cisco-ai-skill-scanner 1.0.0__tar.gz → 1.0.1__tar.gz

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/.github/ISSUE_TEMPLATE/bug_report.md

@@ -13,7 +13,7 @@ A clear and concise description of the bug.
 ## Steps to Reproduce
 
 1. Install version: [e.g., 0.2.0]
-2. Run command: `skill-analyzer scan ...`
+2. Run command: `skill-scanner scan ...`
 3. Observe error: [describe what happened]
 
 ## Expected Behavior

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/.github/ISSUE_TEMPLATE/feature_request.md

@@ -29,7 +29,7 @@ Describe a specific scenario where this feature would be useful.
 **Example:**
 ```bash
 # How the feature would be used
-skill-analyzer scan /path/to/skill --your-new-feature
+skill-scanner scan /path/to/skill --your-new-feature
 ```
 
 ## Benefits
@@ -53,4 +53,4 @@ Screenshots, mockups, links to similar features in other tools, etc.
 - [ ] I have searched existing issues/PRs for similar requests
 - [ ] I have described a clear use case
 - [ ] I have considered implementation complexity
-- [ ] This aligns with the project's goals (security scanning for Claude Skills)
+- [ ] This aligns with the project's goals (security scanning for Agent Skills)

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/.github/PULL_REQUEST_TEMPLATE.md

@@ -41,7 +41,7 @@ Describe manual testing performed:
 
 ```bash
 # Commands run for testing
-skill-analyzer scan examples/test-skill
+skill-scanner scan examples/test-skill
 ```
 
 **Results:**

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/.github/workflows/python-tests.yml

@@ -79,7 +79,7 @@ jobs:
         run: |
           uv run pytest tests/ \
             --ignore=tests/test_llm_analyzer.py \
-            -v --tb=short --cov=skillanalyzer --cov-report=xml
+            -v --tb=short --cov=skill_scanner --cov-report=xml
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/.gitignore

@@ -5,6 +5,8 @@ __pycache__/
 *.so
 .Python
 build/
+# Auto-generated version file (hatch-vcs)
+skill_scanner/_version.py
 develop-eggs/
 dist/
 downloads/

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/CODEOWNERS

@@ -1,3 +1,3 @@
 # CODEOWNERS
 # The first matching pattern takes precedence.
-* @cisco-ai-defense/skill-analyzer-reviewers
+* @cisco-ai-defense/skill-scanner-reviewers

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: cisco-ai-skill-scanner
-Version: 1.0.0
-Summary: Security scanner for Claude Skills and Codex Skills packages - Detects prompt injection, data exfiltration, and malicious code
+Version: 1.0.1
+Summary: Security scanner for Agent Skills packages - Detects prompt injection, data exfiltration, and malicious code
 Project-URL: Homepage, https://github.com/cisco-ai-defense/skill-scanner
 Project-URL: Documentation, https://github.com/cisco-ai-defense/skill-scanner#readme
 Project-URL: Repository, https://github.com/cisco-ai-defense/skill-scanner
@@ -68,14 +68,14 @@ Description-Content-Type: text/markdown
 
 A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines **pattern-based detection** (YAML + YARA), **LLM-as-a-judge**, and **behavioral dataflow analysis** for comprehensive threat detection.
 
-Supports [Anthropic Claude Skills](https://docs.anthropic.com/en/docs/agents-and-tools/claude-skills), [OpenAI Codex Skills](https://openai.github.io/codex/), and [Cursor Agent Skills](https://docs.cursor.com/context/rules) formats following the [Agent Skills specification](https://agentskills.io).
+Supports [OpenAI Codex Skills](https://openai.github.io/codex/) and [Cursor Agent Skills](https://docs.cursor.com/context/rules) formats following the [Agent Skills specification](https://agentskills.io).
 
