Skill Scanner
Cisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Overview
Skill Scanner from Cisco AI Defense is a best-effort security scanner for AI agent skills that detects prompt injection, data exfiltration and malicious code patterns. It combines pattern-based detection (YAML and YARA-X rules), AST and dataflow analysis, an optional LLM-as-a-judge, cloud scanning, and a bounded CEL decision layer that correlates typed detector facts after deterministic detection. It supports Codex and Cursor skill formats under the Agent Skills specification, and with --lenient also Claude Code commands and flat markdown repos. Presets publish recall, false-positive rate and F1, and it outputs SARIF for GitHub Code Scanning with a reusable Actions workflow and pre-commit hook.
The Jev connection comes from the directory listing: it ships a System One analyzer as a deliberately advisory tier that cannot emit a finding or change a severity. That design keeps typed decision-model judgments as context for reviewers while deterministic detectors remain the source of findings. The README stresses that no findings does not mean no risk.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this skill content look like prompt injection or exfiltration? (advisory only)(inferred) | — |
How it works
- Run pattern, AST and dataflow detectors on a skill
- Correlate facts in the CEL decision layer
- Optionally add LLM and System One advisory analysis
- Emit findings as SARIF; advisory signals do not change findings
Strengths
- Layered, measured detection with published presets
- Advisory System One tier cannot cause false findings
- CI and pre-commit integration
Caveats
- Best-effort; no findings does not mean safe
- System One analyzer described only in the list summary
Getting started
pip install cisco-ai-skill-scanner (extras for bedrock, google, vertex, azure, all).At a glance
- Type
- Agent skill
- Status
- production
- Language
- Python
- Runtime
- CLI, GitHub Action, pre-commit hook
- Has code
- yes
- Has tests
- yes
- License
- Apache-2.0
Use cases and integrations
How curated lists describe it
Agent security: Cisco's scanner hunts prompt injection and exfiltration in agent skills, and ships a System One analyzer as a deliberately advisory tier that cannot emit a finding or change a severity.
yibie/awesome-jev
Frequently asked questions
What role does the System One model play?
Per the list summary, an advisory analyzer that cannot emit a finding or change a severity.
Does a clean scan mean a skill is safe?
No; the README says no findings does not equal no risk.
Can it run in CI?
Yes, with SARIF output, a reusable workflow and exit codes.
Related projects
Reviews agent skills, MCP configs and source with local static checks plus Jev before install, reporting evidence, risk and coverage gaps.
MCP serverbetaPythonDrop-in proxy for Playwright MCP that adds Jev page triage, prompt-injection masking, snapshot pruning and risky-action gating.
MCP serverbetaTypeScriptStarter kit that gates every MCP tool call with Kinde identity checks plus Jev risk signals, then allows, holds for approval or stops it.
MCP serverbetaTypeScriptSemantic MCP firewall that screens tool calls, results and descriptions with Jev, plus allowlists and session taint tracking.
MCP serverbetaTypeScriptLocal-first MCP server that returns only Jev-checked passages from big PDFs, Word files and spreadsheets, with exact row calculations.
MCP serverbetaTypeScriptZero-dependency HTTP traffic and bot defense gate that can escalate requests to Jev for five typed risk questions.
ProjectbetaTypeScript, Python