Almanax scan commit

Skill almanax-ai/almanax-security-plugin/.agents/skills/almanax-scan-commit

Use Almanax to scan a Git commit diff for vulnerabilities and then summarize or fix the resulting findings.From its SKILL.md

Install

npx -y skills add almanax-ai/almanax-security-plugin --skill almanax-scan-commit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, as published. Nobody here has run it

Use Almanax to scan a commit diff and work from the resulting findings.

Workflow:

Determine repo_owner, repo_name, and commit_sha from the user request.
If the user asks to scan the current commit or a recent commit range like "last three commits", infer the current repository and HEAD commit from the local git checkout.
If the user provides or clearly implies a range, include base_sha. Treat requests like "last three commits" as one diff scan ending at HEAD, not three separate scans. Ask a follow-up only if the intended range is ambiguous.
If Almanax tools are unavailable or authentication appears broken, guide the user through setup inline:
- Explain that Almanax is available through the hosted MCP server at https://mcp.almanax.ai.
- Direct them to https://app.almanax.ai to create an API key from their organization settings under Account -> API keys.
- Tell them to set the key in their shell: export ALMANAX_API_KEY="their_api_key"
- Tell them to add the Almanax MCP server: codex mcp add --url https://mcp.almanax.ai --bearer-token-env-var ALMANAX_API_KEY almanax
- Tell them to verify the server connection with: codex mcp list
- If they prefer file-based setup, tell them to add the following to ~/.codex/config.toml or a project-scoped .codex/config.toml:
```
[mcp_servers.almanax]
url = "https://mcp.almanax.ai"
bearer_token_env_var = "ALMANAX_API_KEY"
```
Call almanax_scan_commit.
If Almanax returns selection_required=true, prefer a shared organization project when the user asks for the shared org; otherwise ask the user which org or project to use.
Follow next_action exactly. If next_action=poll_status, wait the full recommended_poll_after_seconds before calling almanax_get_scan_status again, and do not busy-poll.
When findings are available, summarize them clearly by severity and affected area.
If the user wants help fixing issues, address the highest severity findings first.

Important:

Never ask the user to paste or expose their API key.
If the scan fails because the repository is unavailable in Almanax, explain that they may need to connect GitHub or link the repository in Almanax first.

One thing to look at

What its file declares

SKILL.md

Keep looking