SkillSpector Security Scanner
Scan AI agent skills for security risks before installation.
- Source repo
- NVIDIA/SkillSpector
- Stars
- ★ 25k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 62/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A team maintaining a Claude Code skill catalog scans third-party Git repositories before admitting them to an internal catalog and uses the JSON report to decide whether installation is allowed.
- Not a fit if
- Teams wanting sandboxing or runtime blocking: it is a pre-install scan and does not contain an installed risky skill
- Externally reachable MCP deployments: the HTTP transport ships without authentication and needs your own reverse proxy
- Source review
- 62/100 · Some gaps
What does this agent do, and when should you use it?
SkillSpector is a security scanner for AI agent skills that accepts Git repositories, URLs, ZIP archives, local directories, and individual files. It runs static analysis first and can optionally add LLM semantic evaluation; it does not execute the skill being scanned. The scanner covers 68 vulnerability or malicious-behavior patterns in 17 categories, including prompt injection, data exfiltration, dangerous code, dependency risk, MCP least privilege, and MCP tool poisoning. It produces terminal, JSON, Markdown, and SARIF reports with a 0–100 risk score, severity, installation recommendation, and findings. It can be invoked as a Python LangGraph workflow or served through skillspector mcp as an installation gate for MCP-capable runtimes such as Claude Code, Codex CLI, and Gemini CLI.
When skillspector scan <target> runs, it ingests the target and applies regex-based static checks, Python AST behavioral analysis, YARA signatures, and SC4 dependency-CVE lookups through OSV.dev to eligible files. Unless --no-llm is used, it then sends analyzer-eligible file contents to the configured SKILLSPECTOR_PROVIDER for optional LLM semantic assessment and false-positive filtering. The resulting report contains risk_assessment, a component inventory, issues, and scan metadata; JSON output is intended as a stable contract for CI and IDE tooling. skillspector baseline creates a suppression baseline so later scans can report only newly introduced findings. With the MCP extra installed, scan_skill(target, use_llm=true, output_format="json") returns structured risk_score, severity, recommendation, safe_to_install, and findings fields.
- A team maintaining a Claude Code skill catalog scans third-party Git repositories before admitting them to an internal catalog and uses the JSON report to decide whether installation is allowed.
- A developer configuring MCP tools for Codex CLI calls
scan_skillbefore adding a new skill or MCP-related package and gates installation on the returned recommendation. - A security engineer maintaining skill packages in CI emits SARIF to bring dangerous calls, unpinned dependencies, and supply-chain findings into an existing code-scanning workflow.
- A security reviewer audits a ZIP-delivered skill for prompt injection, data exfiltration, and suspicious YARA matches without executing any code inside it.
- A skill maintainer commits a
.skillspector-baseline.yamlfile to suppress accepted findings and focus recurring scans on untriaged changes.
How do you install or deploy this agent?
Install the CLI only:
uv tool install git+https://github.com/NVIDIA/skillspector.gitTo run the MCP server:
uv tool install 'skillspector[mcp] @ git+https://github.com/NVIDIA/skillspector.git'For a source installation, create and activate a Python virtual environment, then run make install; use make install-dev for development dependencies. A first static-only scan needs no credentials when run with --no-llm. LLM analysis requires credentials for the selected provider; for the OpenAI path, set SKILLSPECTOR_PROVIDER=openai and OPENAI_API_KEY.
How do you use this agent?
Start with a local static scan:
skillspector scan ./my-skill/ --no-llmWrite a machine-readable report:
skillspector scan ./my-skill/ --no-llm --format json --output report.jsonScan a Git repository:
skillspector scan https://github.com/user/my-skillEnable optional OpenAI semantic analysis:
export SKILLSPECTOR_PROVIDER=openaiexport OPENAI_API_KEY=sk-...
skillspector scan ./my-skill/Start a local MCP server:
skillspector mcpRegister it with Claude Code:
claude mcp add skillspector -- skillspector mcpWhat are this agent's strengths and limitations?
- Combines regex checks, Python AST analysis, YARA, OSV.dev dependency-vulnerability lookups, and optional LLM semantic evaluation in a two-stage pipeline rather than relying on keyword matching alone.
- Accepts local files, directories, ZIP archives, URLs, and Git repositories, with terminal, JSON, Markdown, and SARIF reporting.
- Explicitly does not execute the scanned skill, and
--no-llmkeeps file contents from being sent to an LLM provider. - Supports baseline suppression using fingerprints or glob rules, helping recurring scans focus on newly introduced risk.
- Offers both an MCP server and a Python
graph.invokeinterface for install gates, CI, and editor integrations.
- Static analysis can produce false positives; the optional semantic stage can improve precision but requires a provider, credentials, or a local CLI runtime.
- When LLM analysis is enabled, analyzer-eligible file contents are sent to the configured provider; even with
--no-llm, SC4 sends dependency names and versions to OSV.dev. - This is a pre-install detection layer, not a sandbox; it does not contain a skill that is installed despite risky findings.
- Documented limitations include potentially missed non-English patterns, no analysis of image-contained text or encrypted/compiled code, and no dynamic execution analysis.
