SkillSpector Security Scanner
Scan AI agent skills for security risks before installation.
What does this agent do, and when should you use it?
SkillSpector is a security scanner for AI agent skills that accepts Git repositories, URLs, ZIP archives, local directories, and individual files. It runs static analysis first and can optionally add LLM semantic evaluation; it does not execute the skill being scanned. The scanner covers 68 vulnerability or malicious-behavior patterns in 17 categories, including prompt injection, data exfiltration, dangerous code, dependency risk, MCP least privilege, and MCP tool poisoning. It produces terminal, JSON, Markdown, and SARIF reports with a 0–100 risk score, severity, installation recommendation, and findings. It can be invoked as a Python LangGraph workflow or served through `skillspector mcp` as an installation gate for MCP-capable runtimes such as Claude Code, Codex CLI, and Gemini CLI.
When skillspector scan <target> runs, it ingests the target and applies regex-based static checks, Python AST behavioral analysis, YARA signatures, and SC4 dependency-CVE lookups through OSV.dev to eligible files. Unless --no-llm is used, it then sends analyzer-eligible file contents to the configured SKILLSPECTOR_PROVIDER for optional LLM semantic assessment and false-positive filtering. The resulting report contains risk_assessment, a component inventory, issues, and scan metadata; JSON output is intended as a stable contract for CI and IDE tooling. skillspector baseline creates a suppression baseline so later scans can report only newly introduced findings. With the MCP extra installed, scan_skill(target, use_llm=true, output_format="json") returns structured risk_score, severity, recommendation, safe_to_install, and findings fields.
- A team maintaining a Claude Code skill catalog scans third-party Git repositories before admitting them to an internal catalog and uses the JSON report to decide whether installation is allowed.
- A developer configuring MCP tools for Codex CLI calls `scan_skill` before adding a new skill or MCP-related package and gates installation on the returned recommendation.
- A security engineer maintaining skill packages in CI emits SARIF to bring dangerous calls, unpinned dependencies, and supply-chain findings into an existing code-scanning workflow.
- A security reviewer audits a ZIP-delivered skill for prompt injection, data exfiltration, and suspicious YARA matches without executing any code inside it.
- A skill maintainer commits a `.skillspector-baseline.yaml` file to suppress accepted findings and focus recurring scans on untriaged changes.
What are this agent's strengths and limitations?
- Combines regex checks, Python AST analysis, YARA, OSV.dev dependency-vulnerability lookups, and optional LLM semantic evaluation in a two-stage pipeline rather than relying on keyword matching alone.
- Accepts local files, directories, ZIP archives, URLs, and Git repositories, with terminal, JSON, Markdown, and SARIF reporting.
- Explicitly does not execute the scanned skill, and `--no-llm` keeps file contents from being sent to an LLM provider.
- Supports baseline suppression using fingerprints or glob rules, helping recurring scans focus on newly introduced risk.
- Offers both an MCP server and a Python `graph.invoke` interface for install gates, CI, and editor integrations.
- Static analysis can produce false positives; the optional semantic stage can improve precision but requires a provider, credentials, or a local CLI runtime.
- When LLM analysis is enabled, analyzer-eligible file contents are sent to the configured provider; even with `--no-llm`, SC4 sends dependency names and versions to OSV.dev.
- This is a pre-install detection layer, not a sandbox; it does not contain a skill that is installed despite risky findings.
- Documented limitations include potentially missed non-English patterns, no analysis of image-contained text or encrypted/compiled code, and no dynamic execution analysis.
- The HTTP MCP transport has no authentication by default, so externally reachable deployments need an authenticated reverse proxy.
How do you install or deploy this agent?
Install the CLI only:
uv tool install git+https://github.com/NVIDIA/skillspector.git
To run the MCP server:
uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'
For a source installation, create and activate a Python virtual environment, then run make install; use make install-dev for development dependencies. A first static-only scan needs no credentials when run with --no-llm. LLM analysis requires credentials for the selected provider; for the OpenAI path, set SKILLSPECTOR_PROVIDER=openai and OPENAI_API_KEY.
How do you use this agent?
Start with a local static scan:
skillspector scan ./my-skill/ --no-llm
Write a machine-readable report:
skillspector scan ./my-skill/ --no-llm --format json --output report.json
Scan a Git repository:
skillspector scan https://github.com/user/my-skill
Enable optional OpenAI semantic analysis:
export SKILLSPECTOR_PROVIDER=openai
export OPENAI_API_KEY=sk-...
skillspector scan ./my-skill/
Start a local MCP server:
skillspector mcp
Register it with Claude Code:
claude mcp add skillspector -- skillspector mcp