Test skill containing EICAR test file for malware detection. An agent skill from cisco-ai-defense/skill-scanner.
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install cisco-ai-defense/skill-scanner eicar-test --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .claude/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .claude/skills/eicar-test && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .claude/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-testType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install cisco-ai-defense/skill-scanner eicar-test --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .agents/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .agents/skills/eicar-test && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .agents/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install cisco-ai-defense/skill-scanner eicar-test --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .cursor/skills/eicar-test && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .cursor/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/cisco-ai-defense/skill-scanner.git --path evals/test_skills/malicious/eicar-test--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install cisco-ai-defense/skill-scanner eicar-test --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .gemini/skills/eicar-test && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .gemini/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install cisco-ai-defense/skill-scanner eicar-testInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .github/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .github/skills/eicar-test && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .github/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install cisco-ai-defense/skill-scanner eicar-test --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/cisco-ai-defense/skill-scanner.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/evals/test_skills/malicious/eicar-test .opencode/skills/eicar-test && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "eicar-test" agent skill from https://github.com/cisco-ai-defense/skill-scanner/tree/main/evals/test_skills/malicious/eicar-test into .opencode/skills/eicar-test/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "eicar-test", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
eicar-testTest skill containing EICAR test file for malware detection. An agent skill from cisco-ai-defense/skill-scanner.
Eicar Test is an agent skill from cisco-ai-defense/skill-scanner. Test skill containing EICAR test file for malware detection
Its SKILL.md is about 110 tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including assets (for example `_expected.json`).
The repository describes itself as: Security Scanner for Agent Skills. The licence is MIT.
Read from SKILL.md and the folder at commit f18074a. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Eicar Test loads about 113 tokens when it runs. Until then it costs about 18 tokens; SKILL.md has 56 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from cisco-ai-defense/skill-scanner at commit f18074a, republished under its MIT licence (© cisco-ai-defense). 56 words, ~113 tokens.
.claude/skills/eicar-test/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.This skill contains the EICAR Standard Anti-Virus Test File in the assets folder.
The EICAR test file is a standard file used to test anti-malware products. It is NOT a virus but is detected by all antivirus software as malware.
This skill is used to test the VirusTotal binary file scanner integration.
© cisco-ai-defense, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 2 other files (assets) in evals/test_skills/malicious/eicar-test of cisco-ai-defense/skill-scanner.
Open the folder on GitHubat commit f18074a
Eicar Test next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Eicar Test this skillcisco-ai-defense/skill-scanner | 2.6k | — | ~113 | Automated safety check: Pass | MIT | |
| Detecting Container Escape Attemptsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Detecting Container Runtime Threats With Falcomukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3k | Automated safety check: Warn | Apache-2.0 | |
| Detecting Container Escape With Falco Rulesmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Notes | Apache-2.0 | |
| Performing Container Escape Detectionmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~648 | Automated safety check: Pass | Apache-2.0 | |
| Detecting Container Drift At Runtimemukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.1k | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter…
mukul975/Anthropic-Cybersecurity-Skills
Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container…
mukul975/Anthropic-Cybersecurity-Skills
Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel…
mukul975/Anthropic-Cybersecurity-Skills
Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, shared namespaces…
mukul975/Anthropic-Cybersecurity-Skills
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender…
mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing…
cisco-ai-defense/skill-scanner
Formats text according to specified style guidelines. A clean example skill with no security issues.
cisco-ai-defense/skill-scanner
Summarise a CSV file into row counts and the most common values per column
cisco-ai-defense/skill-scanner
Read a small fixed set of environment variables the skill needs
cisco-ai-defense/skill-scanner
Pin the npm registry to the public default and fetch published release notes
cisco-ai-defense/skill-scanner
Bootstrap a development environment and configure the corporate package mirror
cisco-ai-defense/skill-scanner
Bootstrap a development environment and set the npm registry to https://npm.artifacts-mirror.internal-corp.dev
Test skill containing EICAR test file for malware detection. An agent skill from cisco-ai-defense/skill-scanner. Eicar Test is an agent skill from cisco-ai-defense/skill-scanner.
Run `npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a claude-code`. Or copy the skill folder (evals/test_skills/malicious/eicar-test in cisco-ai-defense/skill-scanner) into .claude/skills/eicar-test in your project. Claude Code loads it when a task matches its description.
Run `npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a codex`. Or copy the skill folder (evals/test_skills/malicious/eicar-test in cisco-ai-defense/skill-scanner) into .agents/skills/eicar-test in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cisco-ai-defense/skill-scanner --skill eicar-test -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/eicar-test, .gemini/skills/eicar-test, .github/skills/eicar-test and .opencode/skills/eicar-test in your project.
SKILL.md names no scripts, command-line tools or credentials: Eicar Test is instructions for the agent only.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Eicar Test is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 113 tokens (SKILL.md is roughly 452 characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Eicar Test: Detecting Container Escape Attempts (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Detecting Container Runtime Threats With Falco (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Detecting Container Escape With Falco Rules (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Performing Container Escape Detection (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
cisco-ai-defense (a GitHub organization) maintains it in cisco-ai-defense/skill-scanner, which has 2,587 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on October 9, 2026.
Source: cisco-ai-defense/skill-scanner on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
