Skill Scanner Files

Skill Scanner 2.3.0

This release maps every finding to the Cisco AI Security and Safety Taxonomy, closes several ways to hide text from the frontmatter scan, and stops silently skipping symlinks and unloadable skills, while keeping the measured false-positive rate steady on the pull-request development corpus.

Changes

• Attach a Cisco AI taxonomy code to findings: an AITech code and, where one fits, an AISubtech code, with names and OWASP, MITRE ATLAS and NIST AML crosswalks, from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner. Every bundled rule declares its code, operational findings are not_applicable, and a code that cannot be resolved is unmapped rather than guessed. New finding metadata: aitech, aitech_name, aisubtech, aisubtech_name, aitech_mappings, aisubtech_mappings, framework_mappings, taxonomy_status and taxonomy_source, plus scan-level counts in scan_metadata.taxonomy and SARIF result properties. (#267)
• Scan every SKILL.md frontmatter value and comment except allowed-tools, as the loader parses it. Quoted and complex keys, YAML aliases and merge keys, escape sequences, !!binary values and values folded over several lines no longer hide text from the static rules. (#265, [#268])
• Detect plain-language instructions to read a local credential file and send it to a remote host in ACTIVE_SENSITIVE_EXFILTRATION. (#264)
• Report symlinks among a skill's files, which are not followed, as SYMLINK_NOT_SCANNED (HIGH when the target leaves the skill root), and skills that fail to load as SKILL_LOAD_FAILED findings in scan-all. (#265)
• Avoid quadratic regex work in two rules on long lines. (#265)

Behavior notes

Taxonomy codes follow taxonomy 2.0.0, so some change: jailbreak rules move from AITech-2.1 to AITech-1.1 / AISubtech-1.1.5, and hardcoded secrets from AISubtech-8.2.2 to AISubtech-14.1.1. The AITech-99.9 / AISubtech-99.9.9 placeholders are no longer emitted. Update any filters on 1.x codes. scan-all now reports folders with unloadable skills or symlinks as findings instead of skipping them, so SARIF, markdown output and --fail-on-severity exit codes include them.

Validation

The PR detection-impact gate compares base and head on the same labelled development records and fixed real-skill sample, enforcing a 0.5 percentage point FPR-rise limit. Across this release, benign flags stayed at 14/1,338 (1.05%) and real-skill flags at 130/2,000, while development-split recall rose from 31.43% to 31.94%. The exact-SHA release evidence and mandatory release gate passed 3,551 checks. The release holdout compares CEL-off and active modes of this revision; both flagged 23/545 benign samples (4.22%), and holdout recall (7.75%) and macro-F1 (35.41%) are unchanged from 2.2.2.