data-analyzer

• Multi-Engine Detection - Static analysis, behavioral dataflow, LLM semantic analysis, and cloud-based scanning
• False Positive Filtering - Meta-analyzer significantly reduces noise while preserving detection capability
• CI/CD Ready - SARIF output for GitHub Code Scanning, exit codes for build failures
• Extensible - Plugin architecture for custom analyzers

[Join the Cisco AI Discord](https://discord.com/invite/nKWtDcXxtx) to discuss, share feedback, or connect with the team.

---

| Guide | Description |

|-------|-------------|

| [Quick Start](docs/quickstart.md) | Get started in 5 minutes |

| [Architecture](docs/architecture.md) | System design and components |

| [Threat Taxonomy](docs/threat-taxonomy.md) | Complete AITech threat taxonomy with examples |

| [LLM Analyzer](docs/llm-analyzer.md) | LLM configuration and usage |

| [Meta-Analyzer](docs/meta-analyzer.md) | False positive filtering and prioritization |

| [Behavioral Analyzer](docs/behavioral-analyzer.md) | Dataflow analysis details |

| [API Reference](docs/api-server.md) | REST API documentation |

| [Development Guide](docs/developing.md) | Contributing and development setup |

---

Prerequisites: Python 3.10+ and [uv](https://docs.astral.sh/uv/) (recommended) or pip

```bash

# Using uv (recommended)

uv pip install cisco-ai-skill-scanner

# Using pip

pip install cisco-ai-skill-scanner

```

---

Environment Setup (Optional)

```bash

# For LLM analyzer and Meta-analyzer

export SKILL_SCANNER_LLM_API_KEY="your_api_key"

export SKILL_SCANNER_LLM_MODEL="claude-3-5-sonnet-20241022"

# For VirusTotal binary scanning

export VIRUSTOTAL_API_KEY="your_virustotal_api_key"

# For Cisco AI Defense

export AI_DEFENSE_API_KEY="your_aidefense_api_key"

```

CLI Usage

```bash

# Scan a single skill (static analyzer only)

skill-scanner scan /path/to/skill

# Scan with behavioral analyzer (dataflow analysis)

skill-scanner scan /path/to/skill --use-behavioral

# Scan with all engines

skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-aidefense

# Scan with meta-analyzer for false positive filtering

skill-scanner scan /path/to/skill --use-llm --enable-meta

# Scan multiple skills recursively

skill-scanner scan-all /path/to/skills --recursive --use-behavioral

# CI/CD: Fail build if threats found

skill-scanner scan-all ./skills --fail-on-findings --format sarif --output results.sarif

```

Python SDK

```python

from skill_scanner import SkillScanner

from skill_scanner.core.analyzers import StaticAnalyzer, BehavioralAnalyzer

# Create scanner with analyzers

scanner = SkillScanner(analyzers=[

StaticAnalyzer(),

BehavioralAnalyzer(use_static_analysis=True),

])

# Scan a skill

result = scanner.scan_skill("/path/to/skill")

print(f"Safe: {result.is_safe}")

print(f"Findings: {len(result.findings)}")

```

---

| Analyzer | Detection Method | Scope | Requirements |

|----------|------------------|-------|--------------|

| Static | YAML + YARA patterns | All files | None |

| Behavioral | AST dataflow analysis | Python files | None |

| LLM | Semantic analysis | SKILL.md + scripts | API key |

| Meta | False positive filtering | All findings | API key |

| VirusTotal | Hash-based malware | Binary files | API key |

| AI Defense | Cloud-based AI | Text content | API key |

---

| Option | Description |

|--------|-------------|

| --use-behavioral | Enable behavioral analyzer (dataflow analysis) |

| --use-llm | Enable LLM analyzer (requires API key) |

| --use-virustotal | Enable VirusTotal binary scanner |

| --use-aidefense | Enable Cisco AI Defense analyzer |

| --enable-meta | Enable meta-analyzer for false positive filtering |

| --format | Output: summary, json, markdown, table, sarif |

| --output PATH | Save report to file |

| --fail-on-findings | Exit with error if HIGH/CRITICAL found |

---

```

$ skill-scanner scan ./my-skill --use-behavioral

============================================================

Skill: my-skill

============================================================

Status: [OK] SAFE

Max Severity: SAFE

Total Findings: 0

Scan Duration: 0.15s

```

---

We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

Apache 2.0 - See [LICENSE](LICENSE) for details.

Copyright 2026 Cisco Systems, Inc. and its affiliates

---

GitHub •

Discord •

PyPI