AI Security Scanner Configuration

The AI Security Scanner is configured through the xygeni.aisecurity.yml file. The built-in configuration can be overridden with a custom file using the -c / --conf option.

The configuration file holds only the engine-level scan settings. Detectors are not listed here: each detector ships its own YAML descriptor under aisecurity/detectors/<id>.yml and is auto-discovered at load time.

Engine settings

# Includes/excludes: Ant-like patterns relative to the scan root.
# Empty 'includes' means ALL files. Command-line --include / --exclude override these.
includes: []

excludes:
  - ".git/**/*"
  - "**/node_modules/**/*"
  - "**/dist/**"
  - "**/target/**"
  - "**/__pycache__/**/*"
  - "vendor/**"

# sequential: detectors run sequentially; parallel: files are processed in parallel.
mode: sequential

# Timeout, in seconds, for the analysis to complete. 0 or negative means no timeout.
timeout: 600

# List of detector ids/severities to run; empty = no restriction. CLI --detectors overrides.
runDetectors: []

# Same shape as runDetectors but for skipping. CLI --skip-detectors overrides.
skipDetectors: []

# OWASP LLM Top 10 categories to include (LLM01..LLM10). Empty = all. CLI --owasp overrides.
owaspCategories: []

Per-detector configuration

Each detector is described by its own YAML file. The descriptor declares the detector's identity, severity, the standards it maps to, the AI asset kind it applies to, and its red-team vector tags:

id: unbounded-user-content-in-system-prompt
enabled: true
severity: high

standards:
  - { std: owasp-llm-top10, ver: "2025", id: LLM01, rel: primary }
  - { std: owasp-asi-top10, ver: "2026", id: ASI01, rel: secondary }
assetKind: ai_prompt

description: System prompt concatenates user-controlled content with no role separation or guardrail.

redTeamVectors:
  - PromptInjection
  - Jailbreaks

To tune a detector (e.g., disable it or change its severity), place an overriding descriptor with the same id in a custom directory and pass it with --custom-detectors-dir. The same mechanism is used to add custom detectors.

LLM semantic review (Stage 2)

Deterministic detectors are complemented by an optional LLM semantic review stage that judges the intent of skill and agent instruction manifests (SKILL.md, AGENTS.md, AGENT.md) raised by the skill-instructions-review detector. A malicious skill written in plain prose (e.g., instructions to read credentials and post them to an external host) carries no code signature — only a semantic review can confirm or discard it.

The stage is off by default and follows an offline-fallback contract: when no AI agent is configured (or the configured provider is unavailable), findings ship at deterministic confidence with a low-severity "pending review" floor.

The review provider is selected through the standard ai-agent / ai-agents keys of the global xygeni.yml — the same schema documented in AI Agents Configuration:

# conf/xygeni.yml

ai-agent: anthropic          # provider for the semantic review stage

ai-agents:
  anthropic:
    token: ${ANTHROPIC_API_KEY}
    model: claude-sonnet-4-6

Supported providers:

Provider	Notes
anthropic	Anthropic Messages API (cloud; requires a token).
anthropic_cli	The local claude CLI (Claude Code). Needs no host or token; reuses the authenticated claude session on the host.
openai	OpenAI chat completions. Its host field also makes any OpenAI-compatible endpoint first-class (NVIDIA NIM, vLLM, Ollama, self-hosted, air-gapped). Token optional for keyless self-hosted servers.
gemini, groq, openrouter	Cloud providers; require a token.

The review is deterministic (temperature 0) and uses a versioned prompt pack, so verdicts are reproducible across scans. A per-scanner override of the provider can be declared in xygeni.aisecurity.yml when the AI Security scan must use a different agent than the rest of the platform.