const SKIP_DIR = new Set([".git", "node_modules", ".venv", "dist", "build", "__pycache__"]);
Skipping .git and node_modules is right. dist and build are a different case for this tool specifically.
Everywhere else those directories hold output you can regenerate and safely ignore. Here, the thing being audited is an artefact somebody is about to install and let an agent execute. If a skill ships a built dist/setup.js, that file is not a derivative of the source, it is the code that will run, and it is the obvious place to put something you would rather a reviewer did not read.
Proposal
Scan dist and build, or at least scan them and label findings there distinctly. Keep skipping .git, node_modules, .venv and __pycache__.
Worth considering alongside: a minified bundle produces poor snippets and may be noisy, so it may need its own presentation rather than being dropped.
Open question worth discussing on the issue before implementing: scan always, or scan behind a flag that defaults to on?
Skipping
.gitandnode_modulesis right.distandbuildare a different case for this tool specifically.Everywhere else those directories hold output you can regenerate and safely ignore. Here, the thing being audited is an artefact somebody is about to install and let an agent execute. If a skill ships a built
dist/setup.js, that file is not a derivative of the source, it is the code that will run, and it is the obvious place to put something you would rather a reviewer did not read.Proposal
Scan
distandbuild, or at least scan them and label findings there distinctly. Keep skipping.git,node_modules,.venvand__pycache__.Worth considering alongside: a minified bundle produces poor snippets and may be noisy, so it may need its own presentation rather than being dropped.
Open question worth discussing on the issue before implementing: scan always, or scan behind a flag that defaults to on?