 ---
 
 ## Highlights
 
 - **Multi-Engine Detection** - Static analysis, behavioral dataflow, LLM semantic analysis, and cloud-based scanning
-- **False Positive Filtering** - Meta-analyzer achieves ~65% noise reduction while maintaining 100% threat detection
+- **False Positive Filtering** - Meta-analyzer significantly reduces noise while preserving detection capability
 - **CI/CD Ready** - SARIF output for GitHub Code Scanning, exit codes for build failures
 - **Extensible** - Plugin architecture for custom analyzers
 
@@ -151,29 +151,29 @@ export AI_DEFENSE_API_KEY="your_aidefense_api_key"
 
 ```bash
 # Scan a single skill (static analyzer only)
-skill-analyzer scan /path/to/skill
+skill-scanner scan /path/to/skill
 
 # Scan with behavioral analyzer (dataflow analysis)
-skill-analyzer scan /path/to/skill --use-behavioral
+skill-scanner scan /path/to/skill --use-behavioral
 
 # Scan with all engines
-skill-analyzer scan /path/to/skill --use-behavioral --use-llm --use-aidefense
+skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-aidefense
 
 # Scan with meta-analyzer for false positive filtering
-skill-analyzer scan /path/to/skill --use-llm --enable-meta
+skill-scanner scan /path/to/skill --use-llm --enable-meta
 
 # Scan multiple skills recursively
-skill-analyzer scan-all /path/to/skills --recursive --use-behavioral
+skill-scanner scan-all /path/to/skills --recursive --use-behavioral
 
 # CI/CD: Fail build if threats found
-skill-analyzer scan-all ./skills --fail-on-findings --format sarif --output results.sarif
+skill-scanner scan-all ./skills --fail-on-findings --format sarif --output results.sarif
 ```
 
 ### Python SDK
 
 ```python
-from skillanalyzer import SkillScanner
-from skillanalyzer.core.analyzers import StaticAnalyzer, BehavioralAnalyzer
+from skill_scanner import SkillScanner
+from skill_scanner.core.analyzers import StaticAnalyzer, BehavioralAnalyzer
 
 # Create scanner with analyzers
 scanner = SkillScanner(analyzers=[
@@ -221,7 +221,7 @@ print(f"Findings: {len(result.findings)}")
 ## Example Output
 
 ```
-$ skill-analyzer scan ./my-skill --use-behavioral
+$ skill-scanner scan ./my-skill --use-behavioral
 
 ============================================================
 Skill: my-skill

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/README.md

@@ -10,14 +10,14 @@
 
 A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines **pattern-based detection** (YAML + YARA), **LLM-as-a-judge**, and **behavioral dataflow analysis** for comprehensive threat detection.
 
-Supports [Anthropic Claude Skills](https://docs.anthropic.com/en/docs/agents-and-tools/claude-skills), [OpenAI Codex Skills](https://openai.github.io/codex/), and [Cursor Agent Skills](https://docs.cursor.com/context/rules) formats following the [Agent Skills specification](https://agentskills.io).
+Supports [OpenAI Codex Skills](https://openai.github.io/codex/) and [Cursor Agent Skills](https://docs.cursor.com/context/rules) formats following the [Agent Skills specification](https://agentskills.io).
 
 ---
 
 ## Highlights
 
 - **Multi-Engine Detection** - Static analysis, behavioral dataflow, LLM semantic analysis, and cloud-based scanning
-- **False Positive Filtering** - Meta-analyzer achieves ~65% noise reduction while maintaining 100% threat detection
+- **False Positive Filtering** - Meta-analyzer significantly reduces noise while preserving detection capability
 - **CI/CD Ready** - SARIF output for GitHub Code Scanning, exit codes for build failures
 - **Extensible** - Plugin architecture for custom analyzers
 
@@ -93,29 +93,29 @@ export AI_DEFENSE_API_KEY="your_aidefense_api_key"
 
 ```bash
 # Scan a single skill (static analyzer only)
-skill-analyzer scan /path/to/skill
+skill-scanner scan /path/to/skill
 
 # Scan with behavioral analyzer (dataflow analysis)
-skill-analyzer scan /path/to/skill --use-behavioral
+skill-scanner scan /path/to/skill --use-behavioral
 
 # Scan with all engines
-skill-analyzer scan /path/to/skill --use-behavioral --use-llm --use-aidefense
+skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-aidefense
 
 # Scan with meta-analyzer for false positive filtering
-skill-analyzer scan /path/to/skill --use-llm --enable-meta
+skill-scanner scan /path/to/skill --use-llm --enable-meta
 
 # Scan multiple skills recursively
-skill-analyzer scan-all /path/to/skills --recursive --use-behavioral
+skill-scanner scan-all /path/to/skills --recursive --use-behavioral
 
 # CI/CD: Fail build if threats found
-skill-analyzer scan-all ./skills --fail-on-findings --format sarif --output results.sarif
+skill-scanner scan-all ./skills --fail-on-findings --format sarif --output results.sarif
 ```
 
