https://cybertoolchain.io/tools/skill-scanner New releases and features in skill-scanner, tracked by The Cyber Toolchain. en Wed, 21 Oct 2026 15:05:24 GMT https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.3.1 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.3.1 Wed, 21 Oct 2026 15:05:24 GMT Skill Scanner 2.3.1 ships full AITech taxonomy definitions via get_aitech_definition() and updates stale LLM provider defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds get_aitech_definition() and get_aisubtech_definition() functions to look up the bundled definition for any AITech objective, technique, or sub-technique code directly from the snapshot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Updates the `--llm-provider openrouter` default model to `openrouter/openai/gpt-5.6-sol` and the `gcp-vertex` default to `vertex_ai/gemini-3.8-flash` to replace retired models. • Ships a generated taxonomy reference covering all 19 objectives, 44 techniques, and 130 sub-techniques, with each entry in `threats.py` carrying a full description and AI Defense labels. Breaking changes: • `scan_metadata.taxonomy.snapshot_sha256` changes from `3df746f0…` to `413e8ce9…`; anything that pins this hash must be updated. • OpenRouter users relying on the default model now get `openrouter/openai/gpt-5.6-sol` instead of `openrouter/openai/gpt-4`; set `SKILL_SCANNER_LLM_MODEL` to pin a specific model. • Vertex AI users relying on the default model now get `vertex_ai/gemini-3.8-flash` instead of `vertex_ai/gemini-1.5-pro`; set `SKILL_SCANNER_LLM_MODEL` to pin a specific model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.3.0 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.3.0 Thu, 15 Oct 2026 07:18:11 GMT Skill Scanner 2.3.0 maps every finding to Cisco AI taxonomy codes, adds ACTIVE_SENSITIVE_EXFILTRATION detection, and surfaces SYMLINK_NOT_SCANNED and SKILL_LOAD_FAILED findin⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `aitech`, `aitech_name`, `aisubtech`, `aisubtech_name`, `aitech_mappings`, `aisubtech_mappings`, `framework_mappings`, `taxonomy_status`, and `taxonomy_source` fields to every finding, plus `scan_metadata.taxonomy` counts and SARIF result properties, mapping to OWASP, MITRE ATLAS, and NIST AML crosswalks from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new detection `ACTIVE_SENSITIVE_EXFILTRATION` to catch plain-language instructions that read a local credential file and send it to a remote host. • Reports symlinks among a skill's files as `SYMLINK_NOT_SCANNED` findings (HIGH when the target leaves the skill root) and skills that fail to load as `SKILL_LOAD_FAILED` findings in `scan-all`, instead of silently skipping them. • Extends frontmatter scanning to cover all `SKILL.md` values and comments — including quoted and complex keys, YAML aliases, merge keys, escape sequences, `!!binary` values, and multi-line folded values — except the `allowed-tools` value. Breaking changes: • Taxonomy codes follow taxonomy 2.0.0: jailbreak rules move from `AITech-2.1` to `AITech-1.1` / `AISubtech-1.1.5`, and hardcoded secrets from `AISubtech-8.2.2` to `AISubtech-14.1.1`. Any filters on 1.x codes must be updated. • The `AITech-99.9` / `AISubtech-99.9.9` placeholder codes are no longer emitted. • `scan-all` now reports folders with unloadable skills or symlinks as findings instead of skipping them, so SARIF output, markdown output, and `--fail-on-severity` exit codes include them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.2.2 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.2.2 Fri, 09 Oct 2026 02:43:53 GMT Skill Scanner 2.2.2 adds whole-environment dump detection and a new `SKILL_SCANNER_ADJUDICATOR_LLM_MAX_TOKENS` env var for LLM output control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SKILL_SCANNER_ADJUDICATOR_LLM_MAX_TOKENS` environment variable to set a separate output-token limit for the adjudicator LLM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SKILL_SCANNER_ADJUDICATOR_LLM_REASONING_EFFORT` environment variable to override the adjudicator's reasoning mode (disabled by default in this release). • Adds `DATA_EXFIL_ENV_DUMP` detection rule for whole process-environment value dumps in Python, JavaScript/TypeScript, and shell code, with targeted reads, keys-only enumeration, literal examples, and comments kept below the HIGH rule boundary. Breaking changes: • The adjudicator's reasoning is now disabled by default; set `SKILL_SCANNER_ADJUDICATOR_LLM_REASONING_EFFORT` to restore the previous behaviour. • A shell prompt marker by itself no longer captures a command on the next line; prompt and command must share a line. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference Mon, 05 Oct 2026 08:18:21 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference Sun, 04 Oct 2026 14:00:04 GMT skill-scanner: Adds `SKILL_SCANNER_LLM_MODEL` environment variable to select the LLM judge model, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `anthropic/claude-sonnet-5-5`. • Enables an LLM judge for scan analysis; if the judge cannot be built (e.g. no API key), the request fails with HTTP 400. