> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Submit a Skill Scan > Queues a security scan of one agent skill: a git repository plus the path of the skill directory inside it. The scan runs asynchronously (roughly 30–90 seconds); poll the returned `scan_id` with Get Skill Scan. Pinning `commit` is recommended. It fixes exactly what gets scanned, and it is what makes the result cacheable: an identical pinned input that has already succeeded comes back immediately with `cached: true` and HTTP `200` instead of being re-scanned. Pass `?force=true` to bypass the cache. The scan is attributed to the user behind your API key. `user_email` is supplied by the gateway, so sending it — or `user_id`, `org_id`, `project_name` — returns `400`. ## OpenAPI ````yaml POST /skill-hub/scan openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. paths: /skill-hub/scan: post: tags: - Skill Scanner summary: Submit a Skill Scan description: >- Queues a security scan of one agent skill: a git repository plus the path of the skill directory inside it. The scan runs asynchronously (roughly 30–90 seconds); poll the returned `scan_id` with Get Skill Scan. Pinning `commit` is recommended. It fixes exactly what gets scanned, and it is what makes the result cacheable: an identical pinned input that has already succeeded comes back immediately with `cached: true` and HTTP `200` instead of being re-scanned. Pass `?force=true` to bypass the cache. The scan is attributed to the user behind your API key. `user_email` is supplied by the gateway, so sending it — or `user_id`, `org_id`, `project_name` — returns `400`. operationId: skill_scanner_create_scan parameters: - name: force in: query required: false schema: type: boolean default: false description: >- Bypass the dedup cache and force a fresh scan even when an identical pinned input already succeeded. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SkillScannerScanRequest' examples: pinned-commit: summary: Scan a skill at a pinned commit (recommended) value: git_url: https://github.com/affaan-m/ECC.git skill_path: .agents/skills/api-design commit: 2bc924aa11bb22cc33dd44ee55ff6677889900aa branch: summary: Scan the tip of a branch value: git_url: https://github.com/affaan-m/ECC.git skill_path: .agents/skills/api-design ref: main unpinned: summary: Scan the default branch (no dedup) value: git_url: https://github.com/affaan-m/ECC.git skill_path: .agents/skills/api-design responses: '200': description: >- Cached result for an identical pinned input — the scan was not re-run. The record is recorded under your own `user_email` and returned complete, with `cached: true`. content: application/json: schema: $ref: '#/components/schemas/SkillScannerScanRecord' examples: cached: summary: Cache hit value: scan_id: 223e4567-e89b-12d3-a456-426614174111 status: succeeded cached: true user_email: user@example.com repo: affaan-m/ECC skill_name: api-design verdict: SAFE risk_level: SAFE findings_count: 0 stars: 128 '202': description: Scan queued content: application/json: schema: $ref: '#/components/schemas/SkillScannerScanRecord' examples: queued: summary: New scan queued value: scan_id: 123e4567-e89b-12d3-a456-426614174000 status: queued cached: false user_email: user@example.com repo: affaan-m/ECC git_url: https://github.com/affaan-m/ECC.git skill_path: .agents/skills/api-design commit: 2bc924aa11bb22cc33dd44ee55ff6677889900aa model: gpt-5.4-mini created_at: '2026-08-24T10:00:00Z' '400': $ref: '#/components/responses/SkillScannerBadRequest' '401': $ref: '#/components/responses/SkillScannerUnauthorized' '422': $ref: '#/components/responses/SkillScannerValidationError' '503': description: >- Storage not configured on the scanner — scan endpoints are unavailable. components: schemas: SkillScannerScanRequest: title: SkillScannerScanRequest type: object required: - git_url - skill_path description: >- Body of Submit a Skill Scan. `user_email` is deliberately absent: the gateway derives it from your API key, and sending it returns `400`. The scanner's `model` and `source_content_hash` inputs are likewise not exposed. properties: git_url: type: string description: >- Full http(s) git clone URL. For github.com URLs the `owner/name` is derived server-side and stored as `repo` (used for the star count and the `?repo=` filter). example: https://github.com/affaan-m/ECC.git skill_path: type: string description: Path of the skill directory, relative to the repo root. example: .agents/skills/api-design commit: type: string description: >- Commit SHA to pin the checkout to. Recommended — it is what enables the dedup cache. ref: type: string description: Branch or tag to check out when no `commit` is given. SkillScannerScanRecord: title: SkillScannerScanRecord type: object required: - scan_id - status description: >- One scan job/result. Fields are omitted rather than nulled, so most of them appear only once `status` is `succeeded`. Note `error` belongs to the RECORD — it is set when the scan itself failed, and the HTTP response is still `200`. properties: scan_id: type: string status: type: string enum: - queued - running - succeeded - failed description: >- `queued`/`running` mean the worker is still going; `succeeded`/`failed` are terminal. cached: type: boolean default: false description: >- `true` when this record copied an existing successful scan of an identical pinned input instead of re-scanning. user_email: type: string description: >- The user the scan is attributed to, lower-cased. Set by the gateway from the submitting API key. repo: type: string description: '`owner/name`, derived from `git_url` for github.com URLs.' git_url: type: string skill_path: type: string skill_name: type: string description: The skill's own declared name, read out of the skill. commit: type: string ref: type: string model: type: string description: The model the scan actually ran on. stars: type: integer description: The repository's GitHub star count, fetched live at scan time. content_hash: type: string description: Hash of the scanned skill content. source_content_hash: type: string verdict: type: string description: >- The scanner's overall verdict for the skill, passed through from the report's `overall_risk_assessment.skill_verdict`. UPPERCASE, e.g. `SAFE` or `SUSPICIOUS`. Deliberately not typed as an enum here: the vocabulary belongs to the analysis engine, so treat it as an opaque string and compare case-sensitively. example: SAFE risk_level: type: string description: >- Severity band for the findings, passed through from the report. UPPERCASE, e.g. `SAFE`, `MEDIUM` or `HIGH`. Same caveat as `verdict` — an opaque, engine-defined string. example: SAFE findings_count: type: integer scan_duration_seconds: type: number token_usage: type: object additionalProperties: true description: Token accounting for the scan. report: type: object additionalProperties: true description: >- The full report document. Also available on its own from Get Skill Scan Report. error: type: string description: Why the scan failed. Present only when `status` is `failed`. attempts: type: integer description: How many times the worker has attempted this scan. created_at: type: string started_at: type: string finished_at: type: string SkillScannerErrorResponse: title: SkillScannerErrorResponse type: object description: Error envelope returned by the Skill Scanner gateway. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: >- Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access. request_id: type: string time: type: number SkillScannerUpstreamValidationError: title: SkillScannerUpstreamValidationError type: object description: >- FastAPI validation-error envelope from the scanner, passed through by the gateway. properties: detail: type: array items: type: object properties: type: type: string example: value_error loc: type: array items: type: string example: - body - git_url msg: type: string example: Value error, git_url must be a full http(s) clone URL responses: SkillScannerBadRequest: description: >- Bad Request — most often a gateway-owned field was supplied (`user_email`, `user_id`, `org_id`, `project_name`) or an unexposed scanner field was (`model`, `source_content_hash`). content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerUnauthorized: description: Unauthorized — missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerValidationError: description: >- Validation Error — raised by the scanner itself and passed through, so the body is the FastAPI `detail` envelope rather than the gateway error envelope the 400/401/403 responses use. A missing or malformed field the gateway owns cannot reach this: `user_email` is always supplied by the gateway, and a client-supplied one is a `400` before the request is forwarded. content: application/json: schema: $ref: '#/components/schemas/SkillScannerUpstreamValidationError' securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````