chore(deps): update dependency cisco-ai-skill-scanner to v2.0.13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cisco-ai-skill-scanner (changelog)	==2.0.12 → ==2.0.13

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cisco-ai-defense/skill-scanner (cisco-ai-skill-scanner)

v2.0.13

Compare Source

What's Changed

• fix(scanner): discover symlinked skill dirs in recursive scans by @​rohitgollarahalli in #​128
• fix(behavioral): converge dataflow fixpoint on large files (#​120) by @​ihabler in #​130
• fix: suppress warning for recovered fenced JSON by @​mgalore in #​148
• fix(llm): allow Vertex AI to use ambient Application Default Credentials by @​gyrospectre in #​144
• chore(packs/atr): refresh ATR pack 2.0.12 -> 3.5.6 (314 -> 712 supported rules) by @​eeee2345 in #​142
• fix(rules): detect current ngrok tunnel domains and add bore.pub/serveo.net/localtunnel.me by @​federicoroncallo-hub in #​132
• feat(static): classify suspicious URLs in configuration files by @​federicoroncallo-hub in #​134
• feat: #​140 add trusted_reference_domains to LLM analysis policy by @​ojacques in #​141
• feat(adjudicator): demote literal-regex false positives on deterministic HIGH+ findings (closes #​138) by @​rcha0s in #​139
• feat(scanner): expose LLM token usage in ScanResult JSON output by @​amber-beasley-liatrio in #​146
• feat(pre-commit): support incremental CI skill scans by @​AlexBybye in #​145
• feat(release): attest build provenance and SBOM for release artifacts by @​ob-aion in #​143
• feat(static): flag unpinned dependencies across manifest formats by @​federicoroncallo-hub in #​133
• feat: add OSV.dev dependency vulnerability analyzer (--use-osv) by @​federicoroncallo-hub in #​135
• fix(scanner): include adjudicator token usage by @​vineethsai7 in #​151
• fix(llm): stabilize consensus finding severity by @​vineethsai7 in #​152
• fix(meta): batch findings and handle truncated responses by @​vineethsai7 in #​153
• chore(deps): upgrade cryptography to 50.0.0 by @​vineethsai7 in #​155
• docs: own website MDX and validate changes by @​vineethsai7 in #​154

New Contributors

• @​mgalore made their first contribution in #​148
• @​gyrospectre made their first contribution in #​144
• @​federicoroncallo-hub made their first contribution in #​132
• @​ojacques made their first contribution in #​141
• @​amber-beasley-liatrio made their first contribution in #​146
• @​AlexBybye made their first contribution in #​145
• @​ob-aion made their first contribution in #​143

Full Changelog: cisco-ai-defense/skill-scanner@2.0.12...2.0.13

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agent-observability-eval-bootstrap

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)

---

Summary: Scanned 1 skill(s), all passed security checks. ✅