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference https://cisco-ai-defense.github.io/docs/skill-scanner/api-reference Sat, 03 Oct 2026 13:07:27 GMT skill-scanner adds LLM judge, OSV.dev dependency scanning, meta-analyzer, and named scan presets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an LLM judge option (recommended) powered by a configurable model such as `anthropic/claude-sonnet-5-5`, set via the `SKILL_SCANNER_LLM_MODEL` environment variable; requests fail with HTTP 400 if the judge cannot be built (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ no API key). • Queries OSV.dev for vulnerable exactly-pinned Python and JavaScript dependencies. • Adds a meta-analyzer option (not recommended per Recommended Settings guidance). • Adds named scan presets — `balanced`, `low-noise`, `quiet`, `strict`, `permissive` — accepted as a preset name or a YAML path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.2.0 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.2.0 Fri, 02 Oct 2026 22:59:48 GMT Skill Scanner 2.2.0 adds `low-noise`/`quiet` presets, scoped suppressions, Apple on-device LLM, OpenAI-compatible gateway support, and two new detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `low-noise` and `quiet` scan presets that demote high-false-positive rules and cap judge findings via `low_confidence_max_severity` and `contextual_risk_max_severity`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds scoped rule suppressions in policy YAML: target a specific skill with `skills` or a file path pattern with `paths`, so a single false positive no longer disables a rule scan-wide. • Adds `SKILL_SCANNER_LLM_PROVIDER=openai-compatible` environment variable to route LLM analysis through any OpenAI-compatible gateway. • Adds `--llm-decompose` flag to run one focused LLM analysis pass per concern instead of a combined pass. • Adds `use_llm`, `llm_model`, and `llm_provider` keys to `.skill_scannerrc` so the pre-commit hook can invoke the LLM judge. • Adds `scanner_version`, `llm_provider`, `llm_base_url`, and `aws_region` inputs to the reusable GitHub Actions workflow. • Adds new `SUPPLY_CHAIN_REGISTRY_REDIRECT` (HIGH) and `UNDECLARED_NETWORK_DESTINATION` (LOW) static detection rules. • Adds experimental on-device Apple Foundation Model support as an LLM provider. • Extends OSV dependency scanning to read `package.json` (npm) in addition to previously supported manifests. • Extends frontmatter scanning to cover `description` and `when_to_use` fields across core rules, YARA, and active-directive rules. • Updates default LLM model to `claude-sonnet-5-5` (or `bedrock/us.anthropic.claude-sonnet-5-5` on Bedrock); adds a recommended-settings guide with measured recall/FPR/F1 figures across all presets. Breaking changes: • `--use-llm`, `--use-behavioral`, and `--enable-meta` now fail closed: if the requested analyzer cannot be built (missing API key, missing extra, unknown provider), the scan exits with code 2 and the REST API returns 400. Previously the scan ran rules only and exited 0. • Exit code 2 now means a usage or configuration error (e.g. unknown policy); previously this condition returned exit code 1. Exit code 1 still means findings at or above `--fail-on-severity`. • The default LLM model is now `claude-sonnet-5-5`; the previous default `claude-3-5-sonnet-20241022` is retired. • Verdict repair is on by default: a SAFE verdict that lists findings is promoted to SUSPICIOUS. To restore the prior behavior, set `SKILL_SCANNER_LLM_REPAIR_INCONSISTENT_VERDICT=0`. • Unpinned dependencies are now reported at LOW severity instead of MEDIUM. • The interactive wizard no longer enables the meta-analyzer by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.1.0 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.1.0 Sat, 05 Sep 2026 19:49:59 GMT Skill Scanner 2.1.0 adds a CEL decision layer with `off`/`shadow`/`enforce` modes and expands Python static detection for shell-enabled subprocess calls. • Adds CEL policy modes `off`, `shadow`, and `enforce` — a bounded CEL decision layer (backed by `cel-go` v0.32.0) that correlates typed analyzer facts after deterministic detection and before optional LLM/Meta analysis. • Adds a versioned protobuf fact contract (`skill_scanner.semantic.v1.ScanFacts`) with strict schema-v2 pack validation, immutable compiled rule generations, expression hashes, and fail-open telemetry. • Expands static detection to identify shell-enabled subprocess calls through aliases and class scopes, constructed sensitive-file reads, import aliases, and commands hidden by supported repeating-XOR encoding. • Adds pipeline detection for recovered runtime commands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.13 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.13 Mon, 03 Aug 2026 22:30:09 GMT Skill Scanner 2.0.13 adds OSV.dev dependency scanning, unpinned-dependency detection, suspicious-URL classification, trusted-domain LLM policy, and LLM token usage in JSON output. • Adds `--use-osv` flag to enable the new OSV.dev dependency vulnerability analyzer, checking dependencies against the open OSV