Which skills in my agent's directory contain hidden instructions that could hijack its behavior?

scans SKILL.md and asset files (HTML, CSS, SVG, XML) for prompt-injection patterns using YARA/YAML rules and an LLM-as-a-judge pass, flagging each hit with severity and file location

Is any skill I'm about to install trying to send data somewhere it shouldn't?

traces taint through bash and pipeline commands from sources like env vars, file reads, and network calls to sinks such as network sends, surfacing multi-step exfiltration chains a single pattern match would miss

Did someone commit a live API key or token into a skill's source?

runs secret-detection checks including documented Anthropic and OpenAI key-prefix patterns across the codebase and reports each exposed credential with its file and line

Does a skill's compiled code actually match the source it ships with?

compares bytecode files against their corresponding source, flagging bytecode with no matching source or an AST that diverges from it as likely hidden or tampered code

Which shell commands in a skill are actually dangerous once you account for pipes and arguments?

evaluates each command in full context — arguments, redirects, chained commands — against a four-tier safety model, rather than judging commands in isolation

skill-scanner release history — The Cyber Toolchain

docs update Oct 22, 2026 · issue 116

Findings marked unmapped when taxonomy code cannot be resolved; taxonomy snapshot overridable at runtime for custom classifications.

Labels findings whose code cannot be resolved — such as from a custom rule pack without a taxonomy selection or a code absent from a custom taxonomy — as unmapped instead of guessing a code.
Supports runtime override of the bundled taxonomy snapshot for custom organizational classifications.

2 details in Everything

New compliance framework Cisco AI Security and Safety Taxonomy 2.0.0 crosswalks (OWASP, MITRE ATLAS, NIST AML)

2.3.1 Oct 21, 2026 · issue 116

Skill Scanner 2.3.1 ships full AITech taxonomy definitions via get_aitech_definition() and updates stale LLM provider defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 2.3.1 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.3.1

└──▷ USE IT

Look up the human-readable definition of an AITech code surfaced in a finding, without leaving Python.

python

from skill_scanner import get_aitech_definition, get_aisubtech_definition

print(get_aitech_definition('AITech-1.1'))
print(get_aisubtech_definition('AITech-1.1.2'))

Adds get_aitech_definition() and get_aisubtech_definition() functions to look up the bundled definition for any AITech objective, technique, or sub-technique code directly from the snapshot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Updates the --llm-provider openrouter default model to openrouter/openai/gpt-5.6-sol and the gcp-vertex default to vertex_ai/gemini-3.8-flash to replace retired models.
Ships a generated taxonomy reference covering all 19 objectives, 44 techniques, and 130 sub-techniques, with each entry in threats.py carrying a full description and AI Defense labels.

Adds get_aitech_definition() and get_aisubtech_definition() functions to look up the bundled definition for any AITech objective, technique, or sub-technique code directly from the snapshot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!scan_metadata.taxonomy.snapshot_sha256 changes from 3df746f0… to 413e8ce9…; anything that pins this hash must be updated.
!OpenRouter users relying on the default model now get openrouter/openai/gpt-5.6-sol instead of openrouter/openai/gpt-4; set SKILL_SCANNER_LLM_MODEL to pin a specific model.
!Vertex AI users relying on the default model now get vertex_ai/gemini-3.8-flash instead of vertex_ai/gemini-1.5-pro; set SKILL_SCANNER_LLM_MODEL to pin a specific model.

2.3.0 Oct 15, 2026 · issue 109

Skill Scanner 2.3.0 maps every finding to Cisco AI taxonomy codes, adds ACTIVE_SENSITIVE_EXFILTRATION detection, and surfaces SYMLINK_NOT_SCANNED and SKILL_LOAD_FAILED findin⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 2.3.0 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.3.0

└──▷ TRY IT

Review taxonomy metadata on a scan to see AITech/AISubtech codes and MITRE ATLAS crosswalks alongside each finding.

$ skill-scanner scan <skill_directory> --format json | jq '.findings[] | {title, aitech, aitech_name, aisubtech, aisubtech_name, framework_mappings, taxonomy_status}'

Adds aitech, aitech_name, aisubtech, aisubtech_name, aitech_mappings, aisubtech_mappings, framework_mappings, taxonomy_status, and taxonomy_source fields to every finding, plus scan_metadata.taxonomy counts and SARIF result properties, mapping to OWASP, MITRE ATLAS, and NIST AML crosswalks from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new detection ACTIVE_SENSITIVE_EXFILTRATION to catch plain-language instructions that read a local credential file and send it to a remote host.
Reports symlinks among a skill's files as SYMLINK_NOT_SCANNED findings (HIGH when the target leaves the skill root) and skills that fail to load as SKILL_LOAD_FAILED findings in scan-all, instead of silently skipping them.
Extends frontmatter scanning to cover all SKILL.md values and comments — including quoted and complex keys, YAML aliases, merge keys, escape sequences, !!binary values, and multi-line folded values — except the allowed-tools value.

Adds aitech, aitech_name, aisubtech, aisubtech_name, aitech_mappings, aisubtech_mappings, framework_mappings, taxonomy_status, and taxonomy_source fields to every finding, plus scan_metadata.taxonomy counts and SARIF result properties, mapping to OWASP, MITRE ATLAS, and NIST AML crosswalks from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new detection ACTIVE_SENSITIVE_EXFILTRATION to catch plain-language instructions that read a local credential file and send it to a remote host.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Taxonomy codes follow taxonomy 2.0.0: jailbreak rules move from AITech-2.1 to AITech-1.1 / AISubtech-1.1.5, and hardcoded secrets from AISubtech-8.2.2 to AISubtech-14.1.1. Any filters on 1.x codes must be updated.
!The AITech-99.9 / AISubtech-99.9.9 placeholder codes are no longer emitted.
!scan-all now reports folders with unloadable skills or symlinks as findings instead of skipping them, so SARIF output, markdown output, and --fail-on-severity exit codes include them.

2.2.2 Oct 9, 2026 · issue 098

Skill Scanner 2.2.2 adds whole-environment dump detection and a new SKILL_SCANNER_ADJUDICATOR_LLM_MAX_TOKENS env var for LLM output control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 2.2.2 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.2.2

Adds SKILL_SCANNER_ADJUDICATOR_LLM_MAX_TOKENS environment variable to set a separate output-token limit for the adjudicator LLM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds SKILL_SCANNER_ADJUDICATOR_LLM_REASONING_EFFORT environment variable to override the adjudicator's reasoning mode (disabled by default in this release).
Adds DATA_EXFIL_ENV_DUMP detection rule for whole process-environment value dumps in Python, JavaScript/TypeScript, and shell code, with targeted reads, keys-only enumeration, literal examples, and comments kept below the HIGH rule boundary.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The adjudicator's reasoning is now disabled by default; set SKILL_SCANNER_ADJUDICATOR_LLM_REASONING_EFFORT to restore the previous behaviour.
!A shell prompt marker by itself no longer captures a command on the next line; prompt and command must share a line.

docs update Oct 6, 2026 · issue 096

skill-scanner adds five policy presets, consensus mode, a second-pass meta-analyzer LLM, and a GitHub Actions reusable workflow with measured recall/FPR benchmarks.

Provides five built-in policy presets — low-noise, quiet, balanced, plus the default and a maximum-sensitivity audit preset — selectable via policy: in the GitHub Actions workflow config.
Adds --policy low-noise and --policy balanced and --policy quiet flags to tune the trade-off between recall and false-positive rate (measured: quiet blocks 33.1% of malicious skills at 5.5% FPR; balanced achieves ~75.5% F1).
Surfaces LLM_ANALYSIS_FAILED at INFO severity when a skill cannot be analysed by the LLM judge, allowing CI to route unreviewed skills to human review.
New integrationSupports uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.1 GitHub Actions reusable workflow with scanner_version, policy, use_llm, llm_model, and llm_api_key inputs.
Supports severity_overrides and suppressions configuration to remove remaining noise without disabling rules.

+2 more show less

Enables consensus mode (run the LLM analyzer multiple times and keep majority-agreed findings) as an opt-in setting.
Supports a second-pass meta-analyzer LLM (off by default) that correlates findings across analyzers and can filter judged false positives.

7 details in Everything

New detection OSV.dev dependency vulnerability scanning
New supported platform Apple Foundation Model (on-device, experimental) LLM provider
New supported platform LLM judge provider support: Anthropic, OpenAI, AWS Bedrock, Google Vertex AI and Gemini, Azure OpenAI, OpenRouter, OrcaRouter, Ollama, and OpenAI-compatible gateways

docs update Oct 6, 2026 · issue 096

skill-scanner adds a reusable GitHub Actions workflow, pre-commit hook, .skill_scannerrc config, and exit code 2 for configuration failures.

New integrationNew supported platformAdds a reusable GitHub Actions workflow at cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml with inputs scanner_version, policy, fail_on_severity, llm_model, llm_provider, llm_base_url, aws_region, skill_path, and extra_args.
Adds a self-hosted workflow path for role-based Bedrock or Vertex AI access using OIDC (id-token: write).
New supported platformAdds pre-commit hook support that scans only the skills touched by a commit.
Adds .skill_scannerrc config file at the repository root with keys skills_path, policy, use_llm, llm_model, severity_threshold, and fail_fast.
Supports environment variables SKILL_SCANNER_LLM_MODEL and SKILL_SCANNER_LLM_PROVIDER as fallbacks in the pre-commit hook.

