Cisco AI Defense Skill Scanner

A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines pattern-based detection (YAML + YARA), LLM-as-a-judge, and behavioral dataflow analysis to maximize detection coverage of probable threats while minimizing false positives.

Important:This scanner provides best-effort detection, not comprehensive or complete coverage. A scan that returns no findings does not guarantee that a skill is free of all threats. See[Scope and Limitations]below.

Supports OpenAI Codex Skills and Cursor Agent Skills formats following the Agent Skills specification. With --lenient

, also scans non-standard formats such as Claude Code .claude/commands/*.md

and flat markdown skill repos.

Multi-Engine Detection- Static analysis, behavioral dataflow, LLM semantic analysis, and cloud-based scanning for layered, best-effort coverageFalse Positive Filtering- Meta-analyzer significantly reduces noise while preserving detection capability** CI/CD Ready**- SARIF output for GitHub Code Scanning,reusable GitHub Actions workflow, exit codes for build failuresPre-commit Hook-Standard pre-commit frameworkintegration to scan skills before every commit** Extensible**- Plugin architecture for custom analyzers

** Join the Cisco AI Discord** to discuss, share feedback, or connect with the team.

Skill Scanner is a detection tool. It identifies known and probable risk patterns, but it does not certify security.

Key limitations:

No findings ≠ no risk. A scan that returns "No findings" indicates that no known threat patterns were detected. It does not guarantee that a skill is secure, benign, or free of vulnerabilities.Coverage is inherently incomplete. The scanner combines signature-based detection, LLM-based semantic analysis, behavioral dataflow analysis, optional cloud services, and configurable rule packs. While this approach improve coverage, no automated tool can detect every technique, especially novel or zero-day attacks.False positives and false negatives can occur. Consensus modes and meta-analysis reduce noise, but no configuration eliminates all incorrect classifications. Tune thescan policyto your risk tolerance.Human review remains essential. Automated scanning is one component of a defense-in-depth strategy. High-risk or production deployments should pair scanner results with manual code review and/or threat modeling.

ArchitectureThreat TaxonomyLLM AnalyzerMeta-AnalyzerBehavioral AnalyzerScan PolicyPolicy Quick ReferenceRule AuthoringGitHub ActionsAPI ReferenceDevelopment GuidePrerequisites: Python 3.10+ and uv (recommended) or pip

uv pip install cisco-ai-skill-scanner

pip install cisco-ai-skill-scanner

Cloud Provider Extras

pip install cisco-ai-skill-scanner[bedrock]

pip install cisco-ai-skill-scanner[google]

pip install cisco-ai-skill-scanner[vertex]

pip install cisco-ai-skill-scanner[azure]

pip install cisco-ai-skill-scanner[all]
export SKILL_SCANNER_LLM_API_KEY="your_api_key"
export SKILL_SCANNER_LLM_MODEL="claude-3-5-sonnet-20241022"

export VIRUSTOTAL_API_KEY="your_virustotal_api_key"

export AI_DEFENSE_API_KEY="your_aidefense_api_key"

Not sure which flags to use? Run skill-scanner

with no arguments to launch the interactive wizard:

skill-scanner

The wizard walks you through selecting a scan target, analyzers, policy, and output format, then shows the assembled command before running it. Great for learning the CLI.

skill-scanner scan /path/to/skill

skill-scanner scan /path/to/skill --use-behavioral

skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-aidefense

skill-scanner scan /path/to/skill --use-llm --enable-meta

skill-scanner scan /path/to/skill --use-trigger

skill-scanner scan /path/to/skill --use-llm --llm-consensus-runs 3

skill-scanner scan-all /path/to/skills --recursive --use-behavioral

skill-scanner scan-all /path/to/skills --recursive --check-overlap

skill-scanner scan /path/to/skill --lenient
skill-scanner scan-all /path/to/skills --recursive --lenient

skill-scanner scan .claude/commands/deploy --lenient
skill-scanner scan-all .claude/commands --recursive --lenient

skill-scanner scan /path/to/skill --skill-file README.md

skill-scanner scan-all ./skills --fail-on-severity high --format sarif --output results.sarif

skill-scanner scan /path/to/skill --use-llm --enable-meta --format html --output report.html

skill-scanner scan /path/to/skill --custom-rules /path/to/my-rules/

skill-scanner scan /path/to/skill --taxonomy /path/to/taxonomy.json --threat-mapping /path/to/threat_mapping.json

skill-scanner scan /path/to/skill --use-virustotal --vt-upload-files

skill-scanner scan /path/to/skill --policy strict

skill-scanner scan /path/to/skill --policy my_org_policy.yaml

skill-scanner generate-policy -o my_org_policy.yaml

skill-scanner configure-policy

LLM provider note: --llm-provider

currently accepts anthropic

or openai

. For Bedrock, Vertex, Azure, Gemini, and other LiteLLM backends, set provider-specific model strings and environment variables (see LLM Analyzer docs).

from skill_scanner import SkillScanner
from skill_scanner.core.analyzers import BehavioralAnalyzer

scanner = SkillScanner(analyzers=[
    BehavioralAnalyzer(),
])

result = scanner.scan_skill("/path/to/skill")

print(f"Findings: {len(result.findings)}")
print(f"Max severity: {result.max_severity}")

if not result.is_safe:
    print("Issues detected -- review findings before deployment")

$ skill-scanner scan ./my-skill --use-behavioral

Status: [OK] No findings
Max Severity: NONE
Total Findings: 0
Scan Duration: 0.15s

Note:"No findings" means the scanner did not detect any known threat patterns -- it is not a guarantee that the skill is free of all risk. See[Scope and Limitations].

Scan skills automatically on every push or PR using the reusable workflow:

name: Scan Skills
on:
  pull_request:
    paths: [".cursor/skills/**"]
jobs:
  scan:
    uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@main
    with:
      skill_path: .cursor/skills
    permissions:
      security-events: write
      contents: read

Results appear as inline annotations in PRs via GitHub Code Scanning. See the full guide for LLM integration, secret configuration, and branch protection setup.

Scan skills before every commit using the pre-commit framework:

repos:
  - repo: https://github.com/cisco-ai-defense/skill-scanner
    rev: v1.0.0  # use the latest release tag
    hooks:
      - id: skill-scanner

Or install the built-in hook directly:

skill-scanner-pre-commit install

The hook automatically detects which skill directories have staged changes and only scans those, keeping commit times fast. Use --all

to scan everything.

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

Apache 2.0 - See LICENSE for details.

Copyright 2026 Cisco Systems, Inc. and its affiliates