cisco-skill-scanner

Off-the-shelf

SKILL.md and skill-config risk analysis, multi-engine and static.

What it scans

SKILL.md files and skill configuration, using a multi-engine static suite: static YARA, bytecode analysis, pipeline taint tracking, and behavioral dataflow — all run offline.

What it catches

SKILL.md and skill-config risks surfaced by its static rule engines.
Risky patterns caught by taint tracking and behavioral dataflow over skill definitions.

Source and provenance

Nerlo pins and publishes each scanner's provenance so you can verify it yourself. Every scan surfaces the source, version, and install command in its report.

Kind: Off-the-shelf
Source channel: pypi (hash-pinned requirements)
Pinned version: 2.0.11
License: Apache-2.0
Source URL: https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/