test_control_server.py::test_upload_payload_excludes_hostname_and_username PASSED [ 31%] 479: tests/unit/test_control_server.py::test_upload_includes_scan_error_in_payload PASSED [ 32%] 480: tests/unit/test_control_server.py::test_upload_file_not_found_error_in_payload PASSED [ 32%] 481: tests/unit/test_control_server.py::test_upload_parse_error_in_payload PASSED [ 33%] 482: tests/unit/test_control_server.py::test_upload_server_http_error_in_payload PASSED [ 33%] 483: tests/unit/test_control_server.py::test_upload_server_startup_error_in_payload PASSED [ 33%] 484: tests/unit/test_control_server.py::test_upload_retries_on_network_error PASSED [ 34%] 485: tests/unit/test_control_server.py::test_upload_retries_on_server_error PASSED [ 34%] 486: tests/unit/test_control_server.py::test_upload_does_not_retry_on_client_error PASSED [ 35%] 487: tests/unit/test_control_server.py::test_upload_succeeds_on_second_attempt PASSED [ 35%] 488: tests/unit/test_control_server.py::test_upload_custom_max_retries PASSED [ 36%] 489: tests/unit/test_control_server.py::test_upload_exponential_backoff PASSED [ 36%] 490: tests/unit/test_control_server.py::test_upload_does_not_retry_on_unexpected_error PASSED [ 37%] 491: tests/unit/test_control_server.py::test_upload_unknown_mcp_config_error_in_payload PASSED [ 37%] 492: tests/unit/test_entity_to_tool.py::test_entity_to_tool[tests/mcp_servers/signatures/math_server_signature.json] PASSED [ 38%] ... 569: tests/unit/test_utils.py::TestRebalanceCommandArgsWithSpacesInPath::test_full_command_is_path_with_spaces_no_args PASSED [ 73%] 570: tests/unit/test_utils.py::test_calculate_distance PASSED [ 74%] 571: tests/unit/test_utils.py::TestSuppressStdout::test_suppress_stdout_suppresses_print PASSED [ 74%] 572: tests/unit/test_utils.py::TestSuppressStdout::test_suppress_stdout_restores_stdout_after_context PASSED [ 75%] 573: tests/unit/test_utils.py::TestSuppressStdout::test_suppress_stdout_works_with_multiple_prints PASSED [ 75%] 574: tests/unit/test_verify_api.py::TestProxySupport::test_analyze_machine_honors_http_proxy_env PASSED [ 76%] 575: tests/unit/test_verify_api.py::TestProxySupport::test_analyze_machine_honors_https_proxy_env PASSED [ 76%] 576: tests/unit/test_verify_api.py::TestProxySupport::test_analyze_machine_works_without_proxy PASSED [ 77%] 577: tests/unit/test_verify_api.py::TestProxySupport::test_analyze_machine_with_skip_ssl_verify_and_proxy PASSED [ 77%] 578: tests/unit/test_verify_api.py::TestProxySupport::test_setup_tcp_connector_with_ssl_verify PASSED [ 78%] 579: tests/unit/test_verify_api.py::TestProxySupport::test_setup_tcp_connector_without_ssl_verify PASSED [ 78%] 580: tests/unit/test_verify_api.py::TestAnalyzeMachineRetries::test_analyze_machine_retries_on_timeout PASSED [ 79%] 581: tests/unit/test_verify_api.py::TestAnalyzeMachineHeaders::test_analyze_machine_includes_additional_headers PASSED [ 79%] 582: tests/unit/test_verify_api.py::TestAnalyzeMachineScanMetadata::test_analyze_machine_includes_scan_metadata_when_scan_context_provided PASSED [ 80%] 583: tests/unit/test_verify_api.py::TestAnalyzeMachineScanMetadata::test_analyze_machine_omits_scan_metadata_when_scan_context_not_provided PASSED [ 80%] 584: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[400] PASSED [ 80%] 585: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[401] PASSED [ 81%] 586: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[403] PASSED [ 81%] 587: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[413] PASSED [ 82%] 588: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[422] PASSED [ 82%] 589: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[429] PASSED [ 83%] 590: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[500] PASSED [ 83%] 591: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[502] PASSED [ 84%] 592: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[503] PASSED [ 84%] 593: tests/unit/test_verify_api.py::TestAnalyzeMachineHttpErrors::test_analyze_machine_http_error_responses[504] PASSED [ 85%] 594: tests/v4compatibility/test_inspect.py::test_get_mcp_config_per_client[client0-valid-True-True] PASSED [ 85%] ... 