# skill-scanner

A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns.

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/cisco-ai-defense-skill-scanner
- Source: https://github.com/cisco-ai-defense/skill-scanner
- Price: free and open source

## Summary
skill-scanner is a Claude Code plugin with 12 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes magic-string-trigger, multi-file-exfiltration, eval-execution. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
npx -y skills add cisco-ai-defense/skill-scanner --agent claude-code
```

## Skills
- magic-string-trigger
- multi-file-exfiltration
- eval-execution
- config-tunnel-exfil
- environment-secrets
- base64-payload
- file-reader
- jailbreak-override
- infinite-loop
- file-validator
- simple-math
- database-query

## FAQ

### What is skill-scanner?
A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns.

### How do I install skill-scanner?
Run these in Claude Code: npx -y skills add cisco-ai-defense/skill-scanner --agent claude-code. Then prompt normally.

### Does skill-scanner auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is skill-scanner free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.