 ### Python SDK
 
 ```python
-from skillanalyzer import SkillScanner
-from skillanalyzer.core.analyzers import StaticAnalyzer, BehavioralAnalyzer
+from skill_scanner import SkillScanner
+from skill_scanner.core.analyzers import StaticAnalyzer, BehavioralAnalyzer
 
 # Create scanner with analyzers
 scanner = SkillScanner(analyzers=[
@@ -163,7 +163,7 @@ print(f"Findings: {len(result.findings)}")
 ## Example Output
 
 ```
-$ skill-analyzer scan ./my-skill --use-behavioral
+$ skill-scanner scan ./my-skill --use-behavioral
 
 ============================================================
 Skill: my-skill

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/SECURITY.md

@@ -9,7 +9,7 @@
 
 ## Reporting a Vulnerability
 
-We take security seriously. If you discover a security vulnerability in the Skill Analyzer, please report it responsibly.
+We take security seriously. If you discover a security vulnerability in the Skill Scanner, please report it responsibly.
 
 ### How to Report
 
@@ -81,7 +81,7 @@ When using the analyzer:
 
 ## Security Scanning
 
-This tool scans Claude Skills for security threats. It is not a substitute for:
+This tool scans agent skills for security threats. It is not a substitute for:
 - Manual security review
 - Penetration testing
 - Compliance audits

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/TESTING.md

@@ -1,6 +1,6 @@
 # Testing Guide
 
-This document covers testing requirements and procedures for contributing to the Skill Analyzer.
+This document covers testing requirements and procedures for contributing to the Skill Scanner.
 
 ## Quick Reference
 
@@ -9,7 +9,7 @@ This document covers testing requirements and procedures for contributing to the
 uv run pytest tests/ -v
 
 # Run tests with coverage
-uv run pytest tests/ --cov=skillanalyzer --cov-report=html
+uv run pytest tests/ --cov=skill_scanner --cov-report=html
 
 # Run evaluation benchmark
 uv run python evals/benchmark_runner.py
@@ -103,7 +103,7 @@ For detailed evaluation documentation, see [evals/README.md](/evals/README.md).
 
 ```bash
 # Generate HTML coverage report
-uv run pytest tests/ --cov=skillanalyzer --cov-report=html
+uv run pytest tests/ --cov=skill_scanner --cov-report=html
 
 # View report (opens in browser)
 open htmlcov/index.html  # macOS
@@ -123,7 +123,7 @@ xdg-open htmlcov/index.html  # Linux
 ```python
 # tests/test_example.py
 import pytest
-from skillanalyzer.core.scanner import SkillScanner
+from skill_scanner.core.scanner import SkillScanner
 
 class TestExampleFeature:
     """Tests for example feature."""

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/aidefense-analyzer.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-The AI Defense Analyzer integrates with Cisco AI Defense API to provide enterprise-grade security scanning for Claude Skills. It analyzes prompts, instructions, markdown content, and code files for threats including prompt injection, data exfiltration, and malicious patterns.
+The AI Defense Analyzer integrates with Cisco AI Defense API to provide enterprise-grade security scanning for Agent Skills. It analyzes prompts, instructions, markdown content, and code files for threats including prompt injection, data exfiltration, and malicious patterns.
 
 ## Features
 
@@ -56,23 +56,23 @@ echo "AI_DEFENSE_API_KEY=your_key" >> .env
 
 ```bash
 # Enable AI Defense analyzer
-skill-analyzer scan /path/to/skill --use-aidefense
+skill-scanner scan /path/to/skill --use-aidefense
 
 # Provide API key directly
-skill-analyzer scan /path/to/skill --use-aidefense --aidefense-api-key your_key
+skill-scanner scan /path/to/skill --use-aidefense --aidefense-api-key your_key
 
 # Combine with other analyzers
-skill-analyzer scan /path/to/skill --use-behavioral --use-llm --use-aidefense
+skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-aidefense
 
 # Scan multiple skills
-skill-analyzer scan-all /path/to/skills --recursive --use-aidefense
+skill-scanner scan-all /path/to/skills --recursive --use-aidefense
 ```
 