611: tests/v4compatibility/test_inspect.py::test_inspect_skill[xlsx-skill_server2] PASSED [ 93%] 612: tests/v4compatibility/test_inspect.py::test_inspect_skill[pdf-skill_server3] PASSED [ 93%] 613: tests/v4compatibility/test_inspect.py::test_inspect_skill[algorithmic-art-skill_server4] PASSED [ 94%] 614: tests/v4compatibility/test_inspect.py::test_inspect_skill[malicious-skill-skill_server5] PASSED [ 94%] 615: tests/v4compatibility/test_inspect.py::test_inspect_skill[internal-comms-skill_server6] PASSED [ 95%] 616: tests/v4compatibility/test_inspect.py::test_inspect_skill[skill-creator-skill_server7] PASSED [ 95%] 617: tests/v4compatibility/test_inspect.py::test_inspect_skill[canvas-design-skill_server8] PASSED [ 96%] 618: tests/v4compatibility/test_inspect.py::test_inspect_skill[pptx-skill_server9] PASSED [ 96%] 619: tests/v4compatibility/test_inspect.py::test_inspect_skill[slack-gif-creator-skill_server10] PASSED [ 97%] 620: tests/v4compatibility/test_inspect.py::test_inspect_skill[webapp-testing-skill_server11] PASSED [ 97%] 621: tests/v4compatibility/test_inspect.py::test_inspect_skill[frontend-design-skill_server12] PASSED [ 98%] 622: tests/v4compatibility/test_inspect.py::test_inspect_skill[mcp-builder-skill_server13] PASSED [ 98%] 623: tests/v4compatibility/test_inspect.py::test_inspect_skill[brand-guidelines-skill_server14] PASSED [ 99%] 624: tests/v4compatibility/test_inspect.py::test_inspect_skill[docx-skill_server15] PASSED [ 99%] 625: tests/v4compatibility/test_inspect.py::test_inspect_skill[web-artifacts-builder-skill_server16] PASSED [100%] 626: =================================== FAILURES =================================== 627: _ TestFullScanFlow.test_scan[tests/mcp_servers/configs_files/math_config.json-server_names1-binary] _ ... 639: ], 640: ) 641: def test_scan(self, agent_scan_cmd, path, server_names): 642: result = subprocess.run( 643: [ 644: *agent_scan_cmd, 645: "scan", 646: "--json", 647: path, 648: "--analysis-url", 649: "https://api.snyk.io/hidden/mcp-scan/analysis-machine?version=2025-09-07", 650: ], 651: capture_output=True, 652: text=True, 653: ) 654: assert result.returncode == 0, f"Command failed with error: {result.stderr}" 655: output = json.loads(result.stdout) 656: for server in output[path]["servers"]: 657: server["signature"]["metadata"]["serverInfo"]["version"] = ( 658: "mcp_version" # swap actual version with placeholder 659: ) 660: with open(f"tests/mcp_servers/signatures/{server['name'].lower()}_server_signature.json") as f: 661: assert server["signature"] == json.load(f), f"Signature mismatch for {server['name']} server" 662: assert len(output) == 1, "Output should contain exactly one entry for the config file" 663: path = next(iter(output.keys())) 664: errors = output[path]["error"] 665: assert errors is None, f"Error should not be present, found: {errors}" 666: issues = output[path]["issues"] 667: issue_set = {issue["code"] for issue in issues} 668: if set(server_names) == {"Weather", "Math"}: 669: allowed_issue_sets = [{"W001", "W003", "TF001", "TF002"}, {"W001", "W003", "TF002"}, {"W001", "W003"}] 670: elif set(server_names) == {"Weather"}: 671: allowed_issue_sets = [{"W003"}, {"W003", "TF001"}, set()] 672: elif set(server_names) == {"Math"}: 673: allowed_issue_sets = [{"W001", "W003"}, {"W001", "W003", "TF002"}] 674: else: 675: raise ValueError(f"Invalid server names: {server_names}") 676: # call list for better error message 677: > assert any(issue_set == ais for ais in allowed_issue_sets), ( 678: f"Issues codes {issue_set} do not match expected values {allowed_issue_sets}" 679: ) 680: E AssertionError: Issues codes {'W001'} do not match expected values [{'W003', 'W001'}, {'TF002', 'W003', 'W001'}] 681: E assert False 682: E + where False = any(<generator object TestFullScanFlow.test_scan.