What it is
Skill Scanner checks AI agent skills for prompt injection, data exfiltration and malicious code. It layers several engines: YAML and YARA-X patterns, AST and dataflow analysis for Python, an optional LLM judge, and optional cloud analysers. Output can be SARIF for GitHub code scanning, and it ships a pre-commit hook and a reusable GitHub Actions workflow that fails a build above a chosen severity.
The README calls it best-effort and publishes its own numbers. On a held-out test set of 839 malicious and 545 harmless skills, rules alone catch 7.7% of malicious skills at HIGH; with a Gemma 4 26B judge, 66.7% reach review at MEDIUM or above (15.4% false positives) and 33.7% are blocked at HIGH. It needs CPython 3.11 to 3.14; v2.3.1 shipped on 21 October 2026.
Our review
Every skill you install is a set of instructions your agent will trust. That makes skills a supply chain, and in 2026 it is one attackers are actively working.
Skill Scanner checks a skill before an agent ever reads it, and it fits where checks belong: a pre-commit hook, a GitHub Action, SARIF results in code scanning. What earns trust is its honesty. The README says a clean scan does not mean a safe skill, and publishes recall and false-positive rates for each preset.
The catch: those numbers are sobering. Rules alone catch under 8% of malicious skills at the blocking level; adding an LLM judge gets two-thirds to human review but flags about one harmless skill in seven. The LLM, VirusTotal and Cisco cloud analysers also send skill content off your machine, so keep them off private skills.
Our take: use it as a filter that stops lazy attacks and routes suspicious skills to a person. Snyk Agent Scan answers the other question, which skills and MCP servers are already installed across your machines.
Where it earns its place
A platform team curating 60 internal agent skills
Stop a poisoned skill reaching developers
Add the reusable GitHub Actions workflow to the skills repo with a severity threshold, and send MEDIUM findings to a reviewer.
A developer about to install a community skill
Check it locally before Claude Code loads it
uv tool install cisco-ai-skill-scanner, then skill-scanner scan on the folder with only local engines enabled.
Before you commit
- Setup
- Needs CPython 3.11 to 3.14; uv tool install cisco-ai-skill-scanner or pip install cisco-ai-skill-scanner.
- Integrations
- SARIF for GitHub code scanning, pre-commit, reusable GitHub Actions workflow; LLM judge works with any provider or a local model.
- Data and privacy
- Pattern and dataflow engines run locally; the LLM judge, VirusTotal and Cisco cloud analysers send content to those services.
- Cost at scale
- Free; LLM judge cost depends on the model you point it at, and a local model costs nothing per scan.
- Limits
- Best-effort coverage with published false negatives and false positives; Python-only dataflow analysis.
What's good
- Publishes its own recall and false-positive rates
- SARIF, pre-commit hook and GitHub Actions workflow
- Local engines work without sending code anywhere
- Supports Claude Code command files
What's not
- Rules alone catch under 8% of malicious skills at HIGH
- LLM judge adds false positives
- Cloud analysers send content off-machine
Best for
Teams running an internal skills repository who want a scan gate before anything reaches developers.
Alternatives
Cisco Skill Scanner: common questions
- Is Cisco Skill Scanner worth it?
- Worth putting in front of your skills repo, as long as you believe its own numbers: it catches the obvious, not everything. We rate it 3.7 out of 5.
- How much does Cisco Skill Scanner cost?
- Free under Apache 2.0; optional LLM and cloud analysers bill through their own providers.
- What are the downsides of Cisco Skill Scanner?
- Rules alone catch under 8% of malicious skills at HIGH; lLM judge adds false positives; cloud analysers send content off-machine.
- Who is Cisco Skill Scanner best for?
- Teams running an internal skills repository who want a scan gate before anything reaches developers.
- How much does Cisco Skill Scanner cost for a team or in production?
- Free; LLM judge cost depends on the model you point it at, and a local model costs nothing per scan.
- Is Cisco Skill Scanner safe for company data?
- Pattern and dataflow engines run locally; the LLM judge, VirusTotal and Cisco cloud analysers send content to those services.
- What are the best Cisco Skill Scanner alternatives?
- The closest alternatives we have reviewed are Snyk Agent Scan.
Answers checked Oct 24, 2026.