ktg-plugin-marketplace/plugins/llm-security/commands/registry.md

name	description	allowed-tools	model
security:registry	Skill signature registry — view stats, scan and register skills, search known fingerprints	Bash, Read, Agent	sonnet

/security registry [scan <path|url> | search ]

Local database of known skill fingerprints and risk profiles. Enables instant re-scan detection.

Step 1: Parse Sub-command

Extract from $ARGUMENTS:

• Empty or stats → show stats
• scan <path|url> → scan and register
• search <pattern> → search registry

Determine plugin root (parent of this commands/ folder).

Step 2a: Stats (default)

node -e "
import { getStats, listEntries } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const stats = getStats('<plugin-root>');
const recent = listEntries({}, '<plugin-root>').slice(0, 5);
console.log(JSON.stringify({ stats, recent }));
" --input-type=module

Display:

## Skill Signature Registry

| Metric | Value |
|--------|-------|
| Total entries | X |
| Scanned | X |
| Seed | X |
| ALLOW | X |
| WARNING | X |
| BLOCK | X |
| Stale (>7d) | X |
| Avg risk score | X/100 |

### Recent Entries
| Name | Verdict | Risk | Last Scanned |

Step 2b: Scan and Register

Resolve target — if $ARGUMENTS contains a URL, clone via node <plugin-root>/scanners/lib/git-clone.mjs clone "<url>" first.

Fingerprint:

node -e "
import { fingerprintSkill, checkRegistry } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const result = fingerprintSkill('<target>');
const check = checkRegistry(result.fingerprint, '<plugin-root>');
console.log(JSON.stringify({ ...result, ...check }));
" --input-type=module

If found and not stale: Display cached result. Skip full scan.

## Registry Hit

**Name:** <name> | **Fingerprint:** <first 12 chars>
**Verdict:** <verdict> | **Risk Score:** <score>/100
**Last scanned:** <date> | **Scan count:** <n>
**Status:** Cached result (use `/security scan` to force re-scan)

If not found or stale: Run /security scan <target>, then register:

node -e "
import { registerScan } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const result = registerScan({
  skillPath: '<target>',
  fingerprint: '<fingerprint>',
  name: '<name>',
  files: <files_json>,
  verdict: '<verdict>',
  risk_score: <score>,
  counts: <counts_json>,
  files_scanned: <n>
}, '<plugin-root>');
console.log(JSON.stringify(result.entry));
" --input-type=module

Display: "Registered: (<fingerprint first 12>) — "

Clean up clone if remote.

Step 2c: Search

node -e "
import { searchRegistry } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const matches = searchRegistry('<pattern>', '<plugin-root>');
console.log(JSON.stringify(matches));
" --input-type=module

Display results table:

## Registry Search: "<pattern>"

**Matches:** X

| Name | Fingerprint | Verdict | Risk | Last Scanned |

If no matches: "No entries matching ''."

Step 3: HTML Report

After producing the markdown registry output above (stats / scan-result / search-result, whichever sub-command ran):

1. Compute a temp markdown path:

   node -p "require('path').join(require('os').tmpdir(), 'sec-registry-' + Date.now() + '.md')"
   

2. Use the Write tool to save the entire markdown output you just produced (Skill Signature Registry header + metric table + Recent Entries, OR Registry Hit banner, OR Registry Search results) to that temp path. Verbatim.

3. Run the renderer:

   node <plugin-root>/scripts/render-report.mjs registry --in "<temp-md-path>"
   

   The CLI writes reports/registry-<YYYYMMDD-HHmmss>.html relative to CWD and prints file:///abs/path.html on stdout.

4. Append to your response (markdown link, no bare URL):

   HTML report: Open in browser

If the CLI exits non-zero, mention the error but do not block — the markdown output above is the primary deliverable.