Skill Scanner is a Python-based security scanner for AI Agent Skills, combining pattern-based detection, LLM analysis, and behavioral dataflow for threat detection. It supports multiple analyzers, CLI options, and cloud-provider extras; latest releases detail maintained fixes and feature expansions.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection (YAML + YARA), LLM-based semantic analysis, and behavioral dataflow analysis to provide best-effort threat coverage. It supports OpenAI Codex Skills and Cursor Agent Skills formats, with optional lenient mode for non-standard formats.
How it works
The project integrates multiple analyzers: Static (YAML + YARA), Bytecode (Python bytecode), Pipeline (command taint), Behavioral (AST dataflow), LLM (semantic analysis), Meta (false positive filtering), VirusTotal, and AI Defense (cloud-based AI). It provides a CLI to choose analyzers and a policy-driven approach for scans, including consensus across multiple LLM runs and severity handling. Outputs can be formatted as SARIF, HTML, JSON, etc.
Getting started
Installation requires Python 3.10+ and uv (recommended) or pip. Installation commands:
# Using uv (recommended)
uv pip install cisco-ai-skill-scanner
# Using pip
pip install cisco-ai-skill-scanner
Cloud provider extras add support via extra packages, for example:
pip install cisco-ai-skill-scanner[bedrock]
pip install cisco-ai-skill-scanner[google]
pip install cisco-ai-skill-scanner[vertex]
pip install cisco-ai-skill-scanner[azure]
pip install cisco-ai-skill-scanner[all]
Quick Start and CLI usage examples are provided to scan single skills, folders, and GitHub repositories, with flags to enable behavioral, LLM, meta, and other analyzers. An interactive wizard is available when running the tool with no arguments.
Recent releases
Latest releases and notable changes from the changelog:
- 2.0.13 (2026-08-03): fix(scanner): discover symlinked skill dirs in recursive scans; fix(behavioral): converge dataf
- 2.0.12 (2026-06-24): fix: add minimax to unsupported_json_schema_providers; fix: count JavaScript/TypeScript as …
- 2.0.11 (2026-04-30): fix: upload release assets before publishing
- 2.0.10 (2026-04-30): feat(atr): expand pack from 34 → 314 rules, restructure signatures by category; fix: allow Gemini fallback
- 2.0.9 (2026-04-10): fix: issue where --lenient could allow binary and non-UTF-8 content to be passed to loader in certain cases
Full changelog at the linked repository.
Traction
Stars: 2397. Forks: 298. Open issues: 2. Language: Python. License: none listed. Created: 2026-01-29. Last push: 2026-08-04.
Behind the repo
Linked to Cisco AI Defense ecosystem and uses multiple analyzers and a modular CLI for integration with CI/CD and pre-commit hooks. No specific startup/company profile beyond organization.
Caveats
License is listed as none. The README notes best-effort detection rather than comprehensive coverage, and highlights limitations such as possible false positives/negatives, and the need for human review. Prerequisites include Python 3.10+ and uv for recommended usage, with several optional cloud-provider extras.