V(g) Security Scanner

rotifer vg

Run V(g) static analysis on a Skill or Gene directory. Scans source code for security-relevant patterns and outputs a safety grade (A/B/C/D/?).

rotifer vg [path] [options]

Arguments:

Argument	Required	Description
`path`	No	Path to the Skill or Gene directory. Defaults to `.`

Options:

Flag	Description
`--id <skill_id>`	Skill/Gene identifier included in the report
`--json`	Output raw JSON report instead of formatted output
`--all`	Scan all code files, not just `src/`

Security Rules

V(g) checks for 7 security-relevant code patterns:

Rule	Target	Severity
S-01	Dynamic code execution (`eval()`, `Function()`)	🔴 CRITICAL
S-02	System command execution (`child_process`, `exec`, `spawn`)	🔴 CRITICAL
S-03	Code obfuscation (`atob()` + `eval` combo)	🔴 CRITICAL
S-04	Suspicious external communication (`fetch()`, `http.request`)	🟡 HIGH
S-05	Environment variable access (`process.env`)	🟡 HIGH
S-06	Persistent outbound connections (`WebSocket`, `net.Socket`)	🟡 HIGH
S-07	File system operations (`fs.readFile`, `fs.writeFile`)	🟠 MEDIUM

Safety Grades

Grade	Condition	Badge Color
A	Zero CRITICAL + Zero HIGH	`brightgreen`
B	Zero CRITICAL + ≤2 HIGH	`green`
C	Zero CRITICAL + >2 HIGH	`yellow`
D	≥1 CRITICAL	`red`
?	No source code found (pure prompt Skill)	`lightgrey`

Examples

Scan the current directory:

$ rotifer vg

Scan a specific Skill with an identifier:

$ rotifer vg ./my-skill --id @alice/search-web

Output JSON for CI/CD:

$ rotifer vg ./my-skill --json > report.json

Scan all files (not just src/):

$ rotifer vg ./my-skill --all

JSON Output Format

When using --json, the output follows this schema:

{
  "skill_id": "@author/skill-name",
  "scanned_at": "2026-03-19T12:00:00Z",
  "grade": "B",
  "findings": [
    {
      "rule": "S-04",
      "severity": "HIGH",
      "file": "src/api.ts",
      "line": 42,
      "snippet": "fetch('https://api.example.com/...')"
    }
  ],
  "stats": {
    "files_scanned": 3,
    "lines_of_code": 245
  }
}

Trust Badges

After scanning, generate a trust badge for your README. Visit the Badge Generator or embed directly:

![Safety](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@author/skill-name)

See the Trust Badges guide for all badge types and embedding options.