[iflov]

scan_skill.py scanned only the .md files directly under references/.
Files in subfolders such as references/guides/setup.md never got the
prompt-injection, obfuscation, secret, or URL checks, and
structure.reference_files left them out too, so a skill could come back
clean while most of its reference text was never read.

This walks references/ with rglob("*.md") and reports each file by its
path relative to references/ (references/guides/setup.md:3), in the
findings and in structure.reference_files. Output is unchanged for skills
without nested folders. Path.rglob does not descend into directory
symlinks, so symlink loops and links to directories outside the skill are not
traversed. A file symlink under references/ is still read, even when it
points outside the skill, which is what the scanner already does for top-level
reference files. The existing symlink check still reports every link.

Tested locally:

• A test skill with an injection phrase only in references/guides/nested.md
  now reports a critical finding at references/guides/nested.md:3. Before
  the change it reported nothing for that file.
• Skills with only top-level reference files produce byte-identical JSON
  before and after.
• On the microsoft/rust-guidelines files packaged as a skill (107 reference
  files, mostly nested), the scan goes from 1 high finding to 1 critical and
  64 high findings.

Fixes #186

Also skip unreadable paths (e.g. a symlink into a permission-denied directory) instead of aborting the scan on Python 3.12 (3.13 not tested), including the pre-existing test-file discovery walk.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 158ead9. Configure here.}