ktg-plugin-marketplace/plugins/llm-security/commands/registry.md

---
name: security:registry
description: Skill signature registry — view stats, scan and register skills, search known fingerprints
allowed-tools: Bash, Read, Agent
model: sonnet
---

# /security registry [scan <path|url> | search <pattern>]

Local database of known skill fingerprints and risk profiles. Enables instant re-scan detection.

## Step 1: Parse Sub-command

Extract from `$ARGUMENTS`:
- Empty or `stats` → **show stats**
- `scan <path|url>` → **scan and register**
- `search <pattern>` → **search registry**

Determine plugin root (parent of this `commands/` folder).

## Step 2a: Stats (default)

```bash
node -e "
import { getStats, listEntries } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const stats = getStats('<plugin-root>');
const recent = listEntries({}, '<plugin-root>').slice(0, 5);
console.log(JSON.stringify({ stats, recent }));
" --input-type=module
```

Display:

```
## Skill Signature Registry

| Metric | Value |
|--------|-------|
| Total entries | X |
| Scanned | X |
| Seed | X |
| ALLOW | X |
| WARNING | X |
| BLOCK | X |
| Stale (>7d) | X |
| Avg risk score | X/100 |

### Recent Entries
| Name | Verdict | Risk | Last Scanned |
```

## Step 2b: Scan and Register

Resolve target — if `$ARGUMENTS` contains a URL, clone via `node <plugin-root>/scanners/lib/git-clone.mjs clone "<url>"` first.

**Fingerprint:**

```bash
node -e "
import { fingerprintSkill, checkRegistry } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const result = fingerprintSkill('<target>');
const check = checkRegistry(result.fingerprint, '<plugin-root>');
console.log(JSON.stringify({ ...result, ...check }));
" --input-type=module
```

**If found and not stale:** Display cached result. Skip full scan.

```
## Registry Hit

**Name:** <name> | **Fingerprint:** <first 12 chars>
**Verdict:** <verdict> | **Risk Score:** <score>/100
**Last scanned:** <date> | **Scan count:** <n>
**Status:** Cached result (use `/security scan` to force re-scan)
```

**If not found or stale:** Run `/security scan <target>`, then register:

```bash
node -e "
import { registerScan } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const result = registerScan({
  skillPath: '<target>',
  fingerprint: '<fingerprint>',
  name: '<name>',
  files: <files_json>,
  verdict: '<verdict>',
  risk_score: <score>,
  counts: <counts_json>,
  files_scanned: <n>
}, '<plugin-root>');
console.log(JSON.stringify(result.entry));
" --input-type=module
```

Display: "Registered: <name> (<fingerprint first 12>) — <verdict>"

Clean up clone if remote.

## Step 2c: Search

```bash
node -e "
import { searchRegistry } from '<plugin-root>/scanners/lib/skill-registry.mjs';
const matches = searchRegistry('<pattern>', '<plugin-root>');
console.log(JSON.stringify(matches));
" --input-type=module
```

Display results table:

```
## Registry Search: "<pattern>"

**Matches:** X

| Name | Fingerprint | Verdict | Risk | Last Scanned |
```

If no matches: "No entries matching '<pattern>'."

## Step 3: HTML Report

After producing the markdown registry output above (stats / scan-result / search-result, whichever sub-command ran):

1. Compute a temp markdown path:
   ```bash
   node -p "require('path').join(require('os').tmpdir(), 'sec-registry-' + Date.now() + '.md')"
   ```
2. Use the Write tool to save the **entire markdown output you just produced** (Skill Signature Registry header + metric table + Recent Entries, OR Registry Hit banner, OR Registry Search results) to that temp path. Verbatim.
3. Run the renderer:
   ```bash
   node <plugin-root>/scripts/render-report.mjs registry --in "<temp-md-path>"
   ```
   The CLI writes `reports/registry-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
4. Append to your response (markdown link, no bare URL):

   > **HTML report:** [Open in browser](file:///abs/path.html)

If the CLI exits non-zero, mention the error but do not block — the markdown output above is the primary deliverable.