{
  "id": "page:docs-reference-repos-cisco-ai-defense-skill-scanner-research",
  "_kind": "Page",
  "_file": "wiki/docs/reference-repos/cisco-ai-defense/skill-scanner/research.md",
  "_cluster": "wiki",
  "attributes": {
    "nodeKind": "Page",
    "sourcePath": "docs/reference-repos/cisco-ai-defense/skill-scanner/research.md",
    "sourceKind": "repo-docs",
    "title": "cisco-ai-defense/skill-scanner",
    "displayName": "cisco-ai-defense/skill-scanner",
    "slug": "docs/reference-repos/cisco-ai-defense/skill-scanner/research",
    "articlePath": "wiki/docs/reference-repos/cisco-ai-defense/skill-scanner/research.md",
    "article": "\n# cisco-ai-defense/skill-scanner\n\n- **GitHub**: https://github.com/cisco-ai-defense/skill-scanner\n- **Stars**: 1,731\n- **License**: Apache-2.0 (NOASSERTION in API, but Apache-2.0 per LICENSE file)\n- **Last pushed**: 2026-04-10\n- **Topics**: agent, agent-skills, security\n- **Source**: gh-search\n\n## Description\n\nSecurity scanner for AI agent skills from Cisco AI Defense. Python CLI tool (`cisco-ai-skill-scanner`) with multi-engine detection: static pattern analysis (YAML + YARA rules), LLM-as-a-judge semantic analysis, behavioral dataflow analysis, and optional cloud-based scanning. Supports OpenAI Codex Skills and Cursor Agent Skills formats (Agent Skills spec), plus lenient mode for Claude Code `.claude/commands/*.md` and flat markdown repos.\n\n## Archetype\n\n**utility-with-skill** -- Standalone security scanning tool with pre-commit hook integration. Not a skill pack itself, but deeply understands and analyzes the skill format.\n\n## Structure\n\n- `skill_scanner/core/` -- Scanner engine, analyzers (static, LLM, behavioral, meta), rule registry, scan policy, extractors\n- `skill_scanner/threats/` -- Cisco AI Security Framework taxonomy (AITech codes), threat definitions\n- `skill_scanner/hooks/` -- pre-commit hook integration\n- `skill_scanner/api/` -- REST API server mode\n- `skill_scanner/cli/` -- CLI interface\n- `evals/` -- 15 evaluation SKILL.md files (safe and malicious) for scanner testing\n- `docs/` -- Comprehensive docs: architecture, threat taxonomy, custom rules, GitHub Actions, scan policy configuration\n\n## Key Capabilities\n\n- Multi-engine detection: pattern-based (YAML+YARA), LLM semantic, behavioral dataflow, cloud scanning\n- Cisco AI Security Framework taxonomy mapping (AITech-1.1 through AITech-12.1+)\n- Meta-analyzer for false positive reduction\n- Pre-commit hook via standard pre-commit framework\n- SARIF output for GitHub Code Scanning\n- Configurable scan policies with presets\n- Plugin architecture for custom analyzers\n- REST API server mode\n- Supports `--lenient` for non-standard formats (Claude Code commands, etc.)\n\n---\n\n## Processes\n\nNone directly extractable. The scanning is a standalone CLI tool, not a multi-step orchestration pattern.\n\n## Plugin Ideas\n\n### 1. Skill Scanning Integration Plugin\n\n- **Category**: Security & Sandboxing\n- **Plugin name**: `skill-scanner` (or combine with snyk/agent-scan into a unified `skill-security` plugin)\n- **Description**: Integrates Cisco skill-scanner into the babysitter plugin lifecycle for pre-install and CI/CD skill vetting.\n- **install.md approach**: Check for `uv`/`cisco-ai-skill-scanner` availability, configure scan policy, add hooks\n- **Key features**:\n  - Pre-install scanning with configurable scan policy (strict/balanced/permissive presets)\n  - Pre-commit hook integration via babysitter's hook system (maps to `pre-commit` hook type)\n  - Cisco AI threat taxonomy (AITech codes) mapped to babysitter breakpoint severity levels\n  - LLM-as-a-judge mode for semantic analysis of suspicious skill content\n  - SARIF report generation for CI/CD pipelines\n  - REST API mode for integration with babysitter's MCP server\n- **Integration surface**: hooks (`pre-plugin-install`, `pre-commit`), commands (`plugin:scan`), breakpoint rules\n\n### 2. Threat Taxonomy as Breakpoint Rules\n\n- **Category**: Security & Sandboxing\n- **Description**: The Cisco AI Security Framework taxonomy (AITech-1.x through AITech-12.x) provides a structured threat classification that could inform babysitter's breakpoint auto-approval rules. Map threat categories to breakpoint tags for automatic rejection of skills with critical findings.\n- **Mapping example**:\n  - AITech-1.x (Prompt Injection) -> `never-auto-approve` breakpoint rule\n  - AITech-8.x (Data Privacy) -> `never-auto-approve` breakpoint rule\n  - AITech-9.x (Supply Chain) -> `never-auto-approve` breakpoint rule\n  - Lower severity -> standard breakpoint prompt\n\n## Comparison with snyk/agent-scan\n\nBoth tools serve similar purposes. Key differences:\n- Cisco: multi-engine (static + LLM + behavioral + cloud), configurable scan policies, plugin architecture for custom analyzers, REST API mode\n- Snyk: simpler single-engine approach, requires Snyk API token, broader agent discovery (more harness support), toxic flow analysis\n- **Recommendation**: A unified `skill-security` babysitter plugin could wrap either/both, with a configurable backend. The threat taxonomies from both are complementary.\n\n## Library Mapping\n\n| Extractable Process | Library Status | Action | Existing Path | Target Placement |\n|-------------------|----------------|--------|---------------|------------------|\n| N/A | N/A | No extractable processes - scanning is a standalone CLI tool, not multi-step orchestration | - | N/A |\n\n## Plugin Marketplace Mapping\n\n| Plugin Idea | Marketplace Status | Action | Existing Plugin | Target Placement |\n|-------------|-------------------|--------|-----------------|------------------|\n| Skill Security Scanner | UPGRADE | Enhanced security scanning with multi-engine detection and threat taxonomy | basic-security | plugins/a5c/marketplace/blueprints/skill-security-scanner/ |\n| AI Threat Taxonomy Integration | NEW | Cisco AI Security Framework taxonomy for breakpoint auto-approval rules | - | plugins/a5c/marketplace/blueprints/ai-threat-taxonomy/ |\n\n## Skipped\n\n- The eval SKILL.md files are scanner test fixtures, not real skills\n- The pre-commit hook is Python-specific; babysitter hooks are JS-based\n",
    "documents": []
  },
  "outgoingEdges": [],
  "incomingEdges": [
    {
      "from": "page:docs-reference-repos",
      "to": "page:docs-reference-repos-cisco-ai-defense-skill-scanner-research",
      "kind": "contains_page"
    }
  ]
}