+1 more show less

Surfaces a distinct exit code 2 ('could not run as configured') distinguishing configuration failures from finding-based failures.

6 details in Everything

New detection LLM judge detection engine
New integration VirusTotal integration via --use-virustotal
New integration GitHub Code Scanning SARIF upload integration

docs update Oct 6, 2026 · issue 096

skill-scanner: Adds --use-llm flag to enable the LLM judge alongside deterministic rules, raising malicious-skill recall from ~8% to ~66.7% at the balanced preset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Vet a third-party skill before install — highest F1, block at HIGH, pipe MEDIUM+ findings to a review queue from the JSON output.

$ skill-scanner scan ./downloaded-skill --use-llm --policy balanced --fail-on-severity high --format json --output scan.json
jq -r '.findings[] | select(.severity == "MEDIUM" or .severity == "HIGH" or .severity == "CRITICAL" or .rule_id == "LLM_ANALYSIS_FAILED") | "\(.severity)\t\(.rule_id)\t\(.file_path // "-")\t\(.title)"' scan.json

Run the judge on a self-hosted Gemma model so skill content never leaves your machines — useful for air-gapped or compliance-sensitive environments.

$ export SKILL_SCANNER_LLM_PROVIDER=openai-compatible
export SKILL_SCANNER_LLM_BASE_URL=http://127.0.0.1:8000/v1
export SKILL_SCANNER_LLM_MODEL=gemma-4-26b-a4b
export SKILL_SCANNER_LLM_API_KEY=unused
skill-scanner scan ./skill --use-llm --policy low-noise --fail-on-severity high

Gate skill commits in a repo — enable the LLM judge for every developer via .skill_scannerrc so the pre-commit hook blocks on HIGH without requiring per-developer flags.

.skill_scannerrc

{
  "skills_path": ".claude/skills",
  "policy": "low-noise",
  "use_llm": true,
  "llm_model": "anthropic/claude-sonnet-5-5",
  "severity_threshold": "high",
  "fail_fast": true
}

Adds --policy flag accepting presets balanced, low-noise, quiet, and strict to control rule severity demotion and judge confidence capping.
Adds --fail-on-severity flag (recommended value: high) to set the severity level that fails a scan.
Adds --llm-decompose flag for the strict hunting preset, enabling per-component LLM decomposition of a skill.
Adds --format sarif and --format json output formats to the scan and scan-all subcommands.
Adds --output flag to write scan results to a named file (e.g., scan.json, results.sarif).

+8 more show less

Adds --use-virustotal, --use-aidefense, and --use-osv flags to opt in to external analyzers (all off by default).
Adds scan-all subcommand with --recursive to batch-scan a directory of skills.
Adds environment variables SKILL_SCANNER_LLM_API_KEY, SKILL_SCANNER_LLM_MODEL, SKILL_SCANNER_LLM_PROVIDER, and SKILL_SCANNER_LLM_BASE_URL to configure the LLM provider without hardcoding credentials.
Adds a pre-commit hook (id: skill-scanner) installable via .pre-commit-config.yaml or skill-scanner-pre-commit --install, scanning only commit-touched skills.
Adds AWS Bedrock provider support via pip install 'cisco-ai-skill-scanner[bedrock]' and SKILL_SCANNER_LLM_MODEL values prefixed bedrock-mantle/.
Adds REST API server (skill-scanner-api --port 8000) exposing a POST /scan-upload endpoint accepting a zipped skill file plus policy and use_llm form fields.
Adds Python API via skill_scanner.SkillScanner, skill_scanner.core.analyzer_factory.build_analyzers, and skill_scanner.core.scan_policy.ScanPolicy (with ScanPolicy.from_preset() and ScanPolicy.from_yaml()) for programmatic scanning.
Supports local self-hosted judge via SKILL_SCANNER_LLM_PROVIDER=openai-compatible + SKILL_SCANNER_LLM_BASE_URL, keeping skill content entirely on-machine; tested with Gemma 4 26B-A4B served by vLLM.

13 details in Everything

docs update Oct 6, 2026 · issue 096

skill-scanner: Adds --use-llm flag to invoke an LLM judge that reads a skill for intent, controlled by SKILL_SCANNER_LLM_MODEL and SKILL_SCANNER_LLM_API_KEY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan a third-party skill with the LLM judge, behavioral dataflow, and OSV dependency checks — fail CI on any HIGH finding and emit a SARIF report for upload to your SAST pipeline.

$ skill-scanner scan /path/to/skill --use-llm --use-behavioral --use-osv --policy balanced --fail-on-severity high --format sarif --output results.sarif

Generate a custom low-noise policy YAML as a starting point, then tune it and point your scan at the result to minimise false positives on first-party skills.

$ skill-scanner generate-policy --preset low-noise -o my_policy.yaml
skill-scanner scan /path/to/skill --use-llm --policy my_policy.yaml --fail-on-severity high

Drop skill-scanner into a GitHub Actions workflow to automatically scan all skills on every push, using the reusable workflow with the LLM judge and a pinned scanner version.

yaml

uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.1
with:
  scanner_version: "2.2.1"
  policy: low-noise
  fail_on_severity: high
  use_llm: true
  llm_model: anthropic/claude-sonnet-5-5
secrets:
  llm_api_key: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}

Adds generate-policy --preset <name> -o <file> subcommand to scaffold a custom policy YAML from any built-in preset.
Adds --use-behavioral flag to enable Python dataflow analysis.
Adds --use-osv flag to check skills against known-vulnerable dependencies.
Adds --format sarif output option (alongside existing formats) for SARIF-compatible results, used with --output <file>.
Adds --format html output option to generate a self-contained HTML report.

+1 more show less

Adds an interactive wizard mode to scan that guides selection of target, analyzers, policy, and output format.

6 details in Everything

docs update Oct 6, 2026 · issue 096

skill-scanner: Adds Homebrew tap for macOS installs via brew tap cisco-ai-defense/skill-scanner and brew install cisco-ai-defense/skill-scanner/skill-scanner (macOS 14+).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Install on macOS via Homebrew and immediately pin the LLM judge to a specific model for reproducible CI results.

$ brew tap cisco-ai-defense/skill-scanner https://github.com/cisco-ai-defense/skill-scanner
brew install cisco-ai-defense/skill-scanner/skill-scanner
export SKILL_SCANNER_LLM_MODEL="anthropic/claude-sonnet-5-5"

Route the LLM judge through a local vLLM or OpenAI-compatible gateway instead of a cloud provider.

$ export SKILL_SCANNER_LLM_PROVIDER=openai-compatible
export SKILL_SCANNER_LLM_MODEL="any name"

Install Google AI Studio / Gemini support and point the judge at a Gemini model for air-gapped or cost-sensitive environments.

$ pip install "cisco-ai-skill-scanner[google]"
export SKILL_SCANNER_LLM_MODEL="gemini/<model>"

Prebuilt wheels now available for glibc Linux x86-64/ARM64, macOS x86-64/ARM64 (macOS 14+), and Windows x86-64; source distribution requires Go 1.27.1+ for the CEL helper.

1 detail in Everything

api-docs-049d522bbb91 Oct 5, 2026 · issue 095

└──▷ TRY IT

Set the LLM model and run a scan so the LLM judge can evaluate results — the scan fails fast with HTTP 400 if the key is missing.

$ export SKILL_SCANNER_LLM_MODEL=anthropic/claude-sonnet-5-5

api-docs-049d522bbb91 Oct 4, 2026 · issue 094

skill-scanner: Adds SKILL_SCANNER_LLM_MODEL environment variable to select the LLM judge model, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ anthropic/claude-sonnet-5-5.

└──▷ TRY IT

Run a scan with the LLM judge enabled using Claude Sonnet, selecting the strict preset to minimize false negatives in a high-stakes pipeline.

$ export SKILL_SCANNER_LLM_MODEL=anthropic/claude-sonnet-5-5

Enables an LLM judge for scan analysis; if the judge cannot be built (e.g. no API key), the request fails with HTTP 400.

1 detail in Everything

api-docs-049d522bbb91 Oct 3, 2026 · issue 093

skill-scanner adds LLM judge, OSV.dev dependency scanning, meta-analyzer, and named scan presets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds an LLM judge option (recommended) powered by a configurable model such as anthropic/claude-sonnet-5-5, set via the SKILL_SCANNER_LLM_MODEL environment variable; requests fail with HTTP 400 if the judge cannot be built (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ no API key).
Queries OSV.dev for vulnerable exactly-pinned Python and JavaScript dependencies.
Adds a meta-analyzer option (not recommended per Recommended Settings guidance).
Adds named scan presets — balanced, low-noise, quiet, strict, permissive — accepted as a preset name or a YAML path.

4 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner gains decomposed LLM analysis, system-one screening, consensus runs, and expanded detection surfaces for AI skill files⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Maximize recall on a skill when model cost is acceptable — each focus area gets its own LLM pass and results are unioned.

$ skill-scanner scan ./skill --use-llm --llm-decompose

Reduce false positives in CI by requiring findings to survive across three independent LLM runs before surfacing.

$ skill-scanner scan ./skill --use-llm --llm-consensus-runs 3

Run a second-pass adjudication review across all findings for deeper triage of high-stakes skills.

