Agent Skill Security Scanner: Cisco Checks Codex Skills Before Installation

Developers adopting third-party Codex-compatible skills need an agent skill security scanner that can flag known and probable risk patterns before a folder reaches a working repository. Cisco AI Defense Skill Scanner is a fixed-version CLI option for that first inspection step; it is not a certification service or a substitute for code review.

Tool Summary

Cisco AI Defense Skill Scanner 2.0.12 is an Apache-2.0 tool for inspecting Agent Skill packages, including documented Codex and Cursor skill formats. Its documented core analyzers use static YAML/YARA patterns, Python bytecode integrity checks, and shell-pipeline taint analysis; behavioral analysis, LLM analysis, Meta filtering, Cisco AI Defense, and VirusTotal are separate choices with different requirements.

The page scope is deliberately narrow: use it to inspect one candidate skill before installation. Agent Skills Evaluation Workflow remains the page for acceptance evidence, controlled testing, and rollback; this scanner does not replace that judgment.

Best Fit Users

• Codex workspace maintainers: need a repeatable pre-install check before adding a new SKILL.md package to a repository.
• Developer enablement teams: need a fixed scanner version and a review record before distributing a skill to colleagues.
• Security-minded builders: need to separate local analysis from cloud/API options, file uploads, and report-writing choices.

Setup / Working Method

01. Keep the review environment separate

Copy or check out the candidate into a disposable review directory first. Pin the package to Cisco’s 2.0.12 release rather than installing a floating latest version, and run the scan against that isolated target.

mkdir -p /tmp/cisco-skill-review
cd /tmp/cisco-skill-review
python -m venv .scanner-venv
.scanner-venv/bin/pip install "cisco-ai-skill-scanner==2.0.12"
.scanner-venv/bin/skill-scanner scan /absolute/path/to/skill

This minimal command deliberately omits optional cloud and upload switches. It is not described as dry-run, fully offline, or zero-write: Cisco’s documentation does not make those global claims for an ordinary scan.

02. Treat findings as review evidence

Read the matched path, severity, category, and surrounding source before deciding what to do. A fixed Cisco repository fixture documents a jailbreak-override skill with an expected CRITICAL result and categories including prompt injection, policy violation, obfuscation, and skill-discovery abuse; that is Cisco project evidence, not a Big Prompt Hub reproduction or an accuracy benchmark.

Likewise, no findings only means the selected scanner configuration did not detect its known patterns. It does not establish that a skill is benign, safe to install, or appropriate for a repository with access to secrets.

03. Add optional analyzers only with their side effects understood

• LLM and Meta: require API-backed configuration; use them only when the destination and policy are acceptable for the candidate content.
• Cisco AI Defense: is an optional cloud-based text analyzer and requires its API configuration.
• VirusTotal: is optional for binary checks; --vt-upload-files can upload unknown binaries, so it belongs in an explicit data-handling decision, not the default command.
• Report files: options such as --output results.sarif write a report file. Use a named review directory when you need that artifact.

04. Pin CI to the reviewed commit

Cisco’s README shows a reusable GitHub Actions workflow using @main. Do not copy that floating reference into a gate for this review. If your team chooses the reusable workflow, pin it to the reviewed 2.0.12 commit and still require human review of findings and repository changes.

uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@605afdc5c7ea887c07e2afeb0fadc1452c07bfa7
with:
  skill_path: .agents/skills

A CI exit gate can route a finding to review; it cannot prove that the package is safe or replace a platform-specific install check.

Comparison / Limits

• What this page recommends: Cisco’s fixed-version CLI as one pre-install inspection tool for a candidate skill package.
• What it does not compare: NVIDIA SkillSpector and Snyk Agent Scan have different scope and execution boundaries; without a shared public corpus and identical configuration, this article makes no performance or accuracy ranking.
• What remains manual: permissions, dependencies, intended triggers, repository fit, controlled tests, and rollback belong in the evaluation workflow.
• Known detection limits: Cisco describes the scanner as best-effort, with possible false positives and false negatives. High-risk deployment still needs human review and threat modeling.

Use Cases

• One incoming Codex skill: inspect a candidate folder before it is copied into a project skill directory.
• Pull-request gate: pin the reviewed CI workflow commit and route high-severity findings to a maintainer instead of auto-approving the package.
• Skill-library intake: record scanner version, candidate revision, findings, and manual disposition alongside a team’s adoption notes.

Common Mistakes & Fixes

• Treating no findings as approval: retain permissions, dependency, trigger, and controlled-test review before adoption.
• Enabling optional analyzers without a data-path review: check API, upload, and report-output behavior before using those switches.
• Using a floating CI reference: pin the exact reviewed workflow commit and update it through a deliberate review.

FAQ

• Q: What does an agent skill security scanner check before installation?
  A: Cisco documents pattern-based, bytecode, and shell-pipeline checks in its core scanner, with optional behavioral, LLM, Meta, Cisco AI Defense, and VirusTotal analyzers. Review the enabled analyzers and each finding before adoption.
• Q: Does a clean Cisco scan mean I can install a Codex skill safely?
  A: No. Cisco explicitly describes best-effort detection and warns that no findings do not guarantee no risk. Continue with permissions, dependency, trigger, and controlled-test review.
• Q: Is the scanner entirely local and read-only?
  A: Do not make that assumption. API-backed analyzers, VirusTotal uploads, and report-output paths each have distinct data or file effects. Use only the options you have reviewed for the environment.
• Q: Should I use this instead of an unused-skills cleanup tool?
  A: No. This page is for a candidate before installation. Unused Agent Skills Cleanup addresses evidence-based maintenance after adoption and does not perform a security certification.

Follow @bigprompt, then explore AI Tools and Coding & Development.

Continue Your Agent Skill Review

Install Agent Skills in Codex, Claude Code, Cursor, and Gemini CLI

Agent Skills Evaluation Workflow: Evidence Before Installation

Unused Agent Skills Cleanup: Deadskills vs Skillreaper Safety Boundaries

AI Cost Control Skills: Audit Spend Before Routing Models

Littlebox Illustration Skill for Chinese Article Image Decisions

Big Prompt Hub Review

Start with Cisco Skill Scanner when the immediate decision is whether a specific Agent Skill deserves deeper review before installation. Keep the scanner version pinned, keep cloud and upload options explicit, and treat a result as one input to a human acceptance decision rather than a pass to trust the package.