<locals>.<genexpr> at 0x105276670>) 683: tests/e2e/test_scan.py:127: AssertionError 684: _ TestFullScanFlow.test_scan[tests/mcp_servers/configs_files/all_config.json-server_names2-binary] _ ... 696: ], 697: ) 698: def test_scan(self, agent_scan_cmd, path, server_names): 699: result = subprocess.run( 700: [ 701: *agent_scan_cmd, 702: "scan", 703: "--json", 704: path, 705: "--analysis-url", 706: "https://api.snyk.io/hidden/mcp-scan/analysis-machine?version=2025-09-07", 707: ], 708: capture_output=True, 709: text=True, 710: ) 711: assert result.returncode == 0, f"Command failed with error: {result.stderr}" 712: output = json.loads(result.stdout) 713: for server in output[path]["servers"]: 714: server["signature"]["metadata"]["serverInfo"]["version"] = ( 715: "mcp_version" # swap actual version with placeholder 716: ) 717: with open(f"tests/mcp_servers/signatures/{server['name'].lower()}_server_signature.json") as f: 718: assert server["signature"] == json.load(f), f"Signature mismatch for {server['name']} server" 719: assert len(output) == 1, "Output should contain exactly one entry for the config file" 720: path = next(iter(output.keys())) 721: errors = output[path]["error"] 722: assert errors is None, f"Error should not be present, found: {errors}" 723: issues = output[path]["issues"] 724: issue_set = {issue["code"] for issue in issues} 725: if set(server_names) == {"Weather", "Math"}: 726: allowed_issue_sets = [{"W001", "W003", "TF001", "TF002"}, {"W001", "W003", "TF002"}, {"W001", "W003"}] 727: elif set(server_names) == {"Weather"}: 728: allowed_issue_sets = [{"W003"}, {"W003", "TF001"}, set()] 729: elif set(server_names) == {"Math"}: 730: allowed_issue_sets = [{"W001", "W003"}, {"W001", "W003", "TF002"}] 731: else: 732: raise ValueError(f"Invalid server names: {server_names}") 733: # call list for better error message 734: > assert any(issue_set == ais for ais in allowed_issue_sets), ( 735: f"Issues codes {issue_set} do not match expected values {allowed_issue_sets}" 736: ) 737: E AssertionError: Issues codes {'W001'} do not match expected values [{'TF002', 'W003', 'W001', 'TF001'}, {'TF002', 'W003', 'W001'}, {'W003', 'W001'}] 738: E assert False 739: E + where False = any(<generator object TestFullScanFlow.test_scan.<locals>.<genexpr> at 0x1052edcb0>) 740: tests/e2e/test_scan.py:127: AssertionError 741: =============================== warnings summary =============================== 742: tests/unit/test_control_server.py: 25 warnings 743: tests/unit/test_verify_api.py: 20 warnings 744: /Users/runner/work/agent-scan/agent-scan/.venv/lib/python3.13/site-packages/aiohttp/connector.py:993: DeprecationWarning: enable_cleanup_closed ignored because https://github.com/python/cpython/pull/118960 is fixed in Python version sys.version_info(major=3, minor=13, micro=12, releaselevel='final', serial=0) 745: super().__init__( 746: -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html 747: =========================== short test summary info ============================ 748: FAILED tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/math_config.json-server_names1-binary] - AssertionError: Issues codes {'W001'} do not match expected values [{'W003', 'W001'}, {'TF002', 'W003', 'W001'}] 749: assert False 750: + where False = any(<generator object TestFullScanFlow.test_scan.<locals>.<genexpr> at 0x105276670>) 751: FAILED tests/e2e/test_scan.py::TestFullScanFlow::test_scan[tests/mcp_servers/configs_files/all_config.json-server_names2-binary] - AssertionError: Issues codes {'W001'} do not match expected values [{'TF002', 'W003', 'W001', 'TF001'}, {'TF002', 'W003', 'W001'}, {'W003', 'W001'}] 752: assert False 753: + where False = any(<generator object TestFullScanFlow.test_scan.<locals>.<genexpr> at 0x1052edcb0>) 754: ========== 2 failed, 213 passed, 33 deselected, 45 warnings in 48.13s ========== 755: make: *** [ci] Error 1 756: ##[error]Process completed with exit code 2. 757: Post job cleanup.