$ skill-scanner scan ./skill --use-llm --adjudicate

Adds --llm-decompose flag to run the LLM judge once per focus area (declared purpose, policy surface, security behaviors) and union the findings, raising F1 from 61.2% to 68.3% on Gemma 4 26B and from 58.7% to 81.4% on Claude Haiku 4.5 at roughly 3x the model calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --system-one-endpoint and --system-one-model flags to record a calibrated risk probability for triage (advisory only; cannot change a finding, severity, or verdict).
Adds --llm-consensus-runs to run the LLM analyzer multiple times independently and retain only majority-agreed findings, using the highest severity observed across agreeing votes.
Adds --adjudicate flag for second-pass review across all findings (off by default; measured at a cost of 16.4 points of recall).
Detects injection and exfiltration text in SKILL.md frontmatter description and when_to_use fields, which agents load before invocation (core rules, YARA and active-directive rules; optional packs scan the body only).

+2 more show less

Detects package-registry redirection across npm/yarn/pnpm, pip/uv, Go, Cargo, RubyGems, NuGet, and Docker, plus unnamed script network destinations.
Adds low-noise profile (balanced, 11 rules, mostly flags harmless skills reported at LOW) and quiet profile (19 rules reported at LOW, suited to triage queues with little review capacity).

7 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner adds OSV.dev dependency advisories, second-pass LLM validation, and five built-in scan presets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds second-pass LLM validation/filtering (off by default; not recommended) to reduce false positives.
Adds five built-in presets including default, low-noise, and quiet review-capacity packs.

2 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner FAQ reveals LLM judge, policy presets, OSV/VirusTotal/Cisco AI Defense integrations, and multi-cloud LLM provider support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Scan third-party skills with the highest-F1 preset in CI, failing on MEDIUM or above — 66.7% recall at 15.4% false-positive rate on held-out splits.

.github/workflows/skill-scan.yml

uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.0
with:
  scanner_version: "2.2.0"
  policy: balanced
  use_llm: true
  llm_model: anthropic/claude-sonnet-5-5
secrets:
  llm_api_key: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}

Use the quiet preset with the LLM judge to minimise false positives when gating production deploys — blocks 33.1% of malicious skills at a 5.5% false-positive rate at HIGH.

.github/workflows/skill-scan.yml

uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.0
with:
  scanner_version: "2.2.0"
  policy: quiet
  use_llm: true
  llm_model: anthropic/claude-sonnet-5-5
secrets:
  llm_api_key: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}

Supports SKILL_SCANNER_LLM_PROVIDER=openai-compatible to connect the LLM judge to any OpenAI-compatible gateway or local server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --policy low-noise, --policy balanced, and --policy quiet presets to tune false-positive/recall trade-offs for own vs. third-party skills.
Integrates OSV.dev for known-vulnerable Python and JavaScript dependency-pin checks (network access required, no key needed).
Integrates VirusTotal and Cisco AI Defense as optional cloud-based binary and content scanning backends (each requires its own API key).
Supports Anthropic (anthropic/claude-sonnet-5-5, default), OpenAI, AWS Bedrock, Google Vertex AI and Gemini, Azure OpenAI, OpenRouter, OrcaRouter, Ollama, and the on-device Apple Foundation Model (experimental) as LLM judge providers.

+4 more show less

Adds five built-in policy presets — default, low-noise, quiet, and two additional named presets — configurable via policy in YAML configuration, controlling which rules fire, severity levels, and file limits.
Surfaces an LLM_ANALYSIS_FAILED INFO finding when the LLM judge cannot read a skill, allowing CI to route unanalysed skills to human review.
Raises deterministic-rules-only recall from 8% to ~67% by enabling the LLM judge; consensus mode multiplies judge runs to raise agreement threshold at proportional cost.
Runs on Linux x86-64/ARM64 and Windows x86-64 pre-built; other platforms build from source requiring Go 1.27.1+.

Supports SKILL_SCANNER_LLM_PROVIDER=openai-compatible to connect the LLM judge to any OpenAI-compatible gateway or local server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --policy low-noise, --policy balanced, and --policy quiet presets to tune false-positive/recall trade-offs for own vs. third-party skills.
Integrates OSV.dev for known-vulnerable Python and JavaScript dependency-pin checks (network access required, no key needed).
Integrates VirusTotal and Cisco AI Defense as optional cloud-based binary and content scanning backends (each requires its own API key).
Supports Anthropic (anthropic/claude-sonnet-5-5, default), OpenAI, AWS Bedrock, Google Vertex AI and Gemini, Azure OpenAI, OpenRouter, OrcaRouter, Ollama, and the on-device Apple Foundation Model (experimental) as LLM judge providers.

+3 more show less

Adds five built-in policy presets — default, low-noise, quiet, and two additional named presets — configurable via policy in YAML configuration, controlling which rules fire, severity levels, and file limits.
Surfaces an LLM_ANALYSIS_FAILED INFO finding when the LLM judge cannot read a skill, allowing CI to route unanalysed skills to human review.
Runs on Linux x86-64/ARM64 and Windows x86-64 pre-built; other platforms build from source requiring Go 1.27.1+.

1 more in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner gains documented tuning workflow: severity presets, scoped suppressions, judge confidence caps, and JSON/SARIF output fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Gate a CI pipeline at HIGH severity and fail explicitly if the judge could not analyse any skill.

$ skill-scanner scan-all ./skills --recursive --use-llm --policy low-noise --format json --output results.json
jq -e '[.results[].findings[] | select(.rule_id == "LLM_ANALYSIS_FAILED")] | length == 0' results.json \
  || { echo "some skills were not analysed by the judge: review them"; exit 1; }

Start from the low-noise preset and cap the judge's contextual findings plus re-rate a noisy rule, so false positives drop without silencing detections elsewhere.

$ skill-scanner generate-policy --preset low-noise -o my-policy.yaml

Apply severity override, scoped suppression, and judge confidence caps in the generated policy file before scanning.

my-policy.yaml

severity_overrides:
  - rule_id: FILE_MAGIC_MISMATCH
    severity: LOW
    reason: "mostly a text label in Markdown on our skills"

suppressions:
  - rule_id: HOMOGLYPH_ATTACK
    skills: ["docs-translator"]
    reason: "Skill legitimately contains Cyrillic prose"
    expires: 2030-12-31

llm_analysis:
  low_confidence_max_severity: LOW
  contextual_risk_max_severity: LOW
  max_total_prompt_chars: 200000
  max_code_file_chars: 50000

Adds --fail-on-severity flag to gate CI jobs at a chosen severity level (e.g., --fail-on-severity high).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --format json output with findings[], suppressed_findings[], is_safe, and max_severity fields per skill; scan-all wraps results in results[] under a summary with counts by severity.
Adds LLM_ANALYSIS_FAILED and LLM_CONTEXT_BUDGET_EXCEEDED INFO-severity findings to surface skills the judge could not fully read, allowing CI pipelines to fail explicitly on unanalysed skills.
Adds severity_overrides policy key to re-rate noisy rules to LOW without disabling them globally, keeping detections intact elsewhere.
Adds suppressions policy key supporting scoped suppression by skills, paths, rule_id, reason, and expires; suppressed findings appear in suppressed_findings in JSON and as dismissed in SARIF.

+7 more show less

Adds llm_analysis.low_confidence_max_severity and llm_analysis.contextual_risk_max_severity policy keys to cap the judge's weakest findings at LOW.
Adds llm_analysis.max_total_prompt_chars, max_instruction_body_chars, max_code_file_chars, and max_referenced_file_chars policy keys to control the judge's prompt budget.
Adds skill-scanner generate-policy --preset <name> -o <file> subcommand to bootstrap a policy file from a named preset (low-noise, balanced, or quiet).
Adds skill-scanner configure-policy -i <file> -o <file> interactive subcommand for editing policy files in place.
Adds disabled_rules policy key to switch a rule off globally (noted as a last resort vs. scoped suppression).
Documents exit code semantics: 0 = nothing reached threshold, 1 = finding at or above --fail-on-severity, 2 = policy/configuration error (e.g., missing API key); same configuration error returns HTTP 400 over the REST API.
SARIF output reports suppressed findings as dismissed, preserving the record in Code Scanning.

12 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Enables an LLM judge via SKILL_SCANNER_LLM_MODEL (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ anthropic/claude-sonnet-5-5) to perform AI-assisted evaluation; requests fail with HTTP 400 if the judge cannot be built

└──▷ TRY IT

Enable the LLM judge with a specific model before running a scan, so AI-assisted evaluation is applied to results

$ export SKILL_SCANNER_LLM_MODEL=anthropic/claude-sonnet-5-5

docs update Oct 3, 2026 · issue 093

skill-scanner Python SDK gains named scan presets (balanced, low-noise, quiet, strict, permissive) and LLM-backed analysis via SKILL_SCANNER_LLM_* env vars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds use_llm=True analyzer option to enable LLM-backed analysis, pulling model and API key from SKILL_SCANNER_LLM_* environment variables.

1 detail in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds .skill_scannerrc config file (repository root) with keys skills_path, policy, use_llm, llm_model, severity_threshold, and fail_fast to configure the LLM judge and scan behaviour.

└──▷ TRY IT

Gate PRs on HIGH-severity findings in your own skills, surfacing MEDIUM findings as inline annotations for reviewers.

$ # .github/workflows/skill-scan.yml
jobs:
  skill-scan:
    uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.0
    secrets:
      SKILL_SCANNER_LLM_API_KEY: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}
    with:
      scanner_version: "2.2.0"
      policy: low-noise
      fail_on_severity: high
      llm_model: anthropic/claude-sonnet-5-5
    permissions:
      actions: read
      security-events: write
      contents: read

Configure the LLM judge and severity gate for local and pre-commit runs without repeating flags on every invocation.

