What changed
StepSecurity added Agent Skills inventories for developer machines and GitHub repositories. The product discovers skill folders used by 18 coding agents, records source and content hashes, flags bundled code, hooks and shell execution, and shows declared tool approvals and managed provenance where available.
Why it matters
Agent skills can travel from a laptop into a repository and execute with developer privileges while looking like documentation in review. A cross-device and repository inventory makes that supply-chain surface visible before a skill spreads further.
What to do
Inventory skills, filter first for shell, hooks and code, review pre-approved tools such as Bash, compare divergent hashes, trace managed sources and refs, and require code-owner review for repository skill directories.
Caveat
This is a commercial vendor feature and behavior description, not an independent detection evaluation. Repository scanning covers GitHub.com default branches once daily, not GitHub Enterprise Server, and a differing hash identifies variation rather than the correct copy.