curl --request POST \
  --url https://api.enkryptai.com/skill-hub/scan \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa"
}
'

{
  "scan_id": "223e4567-e89b-12d3-a456-426614174111",
  "status": "succeeded",
  "cached": true,
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "skill_name": "api-design",
  "verdict": "SAFE",
  "risk_level": "SAFE",
  "findings_count": 0,
  "stars": 128
}

{
  "scan_id": "123e4567-e89b-12d3-a456-426614174000",
  "status": "queued",
  "cached": false,
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa",
  "model": "gpt-5.4-mini",
  "created_at": "2026-08-24T10:00:00Z"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access.",
  "request_id": "<string>",
  "time": 123
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access.",
  "request_id": "<string>",
  "time": 123
}

{
  "detail": [
    {
      "type": "value_error",
      "loc": [
        "body",
        "git_url"
      ],
      "msg": "Value error, git_url must be a full http(s) clone URL"
    }
  ]
}

📜 Skill Scanner API

Submit a Skill Scan

Queues a security scan of one agent skill: a git repository plus the path of the skill directory inside it. The scan runs asynchronously (roughly 30–90 seconds); poll the returned scan_id with Get Skill Scan.

Pinning commit is recommended. It fixes exactly what gets scanned, and it is what makes the result cacheable: an identical pinned input that has already succeeded comes back immediately with cached: true and HTTP 200 instead of being re-scanned. Pass ?force=true to bypass the cache.

The scan is attributed to the user behind your API key. user_email is supplied by the gateway, so sending it — or user_id, org_id, project_name — returns 400.

POST

skill-hub

scan

curl --request POST \
  --url https://api.enkryptai.com/skill-hub/scan \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa"
}
'

{
  "scan_id": "223e4567-e89b-12d3-a456-426614174111",
  "status": "succeeded",
  "cached": true,
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "skill_name": "api-design",
  "verdict": "SAFE",
  "risk_level": "SAFE",
  "findings_count": 0,
  "stars": 128
}

{
  "scan_id": "123e4567-e89b-12d3-a456-426614174000",
  "status": "queued",
  "cached": false,
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa",
  "model": "gpt-5.4-mini",
  "created_at": "2026-08-24T10:00:00Z"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access.",
  "request_id": "<string>",
  "time": 123
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access.",
  "request_id": "<string>",
  "time": 123
}

{
  "detail": [
    {
      "type": "value_error",
      "loc": [
        "body",
        "git_url"
      ],
      "msg": "Value error, git_url must be a full http(s) clone URL"
    }
  ]
}

Authorizations

apikey

string

header

required

Query Parameters

force

boolean

default:false

Bypass the dedup cache and force a fresh scan even when an identical pinned input already succeeded.

Body

application/json

Body of Submit a Skill Scan. user_email is deliberately absent: the gateway derives it from your API key, and sending it returns 400. The scanner's model and source_content_hash inputs are likewise not exposed.

git_url

string

required

Full http(s) git clone URL. For github.com URLs the owner/name is derived server-side and stored as repo (used for the star count and the ?repo= filter).

Example:

"https://github.com/affaan-m/ECC.git"

skill_path

string

required

Path of the skill directory, relative to the repo root.

Example:

".agents/skills/api-design"

commit

string

Commit SHA to pin the checkout to. Recommended — it is what enables the dedup cache.

ref

string

Branch or tag to check out when no commit is given.

Response

Cached result for an identical pinned input — the scan was not re-run. The record is recorded under your own user_email and returned complete, with cached: true.

One scan job/result. Fields are omitted rather than nulled, so most of them appear only once status is succeeded. Note error belongs to the RECORD — it is set when the scan itself failed, and the HTTP response is still 200.

scan_id

string

required

status

enum<string>

required

queued/running mean the worker is still going; succeeded/failed are terminal.

Available options:

queued,

running,

succeeded,

failed

cached

boolean

default:false

true when this record copied an existing successful scan of an identical pinned input instead of re-scanning.

user_email

string

The user the scan is attributed to, lower-cased. Set by the gateway from the submitting API key.

repo

string

owner/name, derived from git_url for github.com URLs.

git_url

string

skill_path

string

skill_name

string

The skill's own declared name, read out of the skill.

commit

string

ref

string

model

string

The model the scan actually ran on.

stars

integer

The repository's GitHub star count, fetched live at scan time.

content_hash

string

Hash of the scanned skill content.

source_content_hash

string

verdict

string

The scanner's overall verdict for the skill, passed through from the report's overall_risk_assessment.skill_verdict. UPPERCASE, e.g. SAFE or SUSPICIOUS. Deliberately not typed as an enum here: the vocabulary belongs to the analysis engine, so treat it as an opaque string and compare case-sensitively.

Example:

"SAFE"

risk_level

string

Severity band for the findings, passed through from the report. UPPERCASE, e.g. SAFE, MEDIUM or HIGH. Same caveat as verdict — an opaque, engine-defined string.

Example:

"SAFE"

findings_count

integer

scan_duration_seconds

number

token_usage

object

Token accounting for the scan.

report

object

The full report document. Also available on its own from Get Skill Scan Report.

error

string

Why the scan failed. Present only when status is failed.

attempts

integer

How many times the worker has attempted this scan.

created_at

string

started_at

string

finished_at

string