.skill_scannerrc

{
  "skills_path": ".claude/skills",
  "policy": "low-noise",
  "use_llm": true,
  "llm_model": "anthropic/claude-sonnet-5-5",
  "severity_threshold": "high",
  "fail_fast": true
}

Adds pre-commit hook integration (pinned via rev: 2.2.0) that scans only the skills touched by a commit, blocking the commit with exit code 2 if the judge cannot be initialised.
Adds --use-virustotal and --use-osv flags to skill-scanner scan-all for Tier 3 behavioral and reputation checks on third-party skills.
Supports bedrock/ models in the reusable workflow via a Bedrock API key (SKILL_SCANNER_LLM_API_KEY secret) plus aws_region input (default us-east-1), and via an OIDC role-assumed self-hosted workflow for role-based Bedrock access.
Adds SKILL_SCANNER_LLM_MODEL and SKILL_SCANNER_LLM_PROVIDER environment variables as fallbacks for llm_model and llm_provider in pre-commit and self-hosted setups.
Exposes --llm-decompose and LLM-limit tuning options via the allowlist in the reusable workflow's extra_args input.

+1 more show less

Supports --format sarif --output results.sarif output with subsequent upload via github/codeql-action/upload-sarif@v4 in self-hosted workflows.

Adds pre-commit hook integration (pinned via rev: 2.2.0) that scans only the skills touched by a commit, blocking the commit with exit code 2 if the judge cannot be initialised.
Adds --use-virustotal and --use-osv flags to skill-scanner scan-all for Tier 3 behavioral and reputation checks on third-party skills.
Supports bedrock/ models in the reusable workflow via a Bedrock API key (SKILL_SCANNER_LLM_API_KEY secret) plus aws_region input (default us-east-1), and via an OIDC role-assumed self-hosted workflow for role-based Bedrock access.
Adds SKILL_SCANNER_LLM_MODEL and SKILL_SCANNER_LLM_PROVIDER environment variables as fallbacks for llm_model and llm_provider in pre-commit and self-hosted setups.
Supports --format sarif --output results.sarif output with subsequent upload via github/codeql-action/upload-sarif@v4 in self-hosted workflows.

1 more in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner adds OSV dependency advisory queries, System One screening, decomposed LLM passes, and new policy presets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Vet a third-party skill in CI/CD, failing the pipeline on any HIGH severity finding and emitting a SARIF report for upload.

$ skill-scanner scan ./my-skill --use-llm --policy low-noise --fail-on-severity high --format sarif --output results.sarif

Run a full dependency advisory check against OSV.dev alongside LLM and behavioral analysis for a thorough audit with no API key.

$ skill-scanner scan ./my-skill --use-behavioral --use-llm --use-osv --use-aidefense

Generate a reusable low-noise policy file to standardise scan settings across pipelines.

$ skill-scanner generate-policy -o my_policy.yaml --preset low-noise

Adds --system-one-endpoint URL flag to route scans through an optional System One screening endpoint (POST /v1/systemone); advisory only and cannot alter findings, severity, or verdict.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds --system-one-model NAME flag to specify the model for the System One endpoint; required when --system-one-endpoint is set and rejected without it.
Adds --use-aidefense flag to enable the meta-analyzer (off by default; measured at a 16.4-point recall cost).

3 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds SKILL_SCANNER_LLM_FORCE_JSON_OBJECT=true to fall back to plain JSON mode for gateways that reject json_schema structured output.

└──▷ TRY IT

Keep skill content fully on-prem by routing the LLM judge through a local vLLM server — no skill data leaves your machines.

$ export SKILL_SCANNER_LLM_PROVIDER="openai-compatible"
export SKILL_SCANNER_LLM_BASE_URL="http://127.0.0.1:8000/v1"
export SKILL_SCANNER_LLM_MODEL="gemma-4-26b-a4b"
export SKILL_SCANNER_LLM_API_KEY="unused"
skill-scanner scan ./skill --use-llm

Scan with AWS Bedrock as the judge backend using an IAM profile — no API key needed, and prompt budget raised for large skills.

$ pip install "cisco-ai-skill-scanner[bedrock]"
export AWS_REGION="us-east-1"
export AWS_PROFILE="my-bedrock-profile"
export SKILL_SCANNER_LLM_MODEL="bedrock/us.anthropic.claude-sonnet-5-5"
skill-scanner scan ./skill --use-llm

Cap noisy low-confidence LLM findings and raise the prompt budget for large skills in your policy file.

yaml

llm_analysis:
  low_confidence_max_severity: LOW
  contextual_risk_max_severity: LOW
  max_total_prompt_chars: 200000
  max_instruction_body_chars: 80000
  max_code_file_chars: 40000
  max_referenced_file_chars: 40000

Adds SKILL_SCANNER_LLM_USER to set the Chat Completions user field for gateways that require it for routing or billing.
Adds SKILL_SCANNER_LLM_TEMPERATURE (accepts a number or none to always omit the parameter) to override the default temperature-0 behaviour.
Adds SKILL_SCANNER_LLM_REPAIR_INCONSISTENT_VERDICT — set to 0 to disable verdict repair (the default escalates a self-contradicting SAFE verdict to SUSPICIOUS).
Adds SKILL_SCANNER_LLM_MAX_TOKENS / --llm-max-tokens N (default 8192) to control output token budget for the judge.
Adds SKILL_SCANNER_LLM_REASONING_EFFORT / --llm-reasoning-effort with levels disabled, minimal, low, medium, high, xhigh, max to control reasoning depth.

+7 more show less

Adds SKILL_SCANNER_META_LLM_* variable family to override the model used by the meta-analyzer independently of the primary judge.
Adds SKILL_SCANNER_ADJUDICATOR_LLM_MODEL to override the model used for --adjudicate independently of the primary judge.
Supports AWS Bedrock as an LLM judge backend via pip install 'cisco-ai-skill-scanner[bedrock]', using bedrock/<model> or bedrock-mantle/<model> prefixes with standard IAM credentials.
Supports Google Vertex AI (pip install 'cisco-ai-skill-scanner[vertex]', model prefix vertex_ai/<model>) and Google AI Studio / Gemini API (pip install 'cisco-ai-skill-scanner[google]', prefix gemini/<model>) as judge backends.
Supports Azure OpenAI as a judge backend via pip install 'cisco-ai-skill-scanner[azure]', configured with SKILL_SCANNER_LLM_MODEL=azure/<deployment-name>, SKILL_SCANNER_LLM_BASE_URL, and SKILL_SCANNER_LLM_API_VERSION.
Supports Ollama as a local judge backend via SKILL_SCANNER_LLM_MODEL=ollama/<model> (defaults SKILL_SCANNER_LLM_BASE_URL to http://127.0.0.1:11434); the route is loopback-only, preventing skill content from leaving the host.
Adds experimental on-device Apple Foundation Model judge backend (SKILL_SCANNER_LLM_MODEL=apple-fm/system) for macOS 26+ with Apple Intelligence — no API key required; requires pip install 'apple-fm-sdk>=0.2.1,<0.3'.

12 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds llm_model policy YAML key to configure which LLM the judge uses (e.g. anthropic/claude-sonnet-5-5)

└──▷ TRY IT

Gate CI on HIGH findings while using the LLM judge across a skills directory, with policy defined in a shared YAML file

$ skill-scanner scan-all ./skills --use-llm --policy .github/scan-policy.yaml --fail-on-severity high

Generate an editable policy from the low-noise preset, then customise it to suppress a noisy rule for one skill with an expiry date

$ skill-scanner generate-policy --preset low-noise -o .github/scan-policy.yaml

Tune a policy YAML to cap weak LLM findings, suppress a false-positive for a specific skill, and pin the judge model

.github/scan-policy.yaml

use_llm: true
llm_model: anthropic/claude-sonnet-5-5
low_confidence_max_severity: LOW
contextual_risk_max_severity: LOW
suppressions:
  - rule_id: HOMOGLYPH_ATTACK
    skills: ["docs-translator"]
    reason: "Skill legitimately contains Cyrillic prose"
    expires: 2030-12-31

Adds --fail-on-severity flag to skill-scanner scan-all, enabling severity-gated CI — e.g. --fail-on-severity high to block on HIGH findings

1 detail in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds --use-llm flag to enable the LLM judge alongside deterministic rules, raising recall of malicious skills from ~8% to 66.7% at MEDIUM+ threshold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Vet a third-party skill before install, blocking on HIGH and writing MEDIUM+ findings to a JSON review queue.

$ skill-scanner scan ./downloaded-skill --use-llm --policy balanced --fail-on-severity high --format json --output scan.json

jq -r '.findings[] | select(.severity == "MEDIUM" or .severity == "HIGH" or .severity == "CRITICAL" or .rule_id == "LLM_ANALYSIS_FAILED") | "\(.severity)\t\(.rule_id)\t\(.file_path // "-")\t\(.title)"' scan.json

Run the LLM judge on a self-hosted vLLM model so skill content never leaves your machines.

$ export SKILL_SCANNER_LLM_PROVIDER=openai-compatible
export SKILL_SCANNER_LLM_BASE_URL=http://127.0.0.1:8000/v1
export SKILL_SCANNER_LLM_MODEL=gemma-4-26b-a4b
export SKILL_SCANNER_LLM_API_KEY=unused
skill-scanner scan ./skill --use-llm --policy low-noise --fail-on-severity high

Wire skill-scanner into a repo so every commit only scans touched skills, with the LLM judge enabled via a repo-root config file.

