> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/ai-security/ai-security-scanner/ai-security-scanner-configuration.md). # AI Security Scanner Configuration The [**AI Security Scanner**](/xygeni-products/ai-security/ai-security-scanner.md) is configured through the `xygeni.aisecurity.yml` file. The built-in configuration can be overridden with a custom file using the `-c / --conf` option. The configuration file holds only the **engine-level scan settings**. Detectors are *not* listed here: each detector ships its own YAML descriptor under `aisecurity/detectors/.yml` and is auto-discovered at load time. ### Engine settings ```yaml # Includes/excludes: Ant-like patterns relative to the scan root. # Empty 'includes' means ALL files. Command-line --include / --exclude override these. includes: [] excludes: - ".git/**/*" - "**/node_modules/**/*" - "**/dist/**" - "**/target/**" - "**/__pycache__/**/*" - "vendor/**" # sequential: detectors run sequentially; parallel: files are processed in parallel. mode: sequential # Timeout, in seconds, for the analysis to complete. 0 or negative means no timeout. timeout: 600 # List of detector ids/severities to run; empty = no restriction. CLI --detectors overrides. runDetectors: [] # Same shape as runDetectors but for skipping. CLI --skip-detectors overrides. skipDetectors: [] # OWASP LLM Top 10 categories to include (LLM01..LLM10). Empty = all. CLI --owasp overrides. owaspCategories: [] ``` ### Per-detector configuration Each detector is described by its own YAML file. The descriptor declares the detector's identity, severity, the standards it maps to, the AI asset kind it applies to, and its red-team vector tags: ```yaml id: unbounded-user-content-in-system-prompt enabled: true severity: high standards: - { std: owasp-llm-top10, ver: "2025", id: LLM01, rel: primary } - { std: owasp-asi-top10, ver: "2026", id: ASI01, rel: secondary } assetKind: ai_prompt description: System prompt concatenates user-controlled content with no role separation or guardrail. redTeamVectors: - PromptInjection - Jailbreaks ``` To tune a detector (e.g., disable it or change its severity), place an overriding descriptor with the same `id` in a custom directory and pass it with `--custom-detectors-dir`. The same mechanism is used to add **custom detectors**. ### LLM semantic review (Stage 2) Deterministic detectors are complemented by an optional **LLM semantic review stage** that judges the *intent* of skill and agent instruction manifests (`SKILL.md`, `AGENTS.md`, `AGENT.md`) raised by the `skill-instructions-review` detector. A malicious skill written in plain prose (e.g., instructions to read credentials and post them to an external host) carries no code signature — only a semantic review can confirm or discard it. The stage is **off by default** and follows an *offline-fallback* contract: when no AI agent is configured (or the configured provider is unavailable), findings ship at deterministic confidence with a low-severity "pending review" floor. The review provider is selected through the standard `ai-agent` / `ai-agents` keys of the global `xygeni.yml` — the same schema documented in [AI Agents Configuration](/xygeni-products/scan-management/ai-agents-configuration.md): ```yaml # conf/xygeni.yml ai-agent: anthropic # provider for the semantic review stage ai-agents: anthropic: token: ${ANTHROPIC_API_KEY} model: claude-sonnet-4-6 ``` Supported providers: | Provider | Notes | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `anthropic` | Anthropic Messages API (cloud; requires a token). | | `anthropic_cli` | The local `claude` CLI (Claude Code). Needs no host or token; reuses the authenticated `claude` session on the host. | | `openai` | OpenAI chat completions. Its `host` field also makes any **OpenAI-compatible endpoint** first-class (NVIDIA NIM, vLLM, Ollama, self-hosted, air-gapped). Token optional for keyless self-hosted servers. | | `gemini`, `groq`, `openrouter` | Cloud providers; require a token. | The review is deterministic (temperature 0) and uses a versioned prompt pack, so verdicts are reproducible across scans. A per-scanner override of the provider can be declared in `xygeni.aisecurity.yml` when the AI Security scan must use a different agent than the rest of the platform. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.xygeni.io/xygeni-products/ai-security/ai-security-scanner/ai-security-scanner-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.