Cisco AI Skill Scanner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:10 AM UTC
• Version: 1.0.1

Overview

This appears to be a real skill-security scanner wrapper, but its install method and optional full-scan mode create review-worthy supply-chain and data-sharing risks.

Review before installing. Prefer installing the scanner in an isolated environment such as pipx or a virtualenv, pin the package version if possible, and avoid full LLM scans on private or proprietary skills unless you are comfortable sending the scanned content to the configured provider.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned System-Wide Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–20
Vulnerability Type: Unpinned third-party dependency installed into the system Python environment
Risk Level: Medium

Complete Code Snippet:

json

"requires": { "bins": ["skill-scanner"] },
"install":
  [
    {
      "id": "pip",
      "kind": "run",
      "label": "Install Cisco AI skill-scanner (pip)",
      "run": "pip install cisco-ai-skill-scanner --break-system-packages",
    },
  ],

Technical Analysis

The installation command retrieves cisco-ai-skill-scanner without pinning an exact reviewed version or verifying an integrity hash. Consequently, the code installed depends on whichever package release and transitive dependencies the package index resolves at installation time, rather than the artifact reviewed during this audit.

The --break-system-packages option bypasses Python's externally managed environment protection. This permits pip to modify the system Python environment, increasing the potential scope of dependency conflicts and package replacement.

There is no evidence in the reviewed project that the named package is currently malicious. The vulnerability is the unsafe, mutable supply-chain installation process.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, the distribution channel, or one of the unpinned transitive dependencies.
2. The attacker publishes a malicious or compromised release that remains compatible with the unconstrained package specification.
3. A user installs this Skill and the installation hook executes:

   bash

   pip install cisco-ai-skill-scanner --break-system-packages
   

4. Pip resolves and installs the attacker-controlled release into the system Python environment.
5. Package installation logic may execute during installation, and the resulting skill-scanner command can execute attacker-controlled code when `scripts/sc ...[truncated 857 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cisco-ai-skill-scanner to an exact, reviewed version rather than installing the latest available release:

   bash

   python -m pip install 'cisco-ai-skill-scanner==<reviewed-version>'
   

2. Use a lock file or hash-verified requirements file that pins all transitive dependencies:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Publish and verify expected package hashes through a trusted release process.
4. Install the CLI in an isolated virtual environment or through pipx, rather than modifying system Python.
5. Remove --break-system-packages.
6. Execute installation with an unprivileged account and avoid sudo or root installation.
7. Periodically review pinned versions and apply updates only after source, provenance, and integrity validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description lists activation phrases such as "check skill safety" and "security audit skill," which are generic enough to match ordinary conversational requests rather than a narrowly scoped invocation. The trigger list also lacks exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The full-scan example enables an external LLM provider using an API key, but the documentation does not clearly warn that skill contents, code, or metadata may be sent off-host for analysis. Users may unknowingly transmit sensitive or proprietary data to a third party, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.