advisory database. • Adds `trusted_reference_domains` to the LLM analysis policy to allowlist domains that should not be flagged as suspicious during semantic analysis. • Exposes LLM token usage in `ScanResult` JSON output, including adjudicator token consumption, enabling cost tracking and auditing. • Flags unpinned dependencies across manifest formats via the static analyzer, surfacing supply-chain risk in skill packages. • Classifies suspicious URLs found in configuration files via the static analyzer. • Demotes literal-regex false positives on deterministic HIGH+ findings via the adjudicator, reducing noise without sacrificing real detections. • Supports incremental CI skill scans via the pre-commit integration, scanning only changed skills instead of the full set. • Expands the ATR rule pack from 314 to 712 supported rules (pack version 3.5.6). • Attests build provenance and publishes an SBOM for release artifacts, supporting software supply-chain verification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.12 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.12 Wed, 24 Jun 2026 19:15:11 GMT skill-scanner 2.0.12 adds ASCII/Unicode smuggling detection, YARA-based jailbreak rules, and repo-name propagation. • Detects ASCII smuggling attacks via Unicode Tag Block characters in scanned skills. • Adds a YARA rule for jailbreak detection. • Supports passing repository name through the scanner for richer scan context. • Supports the OpenAI `user` request field when using LLM-backed analysis. • Allows temperature override and omits temperature for newer Claude and o1 models. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.12 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.12 Wed, 24 Jun 2026 19:15:11 GMT skill-scanner 2.0.12 adds ASCII smuggling detection, jailbreak YARA rule, and repo-name propagation for scans. • Adds detection of ASCII smuggling via the Unicode Tag Block, catching a covert data-hiding technique used in prompt injection attacks. • Adds a jailbreak detection YARA rule to the static analysis engine. • Extends scanner to pass repository name through scan context, improving traceability in multi-repo pipelines. • Supports the OpenAI `user` request field in LLM analyzer calls. • Enables temperature override and automatic temperature omission for newer Claude and o1 models in the LLM analyzer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.10 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.10 Thu, 30 Apr 2026 01:33:27 GMT skill-scanner 2.0.10 expands ATR rules 9× to 314, adds --render-markdown flag, and supports OpenAI-compatible endpoints. • Expands the ATR detection pack from 34 to 314 rules, restructured by category. • Adds `--render-markdown` CLI flag to override markdown rendering behavior. • Supports OpenAI-compatible LLM endpoints for flexible backend configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.9 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.9 Fri, 10 Apr 2026 16:21:19 GMT skill-scanner 2.0.9 adds a PromptGuard rule pack covering PII, secrets, and LLM exfiltration detection. • Adds PromptGuard data protection rule pack with detections for PII, secrets, and LLM exfiltration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.8 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.8 Mon, 06 Apr 2026 15:13:16 GMT skill-scanner 2.0.8 adds MCP/multi-agent attack detection, a --rule-packs flag, and Anthropic/OpenAI key prefix detection. • Adds ATR community rule pack with 34 rules covering MCP tool poisoning, multi-agent attacks, and advanced prompt injection. • New `--rule-packs` CLI flag enables loading multiple signature rule packs in a single scan invocation. • Detects documented Anthropic and OpenAI project API key prefixes to flag exposed credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.7 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.7 Thu, 02 Apr 2026 13:44:57 GMT skill-scanner 2.0.7 adds --lenient mode to scan skills that lack a SKILL.md file • Adds `--lenient` flag to enable scanning of skills that do not have a SKILL.md file present Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.5 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.5 Tue, 24 Mar 2026 15:59:16 GMT skill-scanner 2.0.5 lets --output-<fmt> flags drive the primary output format directly. • Supports using `--output-<fmt>` flags to control the primary output format, not just secondary formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.1 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.1 Fri, 06 Mar 2026 03:25:25 GMT skill-scanner 2.0.1 renders Markdown output directly in the terminal via --format markdown. • Renders Markdown-formatted results natively in the terminal when using `--format markdown` with stdout output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.0 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/2.0.0 Thu, 26 Feb 2026 16:37:16 GMT Skill Scanner 2.0 ships a policy engine, JS/TS scanning, five new analysis engines, and an interactive wizard. • Adds a YAML-based Scan Policy Engine with three built-in presets (`strict`, `balanced`, `permissive`) and 