Skip to main content
Atlan Trident scans each saved version of a skill before serving it, and the Security tab shows the latest decision, what the scan found — or, when it found nothing, what it checked — and how the result changed across scans. Use it to decide whether a version is safe to adopt and to see why a version was held back.

Scan decision

Each scan ends with one decision for the version. Atlan Trident works out the decision and each finding’s severity itself from the reported findings; it does not accept a scanner’s own summary. The decisions are: A scan can be waiting for a scanner or running; the tab says so until it finishes. When Scan now is offered, select it to start a scan. When many versions are published at once, their scans queue and a decision can take longer to appear; the tab keeps showing the scan as waiting until it finishes.

Findings and release gate

Findings lists what the latest scan found, with severity, the file and lines involved, and the scanner that reported it. Filter it by severity. Each finding is either Advisory, shown for review, or Blocking, which stops the version from being released. A blocked version shows Blocked in Source and cannot be released until a fixed version passes its scan, unless a workspace admin approves it without the scan. When a scanner cannot finish analyzing a file because of something in the file’s own content — an expression longer than its parser’s bound, or source it cannot parse — the scan reports File Not Fully Analyzed as a blocking finding on that file, naming the analyzers that stopped. The same content stops the scanner on every scan, so republishing the same files is blocked the same way: simplify the construct that stopped the scanner, such as splitting a long expression or a nested template string, or ask a workspace admin to review the file and approve an exception. To hand a finding to a coding agent for a fix, select Copy as prompt.

Security tab

When the latest scan found nothing, the tab says what was checked:
  • Decision: Reads Safe to install and says what the scan checked: how many scanners ran, how many kinds of risk they swept, whether they read every file in the version you’re viewing, and when it scanned. When some checks couldn’t run, it says so and counts them.
  • What was checked: The checks grouped by what a risky skill could do: Taking over the agent, Leaking your data, Doing more than it says, Tampered tools and files, and Known malware, plus Other checks for anything the groups above don’t cover. Hover a check to see what it looks for. Checks that didn’t run are counted in a line below the groups, which says they didn’t apply to this skill or that they were skipped; select Show to list them.
  • Checked by: Each scanner with its name and its number of checks, and the proofs the scan can make: that it read the exact files of the version you’re viewing, and what a finding would block — for example, A critical or high finding would block install.
  • History: Once there are two scans, one dot per recent scan, oldest left, with a sentence that counts the scans that found nothing and a picker for older scans. Selecting an older scan leaves this view for that scan’s findings.
Any other result keeps the findings layout:
  • Decision: The latest decision and the scanners that ran.
  • Findings: Every issue the latest scan found, by severity.
  • Coverage: The categories the scanners checked.
  • History: Each scan with its Scanner, Last ran, Found, and Decision, so you can see how the result changed.

Example

A team saves version 4 of meeting-notes-to-actions, which adds a script that posts follow-ups. The scan reports a Blocking finding in scripts/post.sh and the decision Do not install, so version 4 shows Blocked and version 3 stays released. The author copies the finding as a prompt, fixes the script in version 5, and its scan returns Pass, so version 5 can be released.

What scans do not prove

  • A pass is not a review. A scan checks known patterns; it does not prove the skill does what it claims. Read every supporting file in Source, especially scripts and templates.
  • A pass covers one version. Each version is scanned on its own. Check the decision for the version you actually use.
  • Not scanned is not safe. Treat a version with no scan as unreviewed.