SkillSpector

NVIDIA/SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

Install

GitHub: NVIDIA/SkillSpector
Website: docs.nvidia.com
Stars: ★ 21.4k
License: Apache-2.0
Language: Python
Last push: Oct 23, 2026
Topics: agent-security · agentic-ai · ai-security · mcp · prompt-injection · security-scanner

Good for

Scan an agent skill before installing it to decide whether it is safe
Detect 71 patterns including prompt injection, data exfiltration, privilege escalation and supply-chain risks
Scan Git repos, URLs, zip files, directories or single files and output JSON, Markdown or SARIF reports
Use a baseline to suppress known false positives so re-scans show only new issues

Getting started

Install with npx skills add NVIDIA/SkillSpector
For the CLI, run uv tool install git+https://github.com/NVIDIA/skillspector.git
Or use Docker: docker run --rm -v "$PWD:/scan" skillspector scan ./my-skill/ --no-llm
Read the 0-100 risk score and severity labels before deciding to install

Before you install

The CLI needs Python unless you run it through Docker. Optional LLM semantic analysis needs credentials in a .env file, and the default configuration targets DeepSeek.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

paperclipCommunity skills · ★ 107k
The open-source app everyone uses to manage agents at work
claude-code-best-practiceCommunity skills · ★ 68k
from vibe coding to agentic engineering - practice makes claude perfect
agentsCommunity skills · ★ 41.7k
Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi
invisible_dotsCommunity skills · ★ 32.2k
Open-source, self-hosted alternative to OpenAI Dots, Grok Bot. Built to be undetectable by anti-bot systems.
claude-skillsCommunity skills · ★ 28.7k
380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering, marketing, product, compliance, C-level advisory, research, business operations, commercial & finance, and your daily productivity skills.