 ### Python API
 
 ```python
-from skillanalyzer.core.analyzers import AIDefenseAnalyzer
-from skillanalyzer.core.loader import load_skill
+from skill_scanner.core.analyzers import AIDefenseAnalyzer
+from skill_scanner.core.loader import load_skill
 
 # Initialize analyzer with default rules
 analyzer = AIDefenseAnalyzer(
@@ -82,7 +82,7 @@ analyzer = AIDefenseAnalyzer(
 )
 
 # Initialize with custom rules
-from skillanalyzer.core.analyzers.aidefense_analyzer import DEFAULT_ENABLED_RULES
+from skill_scanner.core.analyzers.aidefense_analyzer import DEFAULT_ENABLED_RULES
 
 custom_rules = [
     {"rule_name": "Prompt Injection"},
@@ -112,8 +112,8 @@ findings = asyncio.run(scan_skill())
 ### Integration with Scanner
 
 ```python
-from skillanalyzer import SkillScanner
-from skillanalyzer.core.analyzers import StaticAnalyzer, AIDefenseAnalyzer
+from skill_scanner import SkillScanner
+from skill_scanner.core.analyzers import StaticAnalyzer, AIDefenseAnalyzer
 
 # Combine analyzers
 analyzers = [
@@ -169,7 +169,7 @@ For comprehensive coverage, combine AI Defense with other analyzers:
 
 ```bash
 # Maximum coverage
-skill-analyzer scan /path/to/skill \
+skill-scanner scan /path/to/skill \
     --use-behavioral \
     --use-llm \
     --use-aidefense \

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/api-rationale.md

@@ -1,8 +1,8 @@
 # API Server Rationale
 
-## Question: Is an API Server Necessary for Skill Analyzer?
+## Question: Is an API Server Necessary for Skill Scanner?
 
-Unlike MCP Scanner, which scans **remote MCP servers** (HTTP/SSE/stdio connections), Skill Analyzer scans **local skill packages** (files/directories). This raises the question: is an API server necessary?
+Unlike MCP Scanner, which scans **remote MCP servers** (HTTP/SSE/stdio connections), Skill Scanner scans **local skill packages** (files/directories). While an API server is less critical for Skill Scanner, it can provide additional support for CI/CD integration, web interfaces, service integrations, and batch processing. Read below for more details.
 
 ## Analysis
 
@@ -13,12 +13,12 @@ Unlike MCP Scanner, which scans **remote MCP servers** (HTTP/SSE/stdio connectio
 - API server enables scanning servers you don't control
 - Essential for the use case (scanning external services)
 
-**Skill Analyzer:**
+**Skill Scanner:**
 - Scans **local** skill packages (files/directories)
 - Skills are **always local** - there are no remote skills (unlike MCP servers)
 - Skills are distributed as ZIP files or directories that users install locally
 - Can be scanned directly via CLI or Python SDK
-- **Key Point**: Remote Claude Skills do not exist - skills are local file packages
+- **Key Point**: Remote skills do not exist - skills are local file packages
 
 ### Use Cases Where API is Valuable
 
@@ -95,9 +95,9 @@ Despite skills being local files, an API server provides value for:
 
 ## Conclusion
 
-**Critical Finding**: Remote Claude Skills **do not exist**. Skills are local file packages that users install on their machines, not remote services like MCP servers.
+**Critical Finding**: Remote skills **do not exist**. Skills are local file packages that users install on their machines, not remote services like MCP servers.
 
-While the API server is **less critical** for Skill Analyzer than for MCP Scanner (since there are no remote skills to scan), it still provides value for:
+While the API server is **less critical** for Skill Scanner than for MCP Scanner (since there are no remote skills to scan), it still provides value for:
 - CI/CD integration (uploading skill ZIP files)
 - Web interfaces (uploading skill packages)
 - Service integrations (HTTP-based workflows)

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/api-server.md

@@ -2,10 +2,10 @@
 
 ## Overview
 
-The Skill Analyzer API Server provides a REST interface for uploading and scanning Claude Skills and Codex Skills packages, enabling integration with web applications, CI/CD pipelines, and other services.
+The Skill Scanner API Server provides a REST interface for uploading and scanning Agent Skills packages, enabling integration with web applications, CI/CD pipelines, and other services.
 
 **Key Points**:
-- **Skills are local packages**: Claude Skills are local file packages that users install on their machines, not remote services
+- **Skills are local packages**: Skills are local file packages that users install on their machines, not remote services
 - **API enables uploads**: The API allows uploading skill ZIP files for scanning via HTTP
 - **For integration workflows**: Useful for CI/CD, web interfaces, and service integrations
 - **CLI is primary**: For most use cases, the CLI is the recommended interface
@@ -21,22 +21,22 @@ The Skill Analyzer API Server provides a REST interface for uploading and scanni
 
