Skill Scanner

Skill Scanner is an open-source security scanner for AI agent skills that helps developers and security teams assess whether a skill is safe to use. It detects threats such as prompt injection, data exfiltration attempts, and malicious code patterns by combining multiple analysis engines, including pattern-based detection (YAML + YARA), behavioral dataflow analysis, and LLM-assisted semantic review. It is designed for CI/CD usage and supports SARIF output for GitHub Code Scanning, enabling automated gating and actionable reports with file locations, severity, and remediation guidance. The project supports skill formats such as OpenAI Codex Skills and Cursor Agent Skills that follow the Agent Skills specification.