pezhik/skilltotal v0.84.0 is a static security scanner that examines npm·PyPI packages, MCP servers, agent skills, and repositories. In the provided record, v0.84.0 is confirmed as the latest release. The tool runs locally without executing the code under inspection and does not depend on a large language model. In other words, it finds security items based on file contents rather than execution results.
Scanning takes place before a package or repository is installed, and each finding is annotated with file- and line-level evidence. That means you can check which line of which file is related to a scan result. It can be used as a command-line tool, a Claude Code plugin, or a GitHub Action, so scanning can be set up at several points in the development process. The implementation language is Python and the license is Apache-2.0. Supporting several kinds of targets while not executing the code under inspection is the verifiable characteristic of this tool.
However, the provided facts do not list any features added or changed in v0.84.0, so what is different in this release cannot be confirmed. No material comparing detection rules, accuracy, or performance was given either. Therefore, what can be judged from the current material extends only to the inspection targets, the way it works, and the fact that it attaches evidence to results. Actual detection quality or the scale of improvement in this version is hard to assess from this record alone.