Your AI agent's skills are code. This scanner audits them.

What it does

Skill Scanner is a Python-based security scanner aimed at AI agent “skills”—structured files that tell agents like OpenAI Codex or Cursor what they can do and how. It ingests skill definitions and runs them through multiple detection engines looking for prompt injection, data exfiltration, and malicious code patterns. The tool outputs findings in several formats including SARIF for GitHub Code Scanning and interactive HTML reports, and it can be wired into CI pipelines or pre-commit hooks. It supports standard formats like the Agent Skills specification, but can also tolerate non-standard markdown variants with --lenient.

The interesting bit

Instead of a single grep pass, it layers YARA signatures, AST dataflow analysis, and an LLM-as-a-judge, then runs a meta-analyzer to vote findings up or down. The documentation is refreshingly candid about its own limits, explicitly warning that a clean scan is not a security guarantee and that human review remains mandatory.

Key highlights

• Multi-engine stack: YARA/static rules, AST dataflow analysis, LLM semantic review, and optional cloud scanners (VirusTotal, Cisco AI Defense).
• Meta-analyzer layer that cross-checks findings to suppress false positives without discarding real threats.
• CI-native outputs including SARIF for GitHub Code Scanning, exit codes for pipeline gating, and pre-commit integration.
• Supports standard formats like OpenAI Codex and Cursor skills, plus non-standard markdown via a lenient mode.
• Plugin architecture for adding custom analyzers, rules, and threat taxonomies.

Caveats

• The project is explicitly best-effort, and the README states that a clean scan does not certify security or guarantee a skill is free of vulnerabilities.
• Coverage is inherently incomplete, especially against novel or zero-day techniques that fall outside its known patterns and heuristics.
• The LLM, Meta, VirusTotal, and Cisco AI Defense analyzers require external API keys, so full coverage is not available in fully offline or zero-cost environments.

Verdict

Worth a look if you are shipping AI agents that ingest third-party skill files and need a defense-in-depth layer in CI. Skip it if you want a security guarantee or a fully offline, zero-config solution—the best engines require API keys and the README admits it will not catch everything.