# SkillSpector

> Scans AI agent skills for security risks before you install them

- Repository: https://github.com/NVIDIA/SkillSpector
- Category: Infrastructure & security
- Stars: 21,011 · Forks: 1,846 · Language: Python · License: Apache-2.0
- Experience: Some experience
- Page: https://ir.adyog.com/repos/nvidia/skillspector/

Agent skills run inside tools like Claude Code, Codex CLI and Gemini CLI, and they are usually trusted with little checking. The README cites a research dataset of 31,132 skills, where 26.1% had vulnerabilities and 5.2% looked intentionally malicious. SkillSpector is built to answer one question: is this skill safe to install?

You point it at a local folder, a single SKILL.md, a zip file, a URL or a Git repo. It first runs fast static checks against 71 patterns in 17 categories, such as prompt injection, data exfiltration, privilege escalation, MCP tool poisoning and dangerous code. Optionally, an LLM then reads the skill for meaning that simple patterns miss. The result is a 0-100 risk score with severity labels and recommendations.

It is part of NVIDIA's Verified Skills pipeline, which scans, evaluates and signs skills before publication. It also supports a baseline file, so you can accept known findings and see only new ones on later scans.

## What it does

- **Many input types**: Scans Git repos, URLs, zip files, directories or a single file. Size caps on downloads and zips fail closed to guard against oversized or zip-bomb inputs.
- **71 patterns, two stages**: Static analysis is fast and needs no API key. Optional LLM analysis adds semantic checks and works with OpenAI, Anthropic, Bedrock, Azure, Ollama, local CLIs and other OpenAI-compatible endpoints.
- **Live dependency lookups**: The supply-chain check queries OSV.dev for current CVE data and falls back to offline data when needed.
- **Reports for people and CI**: Outputs terminal, JSON, Markdown and SARIF reports, with a 0-100 risk score and clear recommendations.
- **Baseline suppression**: Accept known or false-positive findings into a baseline file so later scans report and score only new issues.

## What you could build

- Check a skill from GitHub for malicious patterns before adding it to Claude Code.
- Gate installs or pull requests by running scans in CI and uploading SARIF reports.
- Batch scan a whole folder of skills in parallel to audit a collection.
- Run scans from inside an agent session using the Pi or OpenCode extension.
- Scan skills in a Docker container without installing Python.

## Who it's for

Developers who install third-party agent skills or MCP tools and want a safety check; comfortable with a command line and basic Python tooling.

## Get started

Install it with uv (Python 3.12+), then run a scan against a skill folder, file, zip or repo URL. Add --no-llm for static-only scans, or set SKILLSPECTOR_PROVIDER and an API key for LLM analysis.

```
uv tool install git+https://github.com/NVIDIA/skillspector.git
```
```
skillspector scan ./my-skill/
```
```
skillspector scan ./my-skill/ --no-llm
```

Tags: security, agent-skills, prompt-injection, mcp, supply-chain