[dependabot]

Bumps the python group with 1 update: cisco-ai-skill-scanner.

Updates cisco-ai-skill-scanner from 2.2.2 to 2.3.0

Release notes

Sourced from cisco-ai-skill-scanner's releases.

Skill Scanner 2.3.0

This release maps every finding to the Cisco AI Security and Safety Taxonomy, closes several ways to hide text from the frontmatter scan, and stops silently skipping symlinks and unloadable skills, while keeping the measured false-positive rate steady on the pull-request development corpus.

Changes

• Attach a Cisco AI taxonomy code to findings: an AITech code and, where one fits, an AISubtech code, with names and OWASP, MITRE ATLAS and NIST AML crosswalks, from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner. Every bundled rule declares its code, operational findings are not_applicable, and a code that cannot be resolved is unmapped rather than guessed. New finding metadata: aitech, aitech_name, aisubtech, aisubtech_name, aitech_mappings, aisubtech_mappings, framework_mappings, taxonomy_status and taxonomy_source, plus scan-level counts in scan_metadata.taxonomy and SARIF result properties. (#267)
• Scan every SKILL.md frontmatter value and comment except allowed-tools, as the loader parses it. Quoted and complex keys, YAML aliases and merge keys, escape sequences, !!binary values and values folded over several lines no longer hide text from the static rules. (#265, #268)
• Detect plain-language instructions to read a local credential file and send it to a remote host in ACTIVE_SENSITIVE_EXFILTRATION. (#264)
• Report symlinks among a skill's files, which are not followed, as SYMLINK_NOT_SCANNED (HIGH when the target leaves the skill root), and skills that fail to load as SKILL_LOAD_FAILED findings in scan-all. (#265)
• Avoid quadratic regex work in two rules on long lines. (#265)

Behavior notes

Taxonomy codes follow taxonomy 2.0.0, so some change: jailbreak rules move from AITech-2.1 to AITech-1.1 / AISubtech-1.1.5, and hardcoded secrets from AISubtech-8.2.2 to AISubtech-14.1.1. The AITech-99.9 / AISubtech-99.9.9 placeholders are no longer emitted. Update any filters on 1.x codes. scan-all now reports folders with unloadable skills or symlinks as findings instead of skipping them, so SARIF, markdown output and --fail-on-severity exit codes include them.

Validation

The PR detection-impact gate compares base and head on the same labelled development records and fixed real-skill sample, enforcing a 0.5 percentage point FPR-rise limit. Across this release, benign flags stayed at 14/1,338 (1.05%) and real-skill flags at 130/2,000, while development-split recall rose from 31.43% to 31.94%. The exact-SHA release evidence and mandatory release gate passed 3,551 checks. The release holdout compares CEL-off and active modes of this revision; both flagged 23/545 benign samples (4.22%), and holdout recall (7.75%) and macro-F1 (35.41%) are unchanged from 2.2.2.

Commits

• e4e334f docs: pin examples to 2.3.0 and describe the 2.3.0 scanning changes (#269)
• 5b0eda6 feat: detect plain-language instructions to send local secrets to a remote ho...
• 55bd732 feat: map every finding to a Cisco AI taxonomy code (#267)
• 010ae2c fix: scan SKILL.md frontmatter values as the loader parses them (#268)
• 64101c5 fix: close silent-skip paths in the scanner and two quadratic rules (#265)
• f18074a docs: pin site examples to skill-scanner 2.2.2 (#262)
• e5a3d3e chore: update Homebrew formula to 2.2.2 (#261)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions