Skip to content

installation-and-configuration.md

Latest commit

 

History

History
132 lines (93 loc) · 3.54 KB

installation-and-configuration.md

File metadata and controls

132 lines (93 loc) · 3.54 KB
Raw

Installation and Configuration

Tip

Minimal Setup

pip install cisco-ai-skill-scanner
skill-scanner scan ./my-skill

That's it for basic static analysis. The sections below cover optional providers, LLM keys, and advanced toggles.

Installation

PyPI (recommended)

uv pip install cisco-ai-skill-scanner
# or
pip install cisco-ai-skill-scanner

Optional provider extras

pip install cisco-ai-skill-scanner[bedrock]
pip install cisco-ai-skill-scanner[vertex]
pip install cisco-ai-skill-scanner[azure]
pip install cisco-ai-skill-scanner[all]

From source

git clone https://github.com/cisco-ai-defense/skill-scanner
cd skill-scanner
uv sync --all-extras

Configuration Priority

Runtime precedence is:

  1. CLI flags
  2. Environment variables
  3. Built-in defaults

Environment Variables

You only need to set these if you're using the corresponding features. Click a section to expand it. For the full list with examples and defaults, see Configuration Reference.

Core LLM
  • SKILL_SCANNER_LLM_API_KEY
  • SKILL_SCANNER_LLM_PROVIDER — set to openai for OpenAI-compatible custom endpoints when the model name is not enough to infer routing
  • SKILL_SCANNER_LLM_MODEL
  • SKILL_SCANNER_LLM_BASE_URL
  • SKILL_SCANNER_LLM_API_VERSION
  • SKILL_SCANNER_LLM_USER — optional raw Chat Completions user field for OpenAI-compatible routes
  • SKILL_SCANNER_LLM_FORCE_JSON_OBJECT — start in plain JSON mode for proxies that reject json_schema
Meta analyzer overrides (optional)
  • SKILL_SCANNER_META_LLM_API_KEY
  • SKILL_SCANNER_META_LLM_MODEL
  • SKILL_SCANNER_META_LLM_BASE_URL
  • SKILL_SCANNER_META_LLM_API_VERSION
External analyzers
  • VIRUSTOTAL_API_KEY
  • VIRUSTOTAL_UPLOAD_FILES — set to true to upload unknown binaries to VirusTotal
  • AI_DEFENSE_API_KEY
  • AI_DEFENSE_API_URL
Cloud provider settings
  • AWS_REGION
  • AWS_PROFILE
  • AWS_SESSION_TOKEN
  • GOOGLE_APPLICATION_CREDENTIALS
  • GEMINI_API_KEY — auto-set from SKILL_SCANNER_LLM_API_KEY when using Gemini via LiteLLM
Custom taxonomy and threat mapping
  • SKILL_SCANNER_TAXONOMY_PATH — path to a custom Cisco AI taxonomy YAML file (overridden by --taxonomy)
  • SKILL_SCANNER_THREAT_MAPPING_PATH — path to a custom threat mapping YAML file (overridden by --threat-mapping)
API server
  • SKILL_SCANNER_ALLOWED_ROOTS — colon-delimited path allowlist for server-side path access
Analyzer toggles

These environment variables override the default enabled/disabled state of analyzers when using the programmatic Config object. The CLI and API server use their own flags (--use-llm, --use-behavioral, etc.) and do not read these variables.

  • ENABLE_STATIC_ANALYZER — set to false to disable the static analyzer
  • ENABLE_LLM_ANALYZER — set to true to enable the LLM analyzer
  • ENABLE_BEHAVIORAL_ANALYZER — set to true to enable the behavioral analyzer
  • ENABLE_AIDEFENSE — set to true to enable the AI Defense analyzer

Verify Installation

skill-scanner --help
skill-scanner list-analyzers

Next Steps