SkillSpector
NVIDIA/SkillSpectorNVIDIA's open-source security scanner for agent skills, with 71 detection patterns, optional LLM review and a skill-inspector skill.
Recommended
Check first Depth 4/5
Cisco Skill Scanner Claude skills
Cisco AI Defense's open-source scanner for agent skills: YARA and YAML rules, dataflow analysis and an optional LLM judge, with SARIF output and a pre-commit hook.
Our verdict Recommended
A maintained, tested scanner with published detection numbers and CI integration; treat it as one layer of review, not a clearance.
What Cisco Skill Scanner does
Skill Scanner is a Python tool (published on PyPI as cisco-ai-skill-scanner) that checks agent skill folders for prompt injection, data exfiltration and malicious code patterns. It layers several engines: pattern rules in YAML and YARA-X, AST and dataflow analysis of scripts, a typed CEL decision layer that correlates detector facts, and optional analyzers that call an LLM judge, VirusTotal for binary hashes or Cisco's AI Defense cloud service. It reads the Agent Skills format used by Codex and Cursor, and with --lenient also scans Claude Code command files and flat markdown skill repos.
For teams, it emits SARIF for GitHub Code Scanning, ships a reusable GitHub Actions workflow and a pre-commit hook that scans only the skills a commit touches, and returns exit codes for failing builds. Presets (low-noise, quiet) and scan policies tune noise.
The README is candid about limits. On a held-out set of 839 malicious and 545 harmless skills, rules alone flagged 7.7% of malicious skills at HIGH severity with a 4.0% false-positive rate; adding the LLM judge raised blocking at HIGH to 33.7% at 6.4% false positives. It says a clean scan does not prove a skill is safe. The 38 small SKILL.md files in the repo are intentionally malicious or inert test fixtures under evals/, about 200 files in all, not skills to install.
Good for
- Teams adding automated skill checks to CI or pre-commit
- People reviewing third-party skills before installing them
- Security researchers comparing skill-scanner approaches
Not for
- Anyone expecting a guarantee that a skill is safe
- Use without any review, since rules-only recall is low
What's inside depth 4/5
A real tool with CI, multiple analysis engines and about 200 eval fixture files with published measured results, though it is a scanner rather than a skill pack.
- Skills
- 38
- Reference docs
- 3
- Scripts
- 24
- Tests / evals
- 204
- Templates
- 1
- Avg SKILL.md
- 0.3 KB
Counted from the repository file tree. How we score depth.
Dependencies and costs
- Python 3.11 to 3.14
- Optional API keys for the LLM judge, VirusTotal or Cisco AI Defense
- Telemetry: none found for the core scanner. If you enable the LLM, VirusTotal or AI Defense analyzers, skill content or file hashes are sent to those services.
Security review
Review before installingCisco's skill scanner for agent skills. The only code we hold is the 24 evaluation fixtures, which are deliberately malicious or benign-lookalike samples used for scanner tests and are not run by the tool. The real scanner is installed from PyPI (not in our snapshot) and, if you enable the optional LLM, VirusTotal or AI Defense analyzers, skill content or binaries are sent to those services.
Worth knowing
- Relies on a CLI or package we could not reviewThe tool is installed from PyPI (
uv pip install cisco-ai-skill-scanner/ pipx) and its scanner source is not in the files we hold.README.md:96 - Installs packages or toolsInstall docs add the cisco-ai-skill-scanner package and optional extras (bedrock, google, vertex, azure) with unpinned pip/uv commands.README.md:96
- Makes network requestsOptional analyzers send data to third parties when enabled: skill content to the configured LLM provider (SKILL_SCANNER_LLM_API_KEY), file hashes to VirusTotal, and with
--vt-upload-filesunknown binaries are uploaded to VirusTotal; Cisco AI Defense is also optional.README.md:248 - Changes files outside your projectOptional pre-commit integration:
pre-commit installorskill-scanner-pre-commit --installwrites a git hook into the user's repository.README.md:459
What we checked
The repository (803 files) on Oct 29, 2026. Not a full review: 703 of 803 files were not downloaded (large repository; we reviewed the skill folders); it contains compiled binaries or archives we cannot read; it relies on code outside the repository: PyPI package cisco-ai-skill-scanner (the scanner itself; 703 of 803 repo files, including all src/ code, docs and CI, are not in our snapshot); VirusTotal, Cisco AI Defense and LLM provider services that optional analyzers call; evals/test_skills/malicious/eicar-test/assets/test-binary.bin (binary fixture) and the SKILL.md files of the intentionally malicious eval skills.
NVIDIA SkillSpector static scan: 31 pattern hits (Data Exfiltration 7, Supply Chain 6, Privilege Escalation 4, Dangerous Code Execution 4, YARA Match 3, Prompt Injection 2). All 31 SkillSpector hits are in evals/: intentionally malicious or near-miss fixtures (env dump, evil.example.com exfiltration, ransomware string, ASCII smuggling, registry redirect, curl|sh in a test SKILL.md) used to test the scanner; I read all 24 fixture code files and each is inert, uses reserved/invalid hosts, and is not part of the installed tool.
A review, not a certification. Skills change after we check them — read the files before installing.
License
Apache-2.0 per the README badge and license section (GitHub's license field reads NOASSERTION) — commercial use allowed.
Can it run unattended?
Not really. It is a one-shot scanner meant to run in CI or pre-commit, not a long-running agent workflow.
Alternatives to Cisco Skill Scanner
Snyk Agent Scan
snyk/agent-scanSnyk's CLI scanner that discovers installed agents, MCP servers and skills on your machine and checks them for prompt injection and other risks.
With caveats
Check first Depth 3/5
Cloudflare security-audit
cloudflare/security-audit-skillA single multi-agent skill from Cloudflare that audits a codebase in six phases and writes validated, independently verified findings.
Recommended
Check first Depth 5/5
FAQ
What is Cisco Skill Scanner?
It is an open-source security scanner from Cisco AI Defense that checks agent skills for prompt injection, data exfiltration and malicious code using rules, dataflow analysis and an optional LLM judge.
How do I install Cisco Skill Scanner?
Install the cisco-ai-skill-scanner package from PyPI on Python 3.11 to 3.14. The README also describes a reusable GitHub Actions workflow and a pre-commit hook.
Is Cisco Skill Scanner reliable?
Its README publishes measured results: rules alone caught 7.7% of malicious skills at HIGH severity, and the LLM judge raised that to 33.7% blocked. It states that a clean scan does not prove a skill is safe.
Cisco Skill Scanner vs NVIDIA SkillSpector: which should I use?
Both scan skills for risky patterns. Cisco's tool adds YARA, dataflow analysis, SARIF output and a pre-commit hook; compare them on your own sample of skills, since both publish limits on recall.
Sources: GitHub repository (stars, license, file tree, last push Oct 26, 2026). Review based on the README and SKILL.md files as published.