Installation and Configuration

Installation and Configuration

[!TIP] Minimal Setup

pip install cisco-ai-skill-scanner
skill-scanner scan ./my-skill

That's it for basic static analysis. The sections below cover optional providers, LLM keys, and advanced toggles.

Installation

PyPI (recommended)

uv pip install cisco-ai-skill-scanner
# or
pip install cisco-ai-skill-scanner

Optional provider extras

pip install cisco-ai-skill-scanner[bedrock]
pip install cisco-ai-skill-scanner[vertex]
pip install cisco-ai-skill-scanner[azure]
pip install cisco-ai-skill-scanner[all]

From source

git clone https://github.com/cisco-ai-defense/skill-scanner
cd skill-scanner
uv sync --all-extras

Configuration Priority

Runtime precedence is:

1. CLI flags
2. Environment variables
3. Built-in defaults

Environment Variables

You only need to set these if you're using the corresponding features. Click a section to expand it. For the full list with examples and defaults, see Configuration Reference.

• SKILL_SCANNER_LLM_API_KEY
• SKILL_SCANNER_LLM_MODEL
• SKILL_SCANNER_LLM_BASE_URL
• SKILL_SCANNER_LLM_API_VERSION

• SKILL_SCANNER_META_LLM_API_KEY
• SKILL_SCANNER_META_LLM_MODEL
• SKILL_SCANNER_META_LLM_BASE_URL
• SKILL_SCANNER_META_LLM_API_VERSION

• VIRUSTOTAL_API_KEY
• VIRUSTOTAL_UPLOAD_FILES — set to true to upload unknown binaries to VirusTotal
• AI_DEFENSE_API_KEY
• AI_DEFENSE_API_URL

• AWS_REGION
• AWS_PROFILE
• AWS_SESSION_TOKEN
• GOOGLE_APPLICATION_CREDENTIALS
• GEMINI_API_KEY — auto-set from SKILL_SCANNER_LLM_API_KEY when using Gemini via LiteLLM

• SKILL_SCANNER_TAXONOMY_PATH — path to a custom Cisco AI taxonomy YAML file (overridden by --taxonomy)
• SKILL_SCANNER_THREAT_MAPPING_PATH — path to a custom threat mapping YAML file (overridden by --threat-mapping)

• SKILL_SCANNER_ALLOWED_ROOTS — colon-delimited path allowlist for server-side path access

These environment variables override the default enabled/disabled state of analyzers when using the programmatic Config object. The CLI and API server use their own flags (--use-llm, --use-behavioral, etc.) and do not read these variables.

• ENABLE_STATIC_ANALYZER — set to false to disable the static analyzer
• ENABLE_LLM_ANALYZER — set to true to enable the LLM analyzer
• ENABLE_BEHAVIORAL_ANALYZER — set to true to enable the behavioral analyzer
• ENABLE_AIDEFENSE — set to true to enable the AI Defense analyzer

Verify Installation

skill-scanner --help
skill-scanner list-analyzers

Next Steps

• Quick Start
• CLI Usage
• Configuration Reference