.skill_scannerrc

{
  "skills_path": ".claude/skills",
  "policy": "low-noise",
  "use_llm": true,
  "llm_model": "anthropic/claude-sonnet-5-5",
  "severity_threshold": "high",
  "fail_fast": true
}

Adds --llm-decompose flag for deep hunting mode alongside the strict preset and all rule packs.
Adds --format flag supporting json and sarif output formats, and --output flag to write results to a file.
Adds --use-virustotal, --use-aidefense, and --use-osv flags to opt in to external analyzers (off by default to keep skill content on-machine).
Adds --recursive flag to scan-all for scanning an entire registry or directory tree.
Adds a REST API server via skill-scanner-api --port 8000 exposing a POST /scan-upload endpoint that accepts a skill ZIP, policy, and use_llm parameters.

+3 more show less

Adds a Python SDK with SkillScanner, build_analyzers, and ScanPolicy (from skill_scanner, skill_scanner.core.analyzer_factory, skill_scanner.core.scan_policy) for programmatic scanning.
The low-noise preset demotes the 11 rules most likely to flag a harmless skill and caps low-confidence judge findings to LOW severity, reducing the review queue by ~3 percentage points versus balanced.
The quiet preset demotes 19 rules and additionally caps CONTEXTUAL_RISK judge findings to LOW, achieving 7.2% FPR while keeping demoted findings visible at LOW.

8 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds --use-behavioral flag to enable Python dataflow analysis during a scan.

└──▷ TRY IT

Scan a third-party skill with the LLM judge, all analyzers enabled, and fail CI on any HIGH finding — outputting a SARIF file for ingestion into a SIEM or GitHub Code Scanning.

$ skill-scanner scan-all ./skills --recursive --use-llm --use-behavioral --use-osv --policy balanced --fail-on-severity high --format sarif --output results.sarif

Start from a built-in preset to create a tuned policy with a low false-positive rate, then scan your own skills against it.

$ skill-scanner generate-policy --preset low-noise -o my_policy.yaml
skill-scanner scan /path/to/skill --use-llm --policy my_policy.yaml --fail-on-severity high

Wire skill-scanner into a GitHub Actions pipeline using the reusable workflow, keeping the LLM API key in repository secrets.

.github/workflows/scan-skills.yml

uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@2.2.0
with:
  scanner_version: '2.2.0'
  policy: low-noise
  fail_on_severity: high
  use_llm: true
  llm_model: anthropic/claude-sonnet-5-5
secrets:
  llm_api_key: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}

Adds --use-osv flag to check skills against known-vulnerable dependencies.
Adds an interactive wizard mode to scan that guides selection of target, analyzers, policy, and output format.

2 details in Everything

docs update Oct 3, 2026 · issue 093

skill-scanner: Adds Homebrew tap install via brew tap cisco-ai-defense/skill-scanner and brew install cisco-ai-defense/skill-scanner/skill-scanner for macOS 14+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Install skill-scanner on macOS via Homebrew for a dependency-isolated, project-independent setup.

$ brew tap cisco-ai-defense/skill-scanner https://github.com/cisco-ai-defense/skill-scanner
brew install cisco-ai-defense/skill-scanner/skill-scanner

Prebuilt wheels now cover glibc Linux x86-64 and ARM64, macOS x86-64 and ARM64 (macOS 14+), and Windows x86-64; source distribution requires Go 1.27.1+ for the CEL helper.

1 detail in Everything

docs update Oct 3, 2026 · issue 093

Docs describe --use-llm flag, GitHub Actions/pre-commit CI integration, REST API, preset configs, and custom policy YAML for the skill-scanner CLI.

Adds --use-llm flag to enable the LLM judge analyzer on top of the automatically-run static, bytecode, and pipeline analyzers.
Supports scanning a local skill, a directory of skills, or a GitHub repository as scan targets.
Provides GitHub Actions reusable workflow and pre-commit hook for CI/CD integration.
Exposes a REST API for reading findings and managing the review queue.
Supports preset configs and custom policy YAML for tuning false-positive rates, with measured recall, FPR, and F1 per setup documented in Recommended Settings.

+1 more show less

Supports scoped suppressions alongside presets and the LLM judge for noise reduction.

6 details in Everything

New integration OSV.dev advisory integration for Python and JavaScript dependencies
New integration VirusTotal integration as optional analysis extra

docs update Oct 3, 2026 · issue 093

Docs describe --use-llm flag, GitHub Actions/pre-commit CI integration, a REST API, a policy YAML system, and preset configurations with measured recall/FPR/F1 rates.

Adds --use-llm flag to invoke an LLM judge that reads a skill for intent, layered on top of the automatic static, bytecode, and pipeline analyzers.
Supports scanning a local skill, a directory of skills, or a GitHub repository as input targets.
Provides GitHub Actions reusable workflow and a pre-commit hook for CI/CD integration.
Exposes a REST API for reading findings and building a review queue.
Offers presets and a custom policy YAML system with scoped suppressions to reduce false positives, with measured recall, FPR, and F1 rates published per setup.

5 details in Everything

New integration OSV.dev advisory scanning for pinned Python and JavaScript dependencies
New integration VirusTotal integration as optional analyzer

2.2.0 Oct 2, 2026 · issue 093

Skill Scanner 2.2.0 adds low-noise/quiet presets, scoped suppressions, Apple on-device LLM, OpenAI-compatible gateway support, and two new detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 2.2.0 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.2.0

└──▷ USE IT

Suppress a known false positive for a specific skill and path without disabling the rule globally — ideal for reviewed test fixtures in CI.

yaml

suppressions:
  - rule_id: ARCHIVE_FILE_DETECTED
    skills: ["my-skill"]
    paths: ["**/fixtures/**/*.zip"]
    severity: LOW
    reason: "Reviewed test fixtures"

Enable the LLM judge in pre-commit so every commit to a skills repo is semantically analyzed before it lands.

.skill_scannerrc

use_llm: true
llm_model: claude-sonnet-5-5
llm_provider: anthropic

Route LLM analysis through an internal OpenAI-compatible gateway instead of a first-party provider — useful in air-gapped or proxy environments.

$ export SKILL_SCANNER_LLM_PROVIDER=openai-compatible
export SKILL_SCANNER_LLM_API_KEY="your_gateway_key"
skill-scanner ./my-skill --use-llm

Adds low-noise and quiet scan presets that demote high-false-positive rules and cap judge findings via low_confidence_max_severity and contextual_risk_max_severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds scoped rule suppressions in policy YAML: target a specific skill with skills or a file path pattern with paths, so a single false positive no longer disables a rule scan-wide.
Adds SKILL_SCANNER_LLM_PROVIDER=openai-compatible environment variable to route LLM analysis through any OpenAI-compatible gateway.
Adds --llm-decompose flag to run one focused LLM analysis pass per concern instead of a combined pass.
Adds use_llm, llm_model, and llm_provider keys to .skill_scannerrc so the pre-commit hook can invoke the LLM judge.

+6 more show less

Adds scanner_version, llm_provider, llm_base_url, and aws_region inputs to the reusable GitHub Actions workflow.
Adds new SUPPLY_CHAIN_REGISTRY_REDIRECT (HIGH) and UNDECLARED_NETWORK_DESTINATION (LOW) static detection rules.
Adds experimental on-device Apple Foundation Model support as an LLM provider.
Extends OSV dependency scanning to read package.json (npm) in addition to previously supported manifests.
Extends frontmatter scanning to cover description and when_to_use fields across core rules, YARA, and active-directive rules.
Updates default LLM model to claude-sonnet-5-5 (or bedrock/us.anthropic.claude-sonnet-5-5 on Bedrock); adds a recommended-settings guide with measured recall/FPR/F1 figures across all presets.

Adds low-noise and quiet scan presets that demote high-false-positive rules and cap judge findings via low_confidence_max_severity and contextual_risk_max_severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds scoped rule suppressions in policy YAML: target a specific skill with skills or a file path pattern with paths, so a single false positive no longer disables a rule scan-wide.
Adds SKILL_SCANNER_LLM_PROVIDER=openai-compatible environment variable to route LLM analysis through any OpenAI-compatible gateway.
Adds --llm-decompose flag to run one focused LLM analysis pass per concern instead of a combined pass.
Adds new SUPPLY_CHAIN_REGISTRY_REDIRECT (HIGH) and UNDECLARED_NETWORK_DESTINATION (LOW) static detection rules.

+1 more show less

Adds experimental on-device Apple Foundation Model support as an LLM provider.

5 more in Everything

└──▷ BREAKING ON UPGRADE

!--use-llm, --use-behavioral, and --enable-meta now fail closed: if the requested analyzer cannot be built (missing API key, missing extra, unknown provider), the scan exits with code 2 and the REST API returns 400. Previously the scan ran rules only and exited 0.
!Exit code 2 now means a usage or configuration error (e.g. unknown policy); previously this condition returned exit code 1. Exit code 1 still means findings at or above --fail-on-severity.
!The default LLM model is now claude-sonnet-5-5; the previous default claude-3-5-sonnet-20241022 is retired.
!Verdict repair is on by default: a SAFE verdict that lists findings is promoted to SUSPICIOUS. To restore the prior behavior, set SKILL_SCANNER_LLM_REPAIR_INCONSISTENT_VERDICT=0.
!Unpinned dependencies are now reported at LOW severity instead of MEDIUM.
!The interactive wizard no longer enables the meta-analyzer by default.

docs update Sep 6, 2026 · issue 066

skill-scanner adds CEL correlation gating and ATR rule packs with per-invocation mode override via new CLI flags

└──▷ TRY IT

Promote CEL gates to enforce mode for a single CI run to validate coverage before rolling it out globally.

