Cisco Skill Scanner

Cisco AI Defense's scanner for agent skills, combining YARA and pattern rules, code dataflow analysis and an optional LLM judge to flag prompt injection, exfiltration and malicious code.

Install

CLI (pinned)
```
uv pip install cisco-ai-skill-scanner==2.1.0
```
Python 3.11–3.14. The README describes changes on main that may not be in the PyPI release yet.
Scan a skill
```
skill-scanner scan /path/to/skill
```

Scan a folder of skills in CI

skill-scanner scan-all ./skills --fail-on-severity high --format sarif --output results.sarif

A second scanner to run alongside SkillSpector. It supports the open Agent Skills format (Codex, Cursor, Claude), and --lenient also covers Claude Code .claude/commands. It writes SARIF for GitHub code scanning and has a pre-commit hook.

When to use it

You maintain a skills repo and want a CI gate (--fail-on-severity high).
You want to compare two scanners’ findings before approving a skill.
--check-overlap flags skills whose trigger descriptions collide.

How to read it

The README calls it best-effort: no findings does not mean safe. It also publishes weak recall on its own held-out benchmark. Treat findings as a reading list, the way this catalog treats SkillSpector scores.

Official

Published by the platform or the maker of the thing itself.

Access: Runs on your machine Works on local files and folders; no access to your online accounts.
Review: Reviewed — safe to install
Scan: 100/100 SkillSpector 2.12.0 said do not install at a24df34
Checked: Sep 25, 2026

The score comes from what a scanner has to contain. 29 CRITICAL and 819 HIGH findings across the whole repo at 2.1.0 sit in its detection rule packs (skill_scanner/data/packs, including harmful-content signatures from the ATR rule set), the analyzers' lists of dangerous APIs, and deliberately malicious test skills under evals/ and tests/. Checked which modules make network calls. The default static, bytecode, pipeline and correlation analyzers stay offline. Network use is opt-in: --use-llm (your LLM key), --use-virustotal (--vt-upload-files uploads unknown files), --use-aidefense (Cisco API key) and --use-osv (api.osv.dev). The scan now matches the pinned release. The skill_scanner package at the 2.1.0 tag (a24df34) scores 100 with 25 CRITICAL and 393 HIGH. 348 of those sit in its rule packs and LLM prompts, and the rest are the analyzers' own lists of sensitive paths and APIs.

Publisher: Cisco AI Defense
Source: github.com/cisco-ai-defense/skill-scanner
Works with: Any agent, Claude Code, Codex, Cursor
Categories: Security & trust, Agent building
License: Apache-2.0
Cost: Free

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.