 ```bash
 # Start server (default: 0.0.0.0:8000)
-skill-analyzer-api
+skill-scanner-api
 
 # Custom port
-skill-analyzer-api --port 8080
+skill-scanner-api --port 8080
 
 # Development mode with auto-reload
-skill-analyzer-api --reload
+skill-scanner-api --reload
 
 # Custom host and port
-skill-analyzer-api --host 127.0.0.1 --port 9000
+skill-scanner-api --host 127.0.0.1 --port 9000
 ```
 
 ### Programmatic
 
 ```python
-from skillanalyzer.api_server import run_server
+from skill_scanner.api_server import run_server
 
 run_server(host="0.0.0.0", port=8000, reload=False)
 ```
@@ -410,7 +410,7 @@ jobs:
       - name: Start API Server
         run: |
           pip install -r requirements.txt
-          skill-analyzer-api &
+          skill-scanner-api &
           sleep 5
 
       - name: Scan Skills
@@ -452,20 +452,20 @@ WORKDIR /app
 COPY requirements.txt .
 RUN pip install -r requirements.txt
 
-COPY skillanalyzer/ ./skillanalyzer/
+COPY skill_scanner/ ./skill_scanner/
 
 EXPOSE 8000
 
-CMD ["python", "-m", "skillanalyzer.api_cli", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["python", "-m", "skill_scanner.api_cli", "--host", "0.0.0.0", "--port", "8000"]
 ```
 
 ```bash
 # Build and run
-docker build -t skill-analyzer-api .
+docker build -t skill-scanner-api .
 docker run -p 8000:8000 \
   -e SKILL_SCANNER_LLM_API_KEY=your_key \
   -e SKILL_SCANNER_LLM_MODEL=claude-3-5-sonnet-20241022 \
-  skill-analyzer-api
+  skill-scanner-api
 ```
 
 ## Error Handling
@@ -547,7 +547,7 @@ Run behind reverse proxy (nginx, Caddy) with TLS:
 ```nginx
 server {
     listen 443 ssl;
-    server_name api.skillanalyzer.com;
+    server_name api.skill_scanner.com;
 
     ssl_certificate /path/to/cert.pem;
     ssl_certificate_key /path/to/key.pem;
@@ -604,7 +604,7 @@ Instrumentator().instrument(app).expose(app)
 lsof -i :8000
 
 # Try different port
-skill-analyzer-api --port 8080
+skill-scanner-api --port 8080
 ```
 
 ### LLM analyzer not available
@@ -626,4 +626,4 @@ export SKILL_SCANNER_LLM_MODEL=claude-3-5-sonnet-20241022
 
 ## Conclusion
 
-The API server makes the Skill Analyzer accessible to any application or service, enabling automated security scanning at scale. Combined with the LLM analyzer, it provides powerful threat detection capabilities through a simple REST interface. Supports both Claude Skills and Codex Skills formats.
+The API server makes the Skill Scanner accessible to any application or service, enabling automated security scanning at scale. Combined with the LLM analyzer, it provides powerful threat detection capabilities through a simple REST interface. Supports Codex Skills and Cursor Agent Skills formats.

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/architecture.md

@@ -1,8 +1,8 @@
-# Skill Analyzer Architecture
+# Skill Scanner Architecture
 
 ## Overview
 
-The Skill Analyzer is built with a modular, extensible architecture for Agent Skills security analysis. It supports the Agent Skills specification format used by Anthropic Claude Skills, OpenAI Codex Skills, and Cursor Agent Skills. This document describes the system design, data flow, and key components.
+The Skill Scanner is built with a modular, extensible architecture for Agent Skills security analysis. It supports the Agent Skills specification format used by OpenAI Codex Skills and Cursor Agent Skills. This document describes the system design, data flow, and key components.
 