$ skill-scanner scan --cel-mode enforce <target>

Include the ATR rule pack alongside core rules to extend detection coverage in an on-demand scan.

$ skill-scanner scan --rule-packs atr <target>

Adds --cel-mode off|shadow|enforce flag to override the active CEL gate policy for a single invocation without changing the global configuration.
Adds --rule-packs atr flag to opt in to the ATR rule pack as an optional input outside the core + CEL release gate.
Adds cel.mode configuration key supporting off, shadow, and enforce values to control CEL decision behavior globally.
Adds analyzers.correlation configuration key enabling bounded source/sink and staged-behavior correlation analysis.

4 details in Everything

docs update Sep 6, 2026 · issue 066

skill-scanner gains --trusted-rule-pack and --cel-mode flags for administrator-trusted schema-v2 pack loading and CEL policy control.

└──▷ TRY IT

Validate an administrator-approved YARA/CEL pack before deploying it to production, checking for schema-v2 compliance and CEL type errors.

$ skill-scanner validate-rules --trusted-rule-pack /path/to/org-pack

Run in shadow mode to observe CEL policy matches without enforcement — useful when rolling out a new rule pack to catch false positives first.

$ skill-scanner validate-rules --trusted-rule-pack /path/to/org-pack --cel-mode shadow

Adds --trusted-rule-pack PATH flag to load an administrator-trusted schema-v2 signature/YARA/CEL pack; repeatable for multiple packs.
Adds --cel-mode MODE flag to override policy CEL mode with off, shadow, or enforce.
Extends validate-rules to validate bundled rules and optional trusted schema-v2 packs, including CEL parse/type checks.

Adds --trusted-rule-pack PATH flag to load an administrator-trusted schema-v2 signature/YARA/CEL pack; repeatable for multiple packs.
Adds --cel-mode MODE flag to override policy CEL mode with off, shadow, or enforce.

1 more in Everything

docs update Sep 6, 2026 · issue 066

skill-scanner adds CEL-based correlation mode and a validate-rules subcommand with trusted rule pack support

└──▷ TRY IT

Run CEL decisions in shadow mode first to observe results without blocking scans before committing to enforce

$ skill-scanner validate-rules --trusted-rule-pack /path/to/org-pack

Adds skill-scanner validate-rules --trusted-rule-pack <path> subcommand to validate rules against an org-supplied rule pack

1 detail in Everything

2.1.0 Sep 5, 2026 · issue 066

Skill Scanner 2.1.0 adds a CEL decision layer with off/shadow/enforce modes and expands Python static detection for shell-enabled subprocess calls.

└──▷ GET THIS VERSION

$ git clone --branch 2.1.0 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.1.0

Adds CEL policy modes off, shadow, and enforce — a bounded CEL decision layer (backed by cel-go v0.32.0) that correlates typed analyzer facts after deterministic detection and before optional LLM/Meta analysis.
Adds a versioned protobuf fact contract (skill_scanner.semantic.v1.ScanFacts) with strict schema-v2 pack validation, immutable compiled rule generations, expression hashes, and fail-open telemetry.
Expands static detection to identify shell-enabled subprocess calls through aliases and class scopes, constructed sensitive-file reads, import aliases, and commands hidden by supported repeating-XOR encoding.
Adds pipeline detection for recovered runtime commands.

Adds CEL policy modes off, shadow, and enforce — a bounded CEL decision layer (backed by cel-go v0.32.0) that correlates typed analyzer facts after deterministic detection and before optional LLM/Meta analysis.
Adds a versioned protobuf fact contract (skill_scanner.semantic.v1.ScanFacts) with strict schema-v2 pack validation, immutable compiled rule generations, expression hashes, and fail-open telemetry.
Adds pipeline detection for recovered runtime commands.

1 more in Everything

2.0.14 Sep 1, 2026 · release notes

skill-scanner 2.0.14 adds semantic data exfiltration detection

└──▷ GET THIS VERSION

$ git clone --branch 2.0.14 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.14

docs update Aug 4, 2026 · issue 035

skill-scanner adds pre-commit hook, incremental CI scans, and an expanded CLI allowlist for GitHub Actions workflows

└──▷ TRY IT

Install the pre-commit hook so commits are blocked when changed skills exceed the configured severity threshold.

$ skill-scanner-pre-commit --install

Run incremental skill scans in CI between a base and head commit, limiting work to only the changed files in a PR.

$ pre-commit run skill-scanner --from-ref "$BASE_SHA" --to-ref "$HEAD_SHA"

Adds skill-scanner-pre-commit --install to install a pre-commit hook that maps each changed path to its nearest parent SKILL.md, scans each affected skill once, and blocks commits at the configured severity.
Adds --scan-all flag to the pre-commit hook to scan every configured skill instead of only those affected by changed paths.
Supports incremental CI scans via pre-commit run skill-scanner --from-ref "$BASE_SHA" --to-ref "$HEAD_SHA" to scan only changed files between two revisions.
Expands the reusable workflow's CLI allowlist to include --rule-packs, --use-aidefense, --use-trigger, and --enable-meta, plus LLM limits and repository-local policy/taxonomy paths; unknown flags are rejected before the scan runs.
Documents that --use-osv and --adjudicate are not accepted by the reusable workflow and require the self-hosted pattern instead.

5 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner adds OSV.dev dependency querying, trigger specificity analysis, LLM consensus runs, and token usage reporting

└──▷ USE IT

Enable OSV.dev vulnerable dependency checking and trigger specificity analysis alongside LLM consensus across 3 runs.

yaml

use_osv: true
use_trigger: true
llm_consensus_runs: 3

Adds use_osv config field to query OSV.dev for vulnerable exactly pinned Python dependencies during scans.
Adds use_trigger config field to enable trigger specificity analysis.
Adds llm_consensus_runs integer config field (default: 1) to control the number of LLM runs used for majority consensus adjudication.
Scan results now include aggregate llm_usage with input_tokens, output_tokens, and total_tokens fields when the configured provider reports usage for LLM, meta, or policy-enabled adjudication calls.

4 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner Python SDK adds llm_usage token reporting and build_analyzers factory for programmatic analyzer assembly.

└──▷ USE IT

Assemble all optional analyzers including behavioral, LLM, and OSV checks with 3 consensus runs — matching what the CLI and API produce.

python

from skill_scanner.core.analyzer_factory import build_analyzers
analyzers = build_analyzers(
    policy,
    use_behavioral=True,
    use_llm=True,
    use_osv=True,
    llm_consensus_runs=3,
)
scanner = SkillScanner(analyzers=analyzers, policy=policy)

Enable the demote-only adjudication pass before scanning to apply adjudicator logic programmatically.

python

policy.adjudicator.enabled = True
scanner = SkillScanner(analyzers=analyzers, policy=policy)

Adds llm_usage field (dict[str, int]) to scan results, reporting aggregate input, output, and total tokens across LLM, meta, and adjudication calls.
Adds build_analyzers factory function in skill_scanner.core.analyzer_factory to assemble optional analyzers (use_behavioral, use_llm, use_osv, llm_consensus_runs) programmatically, matching CLI and API parity.
Enables demote-only adjudication pass programmatically via policy.adjudicator.enabled = True before constructing SkillScanner.

3 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner adds adjudicator and llm_analysis policy keys for false-positive demotion and LLM budget control

└──▷ USE IT

Enable adjudication with a confidence threshold to automatically demote likely false positives while keeping an audit trail.

yaml

adjudicator:
  enabled: true
  min_fp_confidence: 4

Restrict LLM transitive-trust findings to only your internal registries and package hosts so external references still trigger full-severity alerts.

yaml

llm_analysis:
  trusted_reference_domains:
    - git.example.com
    - packages.example.com

Adds adjudicator.enabled and adjudicator.min_fp_confidence config keys to enable demote-only false-positive review with a configurable confidence threshold; disabled by default and records decisions for audit.
Adds llm_analysis.trusted_reference_domains config key to list organization-controlled domains whose transitive-trust and supply-chain findings are automatically demoted to LOW severity.
Adds llm_analysis policy section covering prompt/output budgets and a meta multiplier for controlling LLM analysis behavior.

3 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner gains repo scanning, OSV advisory queries, LLM adjudication, multi-format output, and rule-pack controls in one release.

└──▷ TRY IT

Scan a public GitHub repo for skills, including OSV dependency advisories and overlap checks, without cloning manually.

$ skill-scanner scan-repo https://github.com/owner/repo --use-osv --check-overlap

Run a full local skill scan and emit both a machine-readable JSON report and a SARIF file for upload to a code-scanning platform in one pass.

$ skill-scanner scan ./my-skill --format json --format sarif \
  --output-json results.json --output-sarif results.sarif

Review deterministic HIGH/CRITICAL regex matches with LLM adjudication before committing — reduces false-positive noise without a full LLM enrichment pass.

