AI Defense Stack

Agent & MCP security

Cisco Skill Scanner: open-source scanner for AI agent skills

Cisco Skill Scanner is an open-source scanner for AI agent skills from Cisco. It is released under the Apache-2.0 license and is offered as: CLI, Library, API.

  • Last reviewed
Visit Cisco Skill Scanner (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

Teams that let developers install agent skills and want a free scanner in CI or a pre-commit hook to review skill folders before they reach an agent

Consider instead if

  • You also need to scan MCP servers, not only skills. See Cisco MCP Scanner.
  • You want runtime guardrails and an audit trail around coding agents as well as skill scanning. See DefenseClaw.

What Cisco Skill Scanner does

Cisco Skill Scanner is an open-source (Apache-2.0) scanner for AI agent skills, published in Cisco's AI Defense organization on GitHub. It looks for prompt injection, data exfiltration and malicious code in skill folders, including SKILL.md files and bundled scripts, before an agent loads them. Static, bytecode and pipeline analyzers need no key, while an LLM judge and the VirusTotal and Cisco AI Defense analyzers are optional and need keys. It runs as a command-line tool, a Python SDK or a REST API, and a GitHub Actions workflow and a pre-commit hook cover CI. The README calls it a detection tool that does not certify security.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cisco Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
2,620 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, Library, API Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
cisco-ai-defense.github.io Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
Documentation
cisco-ai-defense.github.io Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Reports go through GitHub private vulnerability reporting, with a Cisco open source security email as fallback Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Cisco Skill Scanner fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Cisco Skill Scanner covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L3 Supply chain Model and supply chain Also covers Scans skill folders for hidden instructions and malicious code before an agent loads them. Scans agent skills for prompt injection, data exfiltration and malicious code patterns before they run; Static analyzers (YAML and YARA patterns, bytecode, shell pipeline taint) need no key; a behavioral analyzer follows dataflow in Python files; Optional VirusTotal hash checks on binaries and Cisco AI Defense cloud analysis of text, each needing its own key

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Cisco Skill Scanner, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Looks for prompt injection in skill instructions and scripts before an agent loads the skill. Scans agent skills for prompt injection, data exfiltration and malicious code patterns before they run; Static analyzers (YAML and YARA patterns, bytecode, shell pipeline taint) need no key; a behavioral analyzer follows dataflow in Python files; An LLM analyzer reviews SKILL.md and scripts for semantic risks such as injected instructions, and needs an API key; Optional VirusTotal hash checks on binaries and Cisco AI Defense cloud analysis of text, each needing its own key
LLM02 Sensitive Information Disclosure Flags data exfiltration patterns in skill files; it is a pre-load scan, not a runtime data control. Scans agent skills for prompt injection, data exfiltration and malicious code patterns before they run; Static analyzers (YAML and YARA patterns, bytecode, shell pipeline taint) need no key; a behavioral analyzer follows dataflow in Python files; Optional VirusTotal hash checks on binaries and Cisco AI Defense cloud analysis of text, each needing its own key

Not mapped in our analysis: LLM05, LLM06, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Cisco Skill Scanner FAQ

Which skill formats does it scan?

The README says it supports OpenAI Codex Skills and Cursor Agent Skills that follow the Agent Skills specification. Claude Code command files are scanned only with the lenient option.

Does a clean scan mean a skill is safe?

No. The README says Skill Scanner is a detection tool that does not certify security, that false positives and negatives occur, and that high-risk deployments need human review.

Do I need API keys to run it?

Not for the static, bytecode and pipeline analyzers. The LLM analyzer, VirusTotal and Cisco AI Defense analyzers are optional and each needs its own API key.

Key facts you can cite

We have no commercial relationship with Cisco.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.