 **Structure**: Organized by component (core/, config/, data/, threats/, cli/, api/)
 **Coverage**: Static analysis (YAML + YARA), LLM analysis, Behavioral dataflow analysis
@@ -64,7 +64,7 @@ graph TB
 
 Defines the core data structures:
 
-- **`Skill`**: Represents a complete Claude Skill, Codex Skill, or Cursor Agent Skill package
+- **`Skill`**: Represents a complete Agent Skill package
   - `directory`: Path to skill package
   - `manifest`: Parsed YAML frontmatter
   - `instruction_body`: Markdown instructions
@@ -256,7 +256,7 @@ Command-line interface built with `argparse`.
 ### Single Skill Scan Flow
 
 ```
-1. User runs: skill-analyzer scan /path/to/skill
+1. User runs: skill-scanner scan /path/to/skill
 
 2. CLI parses arguments → calls scan_command()
 
@@ -287,7 +287,7 @@ Command-line interface built with `argparse`.
 ### Multi-Skill Scan Flow
 
 ```
-1. User runs: skill-analyzer scan-all /path/to/skills
+1. User runs: skill-scanner scan-all /path/to/skills
 
 2. Scanner.scan_directory()
    ├─→ Find all skill packages (SKILL.md files)
@@ -316,7 +316,7 @@ Command-line interface built with `argparse`.
 Example:
 
 ```python
-from skillanalyzer.analyzers.base import BaseAnalyzer
+from skill_scanner.analyzers.base import BaseAnalyzer
 
 class LLMAnalyzer(BaseAnalyzer):
     def __init__(self):
@@ -331,7 +331,7 @@ class LLMAnalyzer(BaseAnalyzer):
 
 ### Adding New Rules
 
-Edit `skillanalyzer/data/rules/signatures.yaml`:
+Edit `skill_scanner/data/rules/signatures.yaml`:
 
 ```yaml
 - id: MY_CUSTOM_RULE
@@ -477,4 +477,4 @@ FastAPI Server
 
 ## Conclusion
 
-The Skill Analyzer is designed with modularity, extensibility, and security in mind. The current static analysis foundation provides a solid base for future enhancements including semantic analysis, behavioral monitoring, and enterprise features. It supports Claude Skills, Codex Skills, and Cursor Agent Skills formats, which follow the Agent Skills specification.
+The Skill Scanner is designed with modularity, extensibility, and security in mind. The current static analysis foundation provides a solid base for future enhancements including semantic analysis, behavioral monitoring, and enterprise features. It supports Codex Skills and Cursor Agent Skills formats, which follow the Agent Skills specification.

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/behavioral-analyzer.md

@@ -36,7 +36,7 @@ Finding Generation
 
 ### 1. AST Parser
 
-**Module**: `skillanalyzer/core/static_analysis/parser/python_parser.py`
+**Module**: `skill_scanner/core/static_analysis/parser/python_parser.py`
 
 **Functionality**:
 - Parses Python source into Abstract Syntax Tree
@@ -51,7 +51,7 @@ Finding Generation
 
 **Example**:
 ```python
-from skillanalyzer.core.static_analysis.parser import PythonParser
+from skill_scanner.core.static_analysis.parser import PythonParser
 
 parser = PythonParser(source_code)
 if parser.parse():
@@ -63,7 +63,7 @@ if parser.parse():
 
 ### 2. Forward Dataflow Analysis (CFG-Based)
 
-**Module**: `skillanalyzer/core/static_analysis/dataflow/forward_analysis.py`
+**Module**: `skill_scanner/core/static_analysis/dataflow/forward_analysis.py`
 
 **Functionality**:
 - **CFG-based dataflow analysis** using Control Flow Graph and fixpoint algorithm
@@ -83,8 +83,8 @@ if parser.parse():
 
 **Example**:
 ```python
-from skillanalyzer.core.static_analysis.dataflow import ForwardDataflowAnalysis
-from skillanalyzer.core.static_analysis.parser.python_parser import PythonParser
+from skill_scanner.core.static_analysis.dataflow import ForwardDataflowAnalysis
+from skill_scanner.core.static_analysis.parser.python_parser import PythonParser
 
 parser = PythonParser(source_code)
 parser.parse()
@@ -102,7 +102,7 @@ for flow in flows:
 