$ skill-scanner scan ./my-skill --adjudicate

New scan-repo subcommand clones a public GitHub repository into a temporary directory, recursively discovers and scans skills, then removes the clone on completion — accepts owner/repo shorthand or a full HTTPS URL.
Adds --use-osv flag to query OSV.dev for advisories affecting exactly pinned Python dependencies; no API key required.
Adds --adjudicate flag for a demote-only LLM review of deterministic HIGH/CRITICAL literal-regex false positives before LLM enrichment.
Adds --llm-max-tokens N to override the LLM response-token budget (default: 8192).
Adds --rule-packs PACK... to enable named packs such as atr and promptguard; run --rule-packs list to inspect available packs.

+8 more show less

Supports repeating --format to produce multiple report formats in a single scan run.
Adds per-format output path flags --output-json, --output-sarif, --output-markdown, --output-html, and --output-table.
Adds --render-markdown / --no-render-markdown to override terminal Markdown rendering.
Adds --taxonomy PATH to override the Cisco AI taxonomy JSON/YAML file.
Adds --threat-mapping PATH to override the threat mapping JSON file.
Adds openai-compatible as an LLM shortcut value for the LLM provider flag.
New skill-scanner-pre-commit hook command with --install to register the built-in Git hook and --scan-all to scan all configured skills; in CI, integrates with pre-commit run skill-scanner --from-ref "$BASE_SHA" --to-ref "$HEAD_SHA" to scope scans to changed paths between two revisions.
scan-repo supports --no-recursive to disable recursive skill discovery (recursive is on by default).

13 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner gains repo scanning, multi-format output, behavioral/LLM analyzers, and rule pack selection in one release.

└──▷ TRY IT

Scan a remote GitHub repository for all skills without cloning it locally — useful in CI pipelines that operate against upstream repos.

$ skill-scanner scan-repo owner/repo

Run the full analyzer stack — behavioral, OSV vulnerability DB, LLM semantic, and metadata — with ATR and PromptGuard rule packs to maximize detection coverage on a local skill.

$ skill-scanner scan /path/to/skill --use-behavioral --use-osv --use-llm --enable-meta --rule-packs atr promptguard

Produce both JSON and SARIF reports from a single scan pass — ideal for feeding results simultaneously into a SIEM and a code-review tool like GitHub Advanced Security.

$ skill-scanner scan /path/to/skill --format json --format sarif --output-json results.json --output-sarif results.sarif

Adds scan-repo owner/repo subcommand to scan every skill in a public GitHub repository in a single invocation.
Adds --use-behavioral, --use-osv, --use-llm, and --enable-meta flags to scan for dependency, OSV, and LLM-powered semantic analysis.
Adds --rule-packs to scan and scan-all for selecting optional rule packs; supports atr and promptguard packs, and accepts list as a value to enumerate all bundled packs.
Adds --recursive flag to scan-all to traverse nested skill directories.
Adds simultaneous multi-format output via --format json --format sarif combined with --output-json <path> and --output-sarif <path>, eliminating the need to scan twice for different report formats.

5 details in Everything

docs update Aug 4, 2026 · issue 035

Skill Scanner adds OSV dependency scanning, an adjudicator engine, ATR and PromptGuard rule packs, and extended detection coverage across 9 ecosystems.

└──▷ TRY IT

Run both the ATR and PromptGuard rule packs together to maximise detection coverage in a single scan.

$ skill-scanner scan ./skill --rule-packs atr promptguard

Enable the adjudicator alongside LLM enrichment and the meta-analyzer to reduce false positives before results are promoted.

$ skill-scanner scan ./skill --use-llm --enable-meta --adjudicate

Check pinned Python dependencies against the OSV database without any API key as part of a CI pipeline.

$ skill-scanner scan ./skill --use-osv

Adds --use-osv flag to activate the OSV Analyzer, which checks known vulnerabilities in exactly pinned Python dependencies with no API key required.
Adds --adjudicate flag to enable the Adjudicator, a demote-only LLM review that can reduce deterministic HIGH/CRITICAL literal-regex false positives to INFO without ever promoting a finding.
Adds --rule-packs atr to enable the ATR (Cisco AI Threat Research) rule pack, currently covering 712 rules.
Adds --rule-packs promptguard to enable the PromptGuard rule pack with 26 rules covering PII, provider secrets, and LLM/Markdown exfiltration.
Aggregates Adjudicator, LLM analyzer, and meta-analyzer token usage under llm_usage in JSON output when the provider reports usage.

+4 more show less

Extends unpinned-dependency detection to Python, Node/npm, Ruby, Go, Rust, Java/Maven, .NET/NuGet, PHP/Composer, and Swift manifests.
Expands suspicious-URL detection in YAML, JSON, TOML, INI, and environment/config files to include bore.pub, serveo.net, and localtunnel.me alongside existing ngrok domains.
Adds Unicode Tag Block (ASCII-smuggling) payload detection, generic jailbreak pattern detection, and improved OpenAI/Anthropic project-key detection to core coverage.
Adds JavaScript and TypeScript content to analyzability scoring, plus recursive discovery of symlinked skill directories.

9 details in Everything

docs update Aug 4, 2026 · issue 035

skill-scanner adds OpenAI-compatible endpoint routing, per-role model overrides, and OSV.dev dependency scanning via new env vars and --use-osv.

Adds SKILL_SCANNER_LLM_PROVIDER environment variable to route LLM calls, including openai for OpenAI-compatible endpoints.
Adds SKILL_SCANNER_LLM_BASE_URL environment variable to point skill-scanner at any OpenAI-compatible base URL.
Adds SKILL_SCANNER_LLM_USER environment variable to inject a raw Chat Completions user field on OpenAI-compatible routes.
Adds SKILL_SCANNER_LLM_TEMPERATURE environment variable to override sampling temperature, or set to none to omit it entirely.
Adds SKILL_SCANNER_ADJUDICATOR_LLM_MODEL environment variable to override the model used specifically for the --adjudicate path (e.g. vertex_ai/gemini-2.5-pro).

+4 more show less

Supports Vertex AI ambient credentials via GOOGLE_APPLICATION_CREDENTIALS or Application Default Credentials, including Workload Identity, with no extra configuration.
Supports ambient AWS/IAM credentials for Bedrock with no extra configuration.
Adds --use-osv flag for OSV.dev dependency scanning — requires network access but no API key or additional package.
GitHub release artifacts now ship with build-provenance attestations and an SBOM, enabling supply-chain verification and software-inventory retention for controlled environments.

9 details in Everything

2.0.13 Aug 3, 2026 · issue 035

Skill Scanner 2.0.13 adds OSV.dev dependency scanning, unpinned-dependency detection, suspicious-URL classification, trusted-domain LLM policy, and LLM token usage in JSON output.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.13 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.13

└──▷ TRY IT

Scan a skill's dependencies against the OSV advisory database to catch known vulnerabilities in pinned or unpinned packages.

$ skill-scanner scan /path/to/skill --use-osv

Run a full CI scan with LLM analysis and emit SARIF output, while failing the build on any high-severity finding and tracking token spend in the JSON result.

$ skill-scanner scan-all ./skills --recursive --use-llm --use-osv --fail-on-severity high --format sarif --output results.sarif

Adds --use-osv flag to enable the new OSV.dev dependency vulnerability analyzer, checking dependencies against the open OSV advisory database.
Adds trusted_reference_domains to the LLM analysis policy to allowlist domains that should not be flagged as suspicious during semantic analysis.
Exposes LLM token usage in ScanResult JSON output, including adjudicator token consumption, enabling cost tracking and auditing.
Flags unpinned dependencies across manifest formats via the static analyzer, surfacing supply-chain risk in skill packages.
Classifies suspicious URLs found in configuration files via the static analyzer.

+4 more show less

Demotes literal-regex false positives on deterministic HIGH+ findings via the adjudicator, reducing noise without sacrificing real detections.
Supports incremental CI skill scans via the pre-commit integration, scanning only changed skills instead of the full set.
Expands the ATR rule pack from 314 to 712 supported rules (pack version 3.5.6).
Attests build provenance and publishes an SBOM for release artifacts, supporting software supply-chain verification.

9 details in Everything

2.0.12 Jun 24, 2026 · release notes

skill-scanner 2.0.12 adds ASCII/Unicode smuggling detection, YARA-based jailbreak rules, and repo-name propagation.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.12 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.12

Detects ASCII smuggling attacks via Unicode Tag Block characters in scanned skills.
Adds a YARA rule for jailbreak detection.
Supports passing repository name through the scanner for richer scan context.
Supports the OpenAI user request field when using LLM-backed analysis.
Allows temperature override and omits temperature for newer Claude and o1 models.

5 details in Everything

2.0.12 Jun 24, 2026 · issue 014

skill-scanner 2.0.12 adds ASCII smuggling detection, jailbreak YARA rule, and repo-name propagation for scans.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.12 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.12

└──▷ TRY IT

Scan a skill for ASCII smuggling and jailbreak patterns — both new detections fire automatically via the static engine, no extra flags needed.

$ skill-scanner scan /path/to/skill --format sarif --output results.sarif

Scan a GitHub repo and surface jailbreak/ASCII-smuggling findings in CI, with the repo name now correctly propagated in scan metadata.

$ skill-scanner scan-repo owner/repo --use-llm --fail-on-severity high --format sarif --output results.sarif

Adds detection of ASCII smuggling via the Unicode Tag Block, catching a covert data-hiding technique used in prompt injection attacks.
Adds a jailbreak detection YARA rule to the static analysis engine.
Extends scanner to pass repository name through scan context, improving traceability in multi-repo pipelines.
Supports the OpenAI user request field in LLM analyzer calls.
Enables temperature override and automatic temperature omission for newer Claude and o1 models in the LLM analyzer.

