Cisco AI Skill Scanner

Security scanner for agent skills. Detects prompt injection, data exfiltration, credential harvesting, and malicious code patterns using static analysis, behavioral dataflow, and optional LLM-as-a-judge.

Quick Scan (recommended default)

bash scripts/scan.sh /path/to/skill

Commands

Scan a single skill

skill-scanner scan /path/to/skill

Scan with behavioral analysis (dataflow)

skill-scanner scan /path/to/skill --use-behavioral

Full scan (all engines, requires API key)

SKILL_SCANNER_LLM_API_KEY="$ANTHROPIC_API_KEY" \
SKILL_SCANNER_LLM_MODEL="claude-sonnet-4-5" \
skill-scanner scan /path/to/skill --use-behavioral --use-llm --enable-meta --llm-provider anthropic

Scan all skills in a directory

skill-scanner scan-all /root/clawd/skills --recursive --use-behavioral

Scan with detailed markdown report

skill-scanner scan /path/to/skill --use-behavioral --format markdown --detailed

Scan before publishing to ClawHub

skill-scanner scan /path/to/skill --use-behavioral --fail-on-severity medium

Severity Levels

• CRITICAL / HIGH — Do not install/publish. Review and fix immediately.
• MEDIUM — Suspicious patterns. Investigate before use.
• LOW — Minor issues. Document and accept risk or fix.
• INFO — Informational only (e.g. missing license). Safe to publish.
• SAFE (0 findings) — No known threat patterns detected.

Key Flags

Workflow: Before Publishing a Skill to ClawHub

1. Run: bash scripts/scan.sh /path/to/skill
2. If SAFE (0 findings) → proceed to publish
3. If INFO only → add missing fields (license, homepage, deps) and re-scan
4. If MEDIUM+ → investigate and fix before publishing

Notes

• "No findings" does not guarantee a skill is 100% safe -- it means no known patterns were detected
• The scanner flags the lossless-claw plugin as a false positive (file read + network send is the LCM summarization pipeline -- it is safe)
• Always run at minimum --use-behavioral for dataflow coverage