 ### 3. Context Extractor
 
-**Module**: `skillanalyzer/core/static_analysis/context_extractor.py`
+**Module**: `skill_scanner/core/static_analysis/context_extractor.py`
 
 **Functionality**:
 - Combines AST parser + dataflow tracker
@@ -154,8 +154,8 @@ reporter.py: Sends to attacker.com
 ### Python API
 
 ```python
-from skillanalyzer.core.analyzers import BehavioralAnalyzer
-from skillanalyzer.core.scanner import SkillScanner
+from skill_scanner.core.analyzers import BehavioralAnalyzer
+from skill_scanner.core.scanner import SkillScanner
 
 # Create analyzer (static analysis mode by default)
 behavioral = BehavioralAnalyzer(use_static_analysis=True)
@@ -169,7 +169,7 @@ result = scanner.scan_skill("/path/to/skill")
 
 ```bash
 # Behavioral analyzer is included by default in static analyzer
-skill-analyzer scan /path/to/skill
+skill-scanner scan /path/to/skill
 
 # Results include behavioral findings (BEHAVIOR_* rule IDs)
 ```
@@ -303,8 +303,8 @@ def process(user_input):
 
 ## Technical References
 
-- Implementation: `skillanalyzer/core/analyzers/behavioral_analyzer.py`
-- AST Parser: `skillanalyzer/core/static_analysis/parser/`
-- Dataflow: `skillanalyzer/core/static_analysis/dataflow/`
+- Implementation: `skill_scanner/core/analyzers/behavioral_analyzer.py`
+- AST Parser: `skill_scanner/core/static_analysis/parser/`
+- Dataflow: `skill_scanner/core/static_analysis/dataflow/`
 - Tests: `tests/test_enhanced_behavioral.py`
 - Complex eval: `evals/skills/behavioral-analysis/multi-file-exfiltration/`

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/binary-handling.md

@@ -1,4 +1,4 @@
-# Binary File Handling in Claude Skills and Codex Skills
+# Binary File Handling in Agent Skills
 
 ## Current Behavior
 
@@ -23,7 +23,7 @@ When the scanner finds binary files in a skill package:
 1. **Unauditable** - Can't read/inspect the code
 2. **Platform-specific malware** - Could be trojans, keyloggers, ransomware
 3. **Obfuscation** - Hides malicious behavior
-4. **Execution risk** - Could be run by user or Claude
+4. **Execution risk** - Could be run by user or agent
 5. **Supply chain attack** - Common malware delivery method
 
 **Example threat:**

{cisco_ai_skill_scanner-1.0.0 → cisco_ai_skill_scanner-1.0.1}/docs/developing.md

@@ -1,6 +1,6 @@
 # Development Guide
 
-This guide covers setting up your development environment, running tests, and contributing code to the Skill Analyzer.
+This guide covers setting up your development environment, running tests, and contributing code to the Skill Scanner.
 
 ## Prerequisites
 
@@ -69,7 +69,7 @@ uv run pytest tests/test_scanner.py -v
 uv run pytest tests/test_scanner.py::test_scan_safe_skill -v
 
 # Run with coverage report
-uv run pytest tests/ -v --tb=short --cov=skillanalyzer --cov-report=html
+uv run pytest tests/ -v --tb=short --cov=skill_scanner --cov-report=html
 ```
 
 For detailed testing requirements, see [TESTING.md](/TESTING.md).
@@ -99,7 +99,7 @@ This runs:
 ## Project Structure
 
 ```
-skillanalyzer/
+skill_scanner/
 ├── __init__.py
 ├── api/               # FastAPI REST endpoints
 ├── cli/               # Click CLI interface
@@ -131,16 +131,16 @@ evals/
 
 ```bash
 # Static analysis only (default)
-skill-analyzer scan /path/to/skill
+skill-scanner scan /path/to/skill
 
 # With behavioral analysis
-skill-analyzer scan /path/to/skill --use-behavioral
+skill-scanner scan /path/to/skill --use-behavioral
 
 # With LLM analysis (requires API key)
-skill-analyzer scan /path/to/skill --use-llm
+skill-scanner scan /path/to/skill --use-llm
 
 # All analyzers
-skill-analyzer scan /path/to/skill --use-behavioral --use-llm --use-virustotal
+skill-scanner scan /path/to/skill --use-behavioral --use-llm --use-virustotal
 ```
 
 ## Versioning