5 details in Everything

2.0.10 Apr 30, 2026 · release notes

skill-scanner 2.0.10 expands ATR rules 9× to 314, adds --render-markdown flag, and supports OpenAI-compatible endpoints.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.10 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.10

└──▷ TRY IT

Force markdown rendering on in a terminal that doesn't auto-detect it, useful in CI pipelines where output is piped to a log viewer.

$ skill-scanner scan <target> --render-markdown

Expands the ATR detection pack from 34 to 314 rules, restructured by category.
Adds --render-markdown CLI flag to override markdown rendering behavior.
Supports OpenAI-compatible LLM endpoints for flexible backend configuration.

3 details in Everything

2.0.9 Apr 10, 2026 · release notes

skill-scanner 2.0.9 adds a PromptGuard rule pack covering PII, secrets, and LLM exfiltration detection.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.9 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.9

2.0.8 Apr 6, 2026 · release notes

skill-scanner 2.0.8 adds MCP/multi-agent attack detection, a --rule-packs flag, and Anthropic/OpenAI key prefix detection.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.8 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.8

└──▷ TRY IT

Load the new ATR community rule pack alongside your existing packs to catch MCP tool-poisoning and multi-agent attack patterns in one pass.

$ skill-scanner scan --rule-packs atr,default <target>

Scan an agent codebase for accidentally committed Anthropic or OpenAI project keys as part of a CI pre-merge check.

$ skill-scanner scan --rule-packs atr,default <path>

Adds ATR community rule pack with 34 rules covering MCP tool poisoning, multi-agent attacks, and advanced prompt injection.
New --rule-packs CLI flag enables loading multiple signature rule packs in a single scan invocation.
Detects documented Anthropic and OpenAI project API key prefixes to flag exposed credentials.

3 details in Everything

2.0.7 Apr 2, 2026 · release notes

skill-scanner 2.0.7 adds --lenient mode to scan skills that lack a SKILL.md file

└──▷ GET THIS VERSION

$ git clone --branch 2.0.7 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.7

└──▷ TRY IT

Scan a skill directory that has no SKILL.md — useful for incomplete or in-progress skill packages during development

$ skill-scanner --lenient <path>

2.0.5 Mar 24, 2026 · release notes

skill-scanner 2.0.5 lets --output-<fmt> flags drive the primary output format directly.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.5 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.5

└──▷ TRY IT

Emit scan results in a specific format as the primary output without extra plumbing.

$ skill-scanner scan <target> --output-json

Supports using --output-<fmt> flags to control the primary output format, not just secondary formats.

1 detail in Everything

2.0.2 Mar 9, 2026 · release notes

skill-scanner 2.0.2 adds GPT-5 support and strengthens multilingual prompt-injection detection.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.2 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.2

Adds GPT-5 model support via drop_params=True for compatibility with the new API.
Strengthens multilingual prompt-injection detection guidance for more accurate cross-language findings.

2 details in Everything

2.0.1 Mar 6, 2026 · release notes

skill-scanner 2.0.1 renders Markdown output directly in the terminal via --format markdown.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.1 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.1

└──▷ TRY IT

Get human-readable, formatted scan results directly in your terminal without piping to a separate Markdown renderer.

$ skill-scanner scan <target> --format markdown

2.0.0 Feb 26, 2026 · release notes

Skill Scanner 2.0 ships a policy engine, JS/TS scanning, five new analysis engines, and an interactive wizard.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.0 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 2.0.0

└──▷ TRY IT

Export a strict baseline policy file, then run a scan against it — useful for enforcing tighter thresholds in CI without touching code.

$ skill-scanner generate-policy --preset strict -o policy.yaml && skill-scanner scan ./my-skill --policy policy.yaml --format sarif --output-sarif results.sarif

Bring your own detection rules for proprietary threat patterns by pointing the scanner at a custom rule pack directory.

$ skill-scanner scan ./my-skill --custom-rules ./packs/my-org-rules/ --format markdown --output-markdown report.md

Launch the interactive wizard for a guided audit — ideal for onboarding new team members or quickly auditing an unfamiliar skill repo.

$ skill-scanner wizard

Adds a YAML-based Scan Policy Engine with three built-in presets (strict, balanced, permissive) and 13 independently configurable sections, replacing all hardcoded thresholds and allowlists.
Introduces skill-scanner generate-policy --preset <name> -o policy.yaml to export a baseline policy and skill-scanner configure-policy for a full terminal UI (Textual TUI) to edit every policy setting.
Replaces the monolithic signatures.yaml with a modular Rule Pack Architecture (packs/core/) including 14 YARA rule files, 12 Python check modules, a formal pack.yaml manifest, and --custom-rules support for user-supplied packs.
Adds first-class JavaScript and TypeScript scanning: eval, child_process, Function constructor, fetch, fs access, secrets, obfuscation patterns, and asset-level prompt-injection scanning for .html, .css, .svg, .xml, .xsd.
New Strict Structure Validator (SkillValidator) performs pre-load structural checks for hidden files, symlinks, disallowed extensions, binary content, non-UTF-8 encoding, and missing/malformed SKILL.md frontmatter.

+17 more show less

New Interactive Scan Wizard provides a guided step-by-step scanning mode that auto-detects skills, walks through analyzer/policy/output selection, and generates the equivalent CLI command.
New Pipeline Analyzer models taint flow through shell pipelines using a source → transform → sink model to detect multi-step attack chains (data exfiltration, fetch-execute, find-exec, variable laundering).
New Bytecode Analyzer detects .pyc files without matching .py source and bytecode whose AST doesn't match its source file, flagging hidden code and supply-chain tampering.
New Content Extractor recursively unpacks ZIP, TAR, DOCX/XLSX/PPTX, JAR/WAR/APK archives with zip-bomb protection, path-traversal rejection, and VBA macro/OLE detection, producing virtual SkillFile objects for nested analysis.
New File Magic Detection (Magika) uses Google Magika (200+ types, ~99% accuracy) with magic-byte fallback to flag extension-vs-content mismatches (e.g., a .py file that is actually an ELF binary) as CRITICAL severity.
New Bash Taint Tracker performs lightweight dataflow analysis for bash scripts, tracking taint from command substitution, env vars, sensitive file reads, and network sources through variable propagation to dangerous sinks.
Adds a four-tier Command Safety model (SAFE / CAUTION / RISKY / DANGEROUS) that evaluates commands in full context — arguments, pipes, redirects, and chained commands — fully configurable via scan policy.
Expands static analysis to a 13-pass architecture covering manifest validation, prompt injection in SKILL.md, Python and Bash code checks, PDF structural analysis, Office macro detection, homoglyph attacks, YARA binary patterns, and asset-level prompt injection.
Adds Finding Deduplication: when multiple engines flag the same line for the same threat, findings collapse to a single entry at the highest severity with full engine attribution.
Adds Analyzability Scoring (0–100) quantifying what fraction of a skill the scanner can inspect, surfacing a HIGH-severity finding when coverage is low.
Introduces two-phase scan execution: Phase 1 runs all deterministic analyzers; Phase 2 feeds their enrichment context to the LLM for semantic analysis and false-positive filtering.
Adds native Azure AD/Entra ID authentication for Azure OpenAI via DefaultAzureCredential; install with pip install skill-scanner[azure].
Adds DeepSeek model support with automatic json_object response format fallback for models that don't support JSON Schema mode.
Supports multiple simultaneous output formats in a single scan run via repeated --format flags and per-format output flags (--output-json, --output-sarif, --output-markdown, --output-html, --output-table).
New standalone HTML Reporter generates self-contained reports with a severity summary, verdict banner, inline pipeline flow diagrams, sortable findings table, and dark theme.
Adds --version / -V flag to print the installed version.
Adds Homebrew installation support for macOS via brew tap cisco-ai-defense/skill-scanner && brew install skill-scanner.

22 details in Everything

└──▷ BREAKING ON UPGRADE

!The --max-file-size CLI flag is replaced by policy knobs; any automation passing --max-file-size will break on upgrade.
!The monolithic signatures.yaml is replaced by the packs/core/ directory with a pack.yaml manifest; any tooling or config referencing signatures.yaml directly will break.

advisory CVE-2026-26057 Feb 17, 2026 · issue 128

CVE-2026-26057: Skill-scanner Unsecured Network Binding Vulnerability (CVSS 6.5, affects <= 1.0.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1.0.2 Feb 6, 2026 · release notes

skill-scanner 1.0.2 adds custom YARA rules via CLI and retains false-positive metadata in meta-analyzer output.

└──▷ GET THIS VERSION

$ git clone --branch 1.0.2 https://github.com/cisco-ai-defense/skill-scanner.git
# already have the repo? check out this version:
$ git checkout 1.0.2

Adds custom rules CLI support, letting practitioners supply their own detection rules at scan time.
Retains false positives with metadata in meta-analyzer output, preserving context for triage instead of silently dropping them.
Updates AITech Taxonomy with combined threat-classification improvements.

3 details in Everything

skill-scanner

Summary

How skill-scanner helps

Languages

Features

What skill-scanner offers you

release 10 total

docs

example

release 8 total

example

release

example

release

release

release

docs

release

release

release

release

release

release

release

docs

command line

example

release 19 total

docs

example

release

docs

example

release

docs

command line

release

docs

command line

example

release

docs

example

release

release

docs

example

release

docs

example

release

docs

command line

release

release

example

release

release

example

release

release

release

release

docs

command line

release

example

release

example

release

release

release

release

release

release

release

release

release

release

release