- The HTTP MCP transport has no authentication by default, so externally reachable deployments need an authenticated reverse proxy.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| SkillSpector Security Scanner This agent | 62 · Some gaps | CLIFree + model costs | ★ 25k | today | Python | Codex · Claude Code · OpenAI API · Claude API |
| Repo Forensics | 44 · Major gaps | CLIPaid | ★ 204 | 13d ago | Python | Codex · Claude Code |
| HOL Guard | 79 · Good | CLIFreemium | ★ 1.1k | today | Rust | Codex · Claude Code |
| Skill Scanner - Security Scanner for Agent Skills | 62 · Some gaps | CLIFree + model costs | ★ 2.7k | 10d ago | Python | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence: CI workflow uses least privilege (contents: read), release workflow elevates only on merge; HTTP transport defaults to no auth but docs explicitly warn and recommend reverse proxy; scanner itself does not execute scanned code, only static analysis; has input size limits to prevent zip bombs; dependencies have version constraints; has security policy and vulnerability reporting channels. Deductions: user confirmation mechanism only implicit in MCP tool (safe_to_install), CLI scan has no interactive confirmation; rollback mechanism not explicit, only baseline suppression mentioned; data flow transparency partial, LLM analysis sends data to external APIs but docs do not detail data retention and privacy.
Evidence: README, pyproject.toml, CI config, and test files are consistent; dependencies have version ranges but not pinned exact versions (except uv.lock); failure messages designed (e.g., IngestLimitExceededError). Deductions: dependency availability not fully guaranteed as lock file content not provided; failure messages only partially exemplified in docs.
Evidence: Clearly targets Claude Code, Codex, Gemini CLI users; supports multiple input and output formats; has MCP server integration; has batch scanning tool; supports multiple LLM providers. Deductions: trigger precision, MCP tool has only one scan_skill but docs do not detail parameter validation; environment fit, Docker and local install documented but no mention of Windows etc.
Evidence: README structure clear, has doc links; install notes detailed (uv, pip, Docker); naming stable (skillspector); has example output; has known limitations (e.g., HTTP no auth, DeepSeek sunset); Apache-2.0 license; has version number (pyproject.toml 2.8.2) and CI. Deductions: no CHANGELOG file, version history unclear; maintenance responsibility by NVIDIA but no specific maintainers identified.
Evidence: Output formats diverse (terminal, JSON, Markdown, SARIF) for integration; provides risk score and severity labels; baseline suppression reduces false positives; value clear (detect malicious skills). Deductions: cost-benefit not quantified, LLM analysis may incur API costs but docs do not discuss cost optimization.
Evidence: Feature list in README consistent with pyproject.toml description; test files (e.g., test_monkeypatch_fragility.py) verify specific behaviors; CI config present. Deductions: cross-source corroboration limited, relies only on repository internal evidence; fact-inference separation, README claims detection of 68 patterns but no validation data provided.
- HTTP transport has no authentication by default; if bound to a routable interface, configure a reverse proxy and authentication yourself.
- LLM analysis sends skill content to external APIs; assess data privacy and compliance before use.
- Dependencies are not pinned to exact versions; consider using uv.lock or similar for reproducibility.
- No CHANGELOG file; version upgrade history is opaque.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v2.13.4 SkillSpector v2.13.4
Release notes excerpt
SkillSpector 2.13.4 This maintenance release includes the v2.13.3 fixes and selected improvements to provider compatibility, source inspection, and recovery of malformed AI responses. Fixes - [#806](https://github.com/NVIDIA/SkillSpector/pull/806): provider compatibility and structured responses for GPT-6.1 Sol and Claude Opus 5.5 across supported routes. - [#947](https://github.com/NVIDIA/SkillSpector/pull/947), [#950](https://github.com/NVIDIA/SkillSpector/pull/950), and [#973](https://github.com/NVIDIA/SkillSpector/pull/973): bounded parsing of shell, …View on GitHub ↗ -
v2.13.3 SkillSpector v2.13.3
Release notes excerpt
SkillSpector 2.13.3 This patch release builds on the published v2.13.2 maintenance release, preserving its fixes and supported Python versions while adding selected merged P0 security and scan-integrity fixes, including four dependency security updates. Fixes - [#945](https://github.com/NVIDIA/SkillSpector/pull/945): Make the tool-description comparison batch limit configurable with SKILLSPECTOR_TP4_MAX_BATCHES, default 256, and raise the default workflow deadline to 1,080 seconds (18 minutes), …View on GitHub ↗ -
v2.13.2 SkillSpector v2.13.2
Release notes excerpt
SkillSpector 2.13.2 This patch release builds on the published v2.13.1 maintenance release and backports three fixes for false incomplete-analysis reports. It preserves the existing maintenance fixes, third-party dependency lock, and provider defaults. Fixes - [#779](https://github.com/NVIDIA/SkillSpector/pull/779): Recognize command wrappers with no wrapped command at a proven clause boundary. Markdown table cells and ordinary source references to timeout, sudo, nice, and xargs no longer cause false parser-limit reports. Redirections, unfinished fragments, and …View on GitHub ↗
FAQ
Does a static scan require an API key?
skillspector scan ./my-skill/ --no-llm to skip LLM analysis. SC4 will attempt an OSV.dev dependency lookup; OSV.dev needs no API key and falls back to a bundled list if unavailable.What data is sent during LLM analysis?
SKILLSPECTOR_PROVIDER. A recognized valid root-level OpenSSF Model Signing file, skill.oms.sig, remains in the component inventory but is excluded from static and LLM content analysis.Does it execute untrusted skill code?
How should an automated gate act on results?
recommendation: allow SAFE, prompt or warn for CAUTION, and block DO_NOT_INSTALL. The command exit code only distinguishes scores above 50 by returning 1.Can the MCP HTTP server be exposed publicly?
file:// URLs.