13 independently configurable sections, replacing all hardcoded thresholds and allowlists. • Introduces `skill-scanner generate-policy --preset <name> -o policy.yaml` to export a baseline policy and `skill-scanner configure-policy` for a full terminal UI (Textual TUI) to edit every policy setting. • Replaces the monolithic `signatures.yaml` with a modular Rule Pack Architecture (`packs/core/`) including 14 YARA rule files, 12 Python check modules, a formal `pack.yaml` manifest, and `--custom-rules` support for user-supplied packs. • Adds first-class JavaScript and TypeScript scanning: `eval`, `child_process`, `Function` constructor, `fetch`, `fs` access, secrets, obfuscation patterns, and asset-level prompt-injection scanning for `.html`, `.css`, `.svg`, `.xml`, `.xsd`. • New Strict Structure Validator (`SkillValidator`) performs pre-load structural checks for hidden files, symlinks, disallowed extensions, binary content, non-UTF-8 encoding, and missing/malformed `SKILL.md` frontmatter. • New Interactive Scan Wizard provides a guided step-by-step scanning mode that auto-detects skills, walks through analyzer/policy/output selection, and generates the equivalent CLI command. • New Pipeline Analyzer models taint flow through shell pipelines using a source → transform → sink model to detect multi-step attack chains (data exfiltration, fetch-execute, find-exec, variable laundering). • New Bytecode Analyzer detects `.pyc` files without matching `.py` source and bytecode whose AST doesn't match its source file, flagging hidden code and supply-chain tampering. • New Content Extractor recursively unpacks ZIP, TAR, DOCX/XLSX/PPTX, JAR/WAR/APK archives with zip-bomb protection, path-traversal rejection, and VBA macro/OLE detection, producing virtual `SkillFile` objects for nested analysis. • New File Magic Detection (Magika) uses Google Magika (200+ types, ~99% accuracy) with magic-byte fallback to flag extension-vs-content mismatches (e.g., a `.py` file that is actually an ELF binary) as CRITICAL severity. • New Bash Taint Tracker performs lightweight dataflow analysis for bash scripts, tracking taint from command substitution, env vars, sensitive file reads, and network sources through variable propagation to dangerous sinks. • Adds a four-tier Command Safety model (SAFE / CAUTION / RISKY / DANGEROUS) that evaluates commands in full context — arguments, pipes, redirects, and chained commands — fully configurable via scan policy. • Expands static analysis to a 13-pass architecture covering manifest validation, prompt injection in `SKILL.md`, Python and Bash code checks, PDF structural analysis, Office macro detection, homoglyph attacks, YARA binary patterns, and asset-level prompt injection. • Adds Finding Deduplication: when multiple engines flag the same line for the same threat, findings collapse to a single entry at the highest severity with full engine attribution. • Adds Analyzability Scoring (0–100) quantifying what fraction of a skill the scanner can inspect, surfacing a HIGH-severity finding when coverage is low. • Introduces two-phase scan execution: Phase 1 runs all deterministic analyzers; Phase 2 feeds their enrichment context to the LLM for semantic analysis and false-positive filtering. • Adds native Azure AD/Entra ID authentication for Azure OpenAI via `DefaultAzureCredential`; install with `pip install skill-scanner[azure]`. • Adds DeepSeek model support with automatic `json_object` response format fallback for models that don't support JSON Schema mode. • Supports multiple simultaneous output formats in a single scan run via repeated `--format` flags and per-format output flags (`--output-json`, `--output-sarif`, `--output-markdown`, `--output-html`, `--output-table`). • New standalone HTML Reporter generates self-contained reports with a severity summary, verdict banner, inline pipeline flow diagrams, sortable findings table, and dark theme. • Adds `--version` / `-V` flag to print the installed version. • Adds Homebrew installation support for macOS via `brew tap cisco-ai-defense/skill-scanner && brew install skill-scanner`. Breaking changes: • The `--max-file-size` CLI flag is replaced by policy knobs; any automation passing `--max-file-size` will break on upgrade. • The monolithic `signatures.yaml` is replaced by the `packs/core/` directory with a `pack.yaml` manifest; any tooling or config referencing `signatures.yaml` directly will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner https://github.com/cisco-ai-defense/skill-scanner/releases/tag/1.0.2 https://github.com/cisco-ai-defense/skill-scanner/releases/tag/1.0.2 Fri, 06 Feb 2026 01:24:01 GMT skill-scanner 1.0.2 adds custom YARA rules via CLI and retains false-positive metadata in meta-analyzer output. • Adds custom rules CLI support, letting practitioners supply their own detection rules at scan time. • Retains false positives with metadata in meta-analyzer output, preserving context for triage instead of silently dropping them. • Updates AITech Taxonomy with combined threat-classification improvements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/skill-scanner