skill-scanner: Scan Agent Skills for Prompt Injection and Malicious Patterns

A skill is instructions you hand to an agent with growing permissions — the same place prompt injection and embedded malicious commands do their damage. As the 2026-08-29 weekly digest noted, curated skill indexes can even vanish overnight; the repos you depend on may not have your security posture in mind. cisco-ai-defense/skill-scanner (2.5k stars, Apache-2.0) is a best-effort scanner that checks skill packages for prompt injection, data exfiltration, and malicious code patterns before you install or serve them.

Why This Skill Matters

The scanner layers three detection classes under one CLI. Pattern-based detection (YAML + YARA rules) catches known signatures; an LLM-as-a-judge pass handles semantic threats signatures miss; and behavioral dataflow analysis looks for risky data movement within the skill. A meta-analyzer then filters false positives and prioritizes findings — the README is explicit that maximizing coverage while minimizing noise is the design goal.

It is built to sit in a security pipeline, not just a laptop: SARIF output feeds GitHub Code Scanning, a reusable GitHub Actions workflow exposes it to CI, exit codes gate builds, and a standard pre-commit hook integration scans skills before every commit. It supports Codex and Cursor skill formats per the Agent Skills spec, and a --lenient flag extends scanning to non-standard layouts like Claude Code's .claude/commands/*.md and flat markdown skill repos.

Installation

The scanner needs Python 3.10+; install via uv or pip:

uv pip install cisco-ai-skill-scanner

The optional analyzers read their keys from the environment — an LLM API key and model for the LLM and meta analyzers, a VirusTotal key for binary scanning, and Cisco AI Defense credentials for the cloud engine.

Real Workflow: Audit a Skill Before You Install It

1. Download or clone the skill repo you are considering.
2. Scan the directory:

skill-scanner scan /path/to/skill --use-behavioral --use-llm

3. Read the findings with the README's own caveat in mind: no findings does not mean no risk, and high-risk deployments still need human review — the scanner narrows the surface; it does not certify safety.

Real Workflow: Audit Everything You Already Have

For the skills already installed across your agents, a recursive sweep:

skill-scanner scan-all ~/.claude/skills --recursive --use-behavioral

And to audit an upstream repo before adopting it:

skill-scanner scan-repo owner/repo --use-llm

The scan-repo shorthand takes the owner/repo form or a full URL.

Tips

• Wire it into CI with the reusable GitHub Actions workflow and SARIF output; gate the build on scan results with the exit codes.
• Add the pre-commit hook so a scan runs before every commit lands in a shared skills repo.
• Use --use-trigger to check for vague descriptions that can hide malicious intent, and --llm-consensus-runs 3 to keep only majority-agreed LLM findings when noise matters.
• The README's scope-and-limitations section is worth reading before you rely on it in production — it is unusually honest about coverage limits.

When Not to Use This

It is a detection tool with explicitly bounded coverage: novel or zero-day techniques will slip through, and false negatives exist. If a skill is mission-critical, the scanner complements — it does not replace — manual code review and threat modeling. And the heavy analyzers need API keys and cost tokens; the signature-only path is the lightweight default.

See the leaderboard for more skills.