Search skills/

SkillSpector Claude skills

NVIDIA's open-source security scanner for agent skills, with 71 detection patterns, optional LLM review and a skill-inspector skill.

NVIDIA/SkillSpector 33 skills SecuritySkill & agent tooling
Our verdict Recommended

A serious, Apache-2.0 scanner from NVIDIA with tests and CI; use the score as a starting point and read the findings, because pattern matches in docs are common.

4/5 Depth expertise shipped Note Security Review before installing 0d Maintenance Updated today 23K Adoption stars OK License Apache-2.0, commercial OK

What SkillSpector does

SkillSpector is a Python command-line scanner that checks agent skills before you install them. You point it at a Git repo, URL, zip file, directory or single file, and it runs static analysis for 71 patterns in 17 categories: prompt injection, data exfiltration, privilege escalation, supply-chain risk, excessive agency, memory poisoning, rogue-agent behavior, anti-refusal text, dangerous code found through AST analysis, taint tracking, YARA signatures, and MCP least-privilege and tool-poisoning checks. It produces a 0 to 100 risk score with terminal, JSON, Markdown or SARIF output, and supports baselines so re-scans show only new findings. An optional second stage asks an LLM (Anthropic, OpenAI, Azure, Ollama, a local agent CLI or any OpenAI-compatible endpoint) to judge the findings semantically. Dependency checks query OSV.dev with an offline fallback.

The skill part is small: skill-inspector (about 7.5 KB) tells an agent to run the skillspector CLI first, treat the target as untrusted, avoid executing its scripts, keep --no-llm unless you ask, and combine the score with its own source review. Most of the 33 skill-like folders in the repo are deliberately malicious or edge-case test fixtures. Install with uv tool install git+https://github.com/NVIDIA/skillspector.git, or build the Docker image.

Good for

  • Vetting a third-party skill or MCP server before installing it
  • Gating skill installs in CI with SARIF output and baselines
  • Teams building a review process for internal skill libraries

Not for

  • Treating the score as proof of safety, since documentation text often triggers pattern hits
  • Environments where sending skill content to an external LLM is not allowed (use --no-llm)

What's inside depth 4/5

One 7.5 KB skill on top of a full Python scanner with 71 patterns, a CI pipeline and a large set of test fixtures, though the skill itself has no references or scripts.

Skills
33
Reference docs
2
Scripts
13
Tests / evals
0
Templates
0
Avg SKILL.md
0.7 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Python 3.12 or newer with uv or pip (or Docker)
  • Optional: an LLM provider API key or local agent CLI for the semantic stage
  • Network access to OSV.dev for live vulnerability lookups (offline fallback exists)
  • Telemetry: none found; with LLM analysis enabled, skill content is sent to the provider you configure, and --no-llm keeps scanning local apart from OSV.dev lookups.

Security review

Review before installing

A skill that tells the agent to scan other skills with the NVIDIA SkillSpector CLI (with --no-llm by default) and then review the source read-only. The skill folder is instructions only; the only code we have is deliberately malicious test fixtures used to test the scanner. Installing the scanner is a separate, unpinned step, and LLM mode would send scanned content to a model provider.

Worth knowing

  • Relies on a CLI or package we could not reviewThe skill runs the separately installed skillspector CLI (Python package from NVIDIA/skillspector) against the target skill; the scanner's own source (src/) is not among the files we have.skills/skill-inspector/SKILL.md:46
  • Runs remote code at an unpinned versionREADME installs the scanner with uv tool install git+https://github.com/NVIDIA/skillspector.git (no tag or commit); the skill itself tells the agent not to install tools silently.README.md:45
  • Makes network requestsThe scanner looks up dependencies on OSV.dev, and if LLM analysis is enabled sends scanned skill content to the configured provider (NVIDIA build API by default, or Anthropic/OpenAI/etc.); the skill says to keep --no-llm unless the user asks.README.md:912

What we checked

The repository (476 files) on Oct 29, 2026. Not a full review: 425 of 476 files were not downloaded (large repository; we reviewed the skill folders); it relies on code outside the repository: The SkillSpector scanner source (src/skillspector, 425 readable files not available to us) and its Python dependencies; LLM providers used when LLM analysis is enabled (NVIDIA build API, Anthropic, OpenAI, Gemini, local agent CLIs); OSV.dev vulnerability lookups.

NVIDIA SkillSpector static scan: 66 pattern hits (Data Exfiltration 19, Anti-Refusal 11, Prompt Injection 5, MCP Rug Pull 5, Dangerous Code Execution 5, Privilege Escalation 4). All CRITICAL and most HIGH hits are intentional: the 13 code files are test fixtures that model malicious or mismatched skills (env harvesting to evil.example.com, an undeclared-permission agent, a skill with a harmful recipe line) and are never run by the skill; the README hits are its table of detection patterns and example output.

A review, not a certification. Skills change after we check them — read the files before installing.

License

Apache-2.0 — commercial use allowed. The README notes it downloads third-party open-source dependencies with their own licenses.

Can it run unattended?

Yes. It is a batch CLI with recursive collection, a max-skills option, baselines and SARIF output, so it can scan many skills unattended in CI.

Alternatives to SkillSpector

Snyk Agent Scan

snyk/agent-scan

Snyk's CLI scanner that discovers installed agents, MCP servers and skills on your machine and checks them for prompt injection and other risks.

With caveats Check first Depth 3/5

Cisco Skill Scanner

cisco-ai-defense/skill-scanner

Cisco AI Defense's open-source scanner for agent skills: YARA and YAML rules, dataflow analysis and an optional LLM judge, with SARIF output and a pre-commit hook.

Recommended Check first Depth 4/5

Cloudflare security-audit

cloudflare/security-audit-skill

A single multi-agent skill from Cloudflare that audits a codebase in six phases and writes validated, independently verified findings.

Recommended Check first Depth 5/5

Trail of Bits Skills

trailofbits/skills

Trail of Bits' marketplace of 97 security skills: smart-contract scanners, C/C++ and Rust review, Semgrep and CodeQL workflows, variant analysis and audit helpers.

Recommended Broad access Depth 4/5

FAQ

What is NVIDIA SkillSpector?

SkillSpector is an open-source scanner for AI agent skills from NVIDIA. It checks skills and MCP definitions for prompt injection, data exfiltration, privilege escalation, supply-chain risks and 60-plus other patterns, then gives a 0 to 100 risk score.

How do I install SkillSpector?

Run uv tool install git+https://github.com/NVIDIA/skillspector.git (add the mcp extra if you want skillspector mcp), or build the Docker image and run skillspector scan ./my-skill/ --no-llm.

Is SkillSpector safe to run on untrusted skills?

It reads and analyzes files rather than executing the target skill's scripts, and its skill-inspector instructions say not to run them. LLM analysis sends content to the provider you pick, so use --no-llm for sensitive code.

SkillSpector vs Snyk agent-scan: which one?

Both scan agent skills and MCP servers for risks. SkillSpector is NVIDIA's open-source CLI with a pattern library, optional LLM review and SARIF output; compare detection results on your own skills, since coverage and false-positive rates differ.

Sources: GitHub repository (stars, license, file tree, last push Oct 29, 2026). Review based on the README and SKILL.md files as published.