SkillSpector

// Overview

Agent skills — the packaged instruction bundles that Claude Code, Codex CLI and Gemini CLI load — run with implicit trust and very little vetting. SkillSpector is NVIDIA's open-source scanner for exactly that gap. It answers one question: is this skill safe to install? Point it at a Git repo, a URL, a zip, a directory or a single `SKILL.md`, and it returns a 0–100 risk score with a severity label and a recommendation.

Detection runs in two stages. A fast static pass applies 70 vulnerability patterns across 17 categories — prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, output handling, system-prompt leakage, memory poisoning, tool misuse, rogue agent, anti-refusal, trigger abuse, dangerous code via AST analysis, taint tracking, YARA signatures, MCP least privilege and MCP tool poisoning. An optional second pass sends the skill to an LLM for semantic evaluation; supply-chain checks can also query OSV.dev live for CVE data, falling back to offline data when the network is unavailable.

Reports come out as terminal output, JSON, Markdown or SARIF, so a scan drops straight into CI or an IDE's problem list. A baseline file lets you accept known findings once — either as exact evidence-bound fingerprints or as drift-tolerant glob rules — so re-scans surface only new issues and the risk score reflects un-triaged problems rather than accumulated noise.

SkillSpector can also run as an MCP server, which turns it from an out-of-band audit into a runtime guardrail: an MCP-capable agent calls `scan_skill` and gates the install on the verdict. It is Apache-2.0 licensed, needs Python 3.12 or newer, ships a Dockerfile for a Python-free path, and is part of NVIDIA's Verified Skills pipeline, which scans, evaluates and signs skills before publishing them to the NVIDIA skills catalog.

// What it does

• 70 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, privilege escalation and MCP tool poisoning
• Two-stage analysis: fast static scanning plus optional LLM semantic evaluation
• Multi-format input — Git repos, URLs, zip files, directories or a single SKILL.md
• Terminal, JSON, Markdown and SARIF reports, with a 0–100 risk score and severity label
• Baseline suppression by fingerprint or glob rule, so re-scans surface only new findings
• Runs as an MCP server exposing a `scan_skill` tool, so an agent can gate installs on the result
• Pluggable LLM backends — OpenAI, Anthropic, Bedrock, build.nvidia.com, local Claude/Codex CLIs, or any OpenAI-compatible endpoint such as Ollama or vLLM

// Getting started

Install the CLI with uv, scan a skill, and read the risk score. Static-only scans need no API key; LLM analysis needs a provider configured. Python 3.12 or newer is required.

uv tool install git+https://github.com/NVIDIA/skillspector.git

# with MCP server support
uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'

skillspector scan ./my-skill/
skillspector scan ./SKILL.md
skillspector scan https://github.com/user/my-skill
skillspector scan ./my-skill.zip

# static only — faster, no API key
skillspector scan ./my-skill/ --no-llm

# with Anthropic semantic analysis
export SKILLSPECTOR_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...
skillspector scan ./my-skill/

skillspector scan ./my-skill/ --format sarif --output report.sarif
skillspector scan ./my-skill/ --format json --output report.json

skillspector baseline ./my-skill/ -o .skillspector-baseline.yaml
skillspector scan ./my-skill/ --baseline .skillspector-baseline.yaml

skillspector mcp
skillspector mcp --transport http --host 127.0.0.1 --port 8000

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Vet a third-party agent skill or MCP server before installing it on a developer machine
• Gate skill installs in CI with a SARIF report and a risk-score threshold
• Give an agent the ability to scan and refuse a skill at runtime through the MCP `scan_skill` tool
• Audit an internal skill library in bulk, then baseline the accepted findings so future scans stay signal-only

// How SkillSpector compares

SkillSpector alongside other open-source guardrails & security tools AI/TLDR tracks, ranked by